4cfeffc865e99ab59c5c9f7134bcd174cdcecac858d2e23f652be4b789a4605a

Analysis

max time kernel
58s
max time network
68s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
08/08/2024, 22:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DiscordSetup.exe
Size

107.6MB
MD5

0f05e59dd6db6f1f24189531edef2f3c
SHA1

eaee1d510f5f2d680be88cfdaa65e595cf7eaeac
SHA256

4cfeffc865e99ab59c5c9f7134bcd174cdcecac858d2e23f652be4b789a4605a
SHA512

a6711294394ebbd619e0234f57ea74f5b1a26611184d9032f4e6e8622123320f7cd30a1154481574973528a2710010906f7caa09929849bb36195430bc0f1f23
SSDEEP

3145728:Cx7oFqxoWk4AxVYZ8JsACTBEMfTQtFz7ff5JdtO4JmUm:KzGWk4AxVYukQtFz7ff5Jd4WHm

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Microsoft\Windows\CurrentVersion\Run\Discord = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\Update.exe\" --processStart Discord.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Microsoft\Windows\CurrentVersion\Run\Discord = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\Update.exe\" --processStart Discord.exe"	reg.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5856_2140654859\_metadata\verified_contents.json	Discord.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5856_2140654859\manifest.fingerprint	Discord.exe
File opened for modification	C:\Windows\SystemTemp	Discord.exe
File opened for modification	C:\Windows\SystemTemp	Discord.exe
File created	C:\Windows\SystemTemp\chrome_url_fetcher_5856_707446113\neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3	Discord.exe
File created	C:\Windows\SystemTemp\chrome_url_fetcher_5856_1927167252\oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win64_adsurwm4gclupf32xdrpgdnapira.crx3	Discord.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5856_2140654859\Google.Widevine.CDM.dll	Discord.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5856_2140654859\manifest.json	Discord.exe

Executes dropped EXE 23 IoCs

pid	Process
392	Update.exe
1976	Discord.exe
5052	Discord.exe
1912	Update.exe
1012	Discord.exe
796	Discord.exe
5000	Update.exe
4904	Discord.exe
1776	Discord.exe
3396	Discord.exe
1788	Discord.exe
4252	Discord.exe
4572	Discord.exe
5856	Discord.exe
5732	Discord.exe
620	Discord.exe
5240	Discord.exe
4100	Discord.exe
5560	Discord.exe
3740	Discord.exe
792	Discord.exe
4456	Discord.exe
2972	Discord.exe

Loads dropped DLL 38 IoCs

pid	Process
1976	Discord.exe
5052	Discord.exe
796	Discord.exe
1012	Discord.exe
1012	Discord.exe
1012	Discord.exe
1012	Discord.exe
1012	Discord.exe
4904	Discord.exe
1776	Discord.exe
4904	Discord.exe
3396	Discord.exe
4252	Discord.exe
1788	Discord.exe
3396	Discord.exe
3396	Discord.exe
3396	Discord.exe
3396	Discord.exe
4252	Discord.exe
4572	Discord.exe
4252	Discord.exe
5856	Discord.exe
5732	Discord.exe
620	Discord.exe
5240	Discord.exe
4100	Discord.exe
620	Discord.exe
620	Discord.exe
620	Discord.exe
4100	Discord.exe
620	Discord.exe
4100	Discord.exe
5856	Discord.exe
5560	Discord.exe
3740	Discord.exe
792	Discord.exe
4456	Discord.exe
2972	Discord.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DiscordSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe

Checks processor information in registry 2 TTPs 28 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Discord.exe

Modifies registry class 27 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Discord\DefaultIcon	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Discord\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9039\\Discord.exe\",-1"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Discord\shell	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Discord\DefaultIcon	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Discord\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9157\\Discord.exe\" --url -- \"%1\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Discord\URL Protocol	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Discord\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9039\\Discord.exe\" --url -- \"%1\""	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Discord	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Discord\URL Protocol	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Discord\shell\open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Discord	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Discord\ = "URL:Discord Protocol"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Discord\shell\open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Discord	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Discord\shell\open\command	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Discord\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9039\\Discord.exe\",-1"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Discord\shell\open	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Discord\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9157\\Discord.exe\",-1"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Discord	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Discord	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Discord\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9039\\Discord.exe\" --url -- \"%1\""	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Discord	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Discord\ = "URL:Discord Protocol"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Discord\DefaultIcon	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Discord\URL Protocol	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Discord	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Discord\ = "URL:Discord Protocol"	reg.exe

Modifies registry key 1 TTPs 15 IoCs

Modify Registry

T1112

pid	Process
788	reg.exe
3460	reg.exe
5700	reg.exe
5740	reg.exe
3448	reg.exe
5544	reg.exe
912	reg.exe
4568	reg.exe
1820	reg.exe
2432	reg.exe
5352	reg.exe
1084	reg.exe
2144	reg.exe
2096	reg.exe
1468	reg.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
1976	Discord.exe
1976	Discord.exe
1976	Discord.exe
1976	Discord.exe
1976	Discord.exe
1976	Discord.exe
1976	Discord.exe
1976	Discord.exe
1976	Discord.exe
1976	Discord.exe
4904	Discord.exe
4904	Discord.exe
4904	Discord.exe
4904	Discord.exe
4904	Discord.exe
4904	Discord.exe
4904	Discord.exe
4904	Discord.exe
4904	Discord.exe
4904	Discord.exe
4252	Discord.exe
4252	Discord.exe
4100	Discord.exe
4100	Discord.exe
5856	Discord.exe
5856	Discord.exe
5856	Discord.exe
5856	Discord.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1976	Discord.exe
Token: SeCreatePagefilePrivilege	1976	Discord.exe
Token: SeShutdownPrivilege	4904	Discord.exe
Token: SeCreatePagefilePrivilege	4904	Discord.exe
Token: SeShutdownPrivilege	4904	Discord.exe
Token: SeCreatePagefilePrivilege	4904	Discord.exe
Token: SeShutdownPrivilege	4904	Discord.exe
Token: SeCreatePagefilePrivilege	4904	Discord.exe
Token: SeShutdownPrivilege	4904	Discord.exe
Token: SeCreatePagefilePrivilege	4904	Discord.exe
Token: SeShutdownPrivilege	4904	Discord.exe
Token: SeCreatePagefilePrivilege	4904	Discord.exe
Token: SeShutdownPrivilege	4904	Discord.exe
Token: SeCreatePagefilePrivilege	4904	Discord.exe
Token: SeShutdownPrivilege	4904	Discord.exe
Token: SeCreatePagefilePrivilege	4904	Discord.exe
Token: SeShutdownPrivilege	4904	Discord.exe
Token: SeCreatePagefilePrivilege	4904	Discord.exe
Token: SeShutdownPrivilege	4904	Discord.exe
Token: SeCreatePagefilePrivilege	4904	Discord.exe
Token: SeShutdownPrivilege	4904	Discord.exe
Token: SeCreatePagefilePrivilege	4904	Discord.exe
Token: SeShutdownPrivilege	4904	Discord.exe
Token: SeCreatePagefilePrivilege	4904	Discord.exe
Token: SeShutdownPrivilege	4904	Discord.exe
Token: SeCreatePagefilePrivilege	4904	Discord.exe
Token: SeShutdownPrivilege	4904	Discord.exe
Token: SeCreatePagefilePrivilege	4904	Discord.exe
Token: SeShutdownPrivilege	4904	Discord.exe
Token: SeCreatePagefilePrivilege	4904	Discord.exe
Token: SeShutdownPrivilege	5856	Discord.exe
Token: SeCreatePagefilePrivilege	5856	Discord.exe
Token: SeShutdownPrivilege	5856	Discord.exe
Token: SeCreatePagefilePrivilege	5856	Discord.exe
Token: SeShutdownPrivilege	5856	Discord.exe
Token: SeCreatePagefilePrivilege	5856	Discord.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
392	Update.exe
5856	Discord.exe
5856	Discord.exe
5856	Discord.exe
5856	Discord.exe
5856	Discord.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
5856	Discord.exe
5856	Discord.exe
5856	Discord.exe
5856	Discord.exe
5856	Discord.exe
5856	Discord.exe
5856	Discord.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 392	2544	DiscordSetup.exe	78
PID 2544 wrote to memory of 392	2544	DiscordSetup.exe	78
PID 2544 wrote to memory of 392	2544	DiscordSetup.exe	78
PID 392 wrote to memory of 1976	392	Update.exe	79
PID 392 wrote to memory of 1976	392	Update.exe	79
PID 1976 wrote to memory of 5052	1976	Discord.exe	80
PID 1976 wrote to memory of 5052	1976	Discord.exe	80
PID 1976 wrote to memory of 1912	1976	Discord.exe	81
PID 1976 wrote to memory of 1912	1976	Discord.exe	81
PID 1976 wrote to memory of 1912	1976	Discord.exe	81
PID 1976 wrote to memory of 1012	1976	Discord.exe	82
PID 1976 wrote to memory of 1012	1976	Discord.exe	82
PID 1976 wrote to memory of 1012	1976	Discord.exe	82
PID 1976 wrote to memory of 1012	1976	Discord.exe	82
PID 1976 wrote to memory of 1012	1976	Discord.exe	82
PID 1976 wrote to memory of 1012	1976	Discord.exe	82
PID 1976 wrote to memory of 1012	1976	Discord.exe	82
PID 1976 wrote to memory of 1012	1976	Discord.exe	82
PID 1976 wrote to memory of 1012	1976	Discord.exe	82
PID 1976 wrote to memory of 1012	1976	Discord.exe	82
PID 1976 wrote to memory of 1012	1976	Discord.exe	82
PID 1976 wrote to memory of 1012	1976	Discord.exe	82
PID 1976 wrote to memory of 1012	1976	Discord.exe	82
PID 1976 wrote to memory of 1012	1976	Discord.exe	82
PID 1976 wrote to memory of 1012	1976	Discord.exe	82
PID 1976 wrote to memory of 1012	1976	Discord.exe	82
PID 1976 wrote to memory of 1012	1976	Discord.exe	82
PID 1976 wrote to memory of 1012	1976	Discord.exe	82
PID 1976 wrote to memory of 1012	1976	Discord.exe	82
PID 1976 wrote to memory of 1012	1976	Discord.exe	82
PID 1976 wrote to memory of 1012	1976	Discord.exe	82
PID 1976 wrote to memory of 1012	1976	Discord.exe	82
PID 1976 wrote to memory of 1012	1976	Discord.exe	82
PID 1976 wrote to memory of 1012	1976	Discord.exe	82
PID 1976 wrote to memory of 1012	1976	Discord.exe	82
PID 1976 wrote to memory of 1012	1976	Discord.exe	82
PID 1976 wrote to memory of 1012	1976	Discord.exe	82
PID 1976 wrote to memory of 1012	1976	Discord.exe	82
PID 1976 wrote to memory of 1012	1976	Discord.exe	82
PID 1976 wrote to memory of 1012	1976	Discord.exe	82
PID 1976 wrote to memory of 796	1976	Discord.exe	83
PID 1976 wrote to memory of 796	1976	Discord.exe	83
PID 1976 wrote to memory of 912	1976	Discord.exe	84
PID 1976 wrote to memory of 912	1976	Discord.exe	84
PID 1976 wrote to memory of 788	1976	Discord.exe	86
PID 1976 wrote to memory of 788	1976	Discord.exe	86
PID 1976 wrote to memory of 1084	1976	Discord.exe	88
PID 1976 wrote to memory of 1084	1976	Discord.exe	88
PID 1976 wrote to memory of 4568	1976	Discord.exe	90
PID 1976 wrote to memory of 4568	1976	Discord.exe	90
PID 1976 wrote to memory of 3460	1976	Discord.exe	92
PID 1976 wrote to memory of 3460	1976	Discord.exe	92
PID 5000 wrote to memory of 4904	5000	Update.exe	102
PID 5000 wrote to memory of 4904	5000	Update.exe	102
PID 4904 wrote to memory of 1776	4904	Discord.exe	103
PID 4904 wrote to memory of 1776	4904	Discord.exe	103
PID 4904 wrote to memory of 3396	4904	Discord.exe	104
PID 4904 wrote to memory of 3396	4904	Discord.exe	104
PID 4904 wrote to memory of 3396	4904	Discord.exe	104
PID 4904 wrote to memory of 3396	4904	Discord.exe	104
PID 4904 wrote to memory of 3396	4904	Discord.exe	104
PID 4904 wrote to memory of 3396	4904	Discord.exe	104
PID 4904 wrote to memory of 3396	4904	Discord.exe	104
PID 4904 wrote to memory of 3396	4904	Discord.exe	104

C:\Users\Admin\AppData\Local\Temp\DiscordSetup.exe
"C:\Users\Admin\AppData\Local\Temp\DiscordSetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:392
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\Discord.exe" --squirrel-install 1.0.9039
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1976
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\Discord.exe
      C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9039 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=28.2.10 --initial-client-data=0x50c,0x510,0x514,0x504,0x51c,0x7ff634f11e08,0x7ff634f11e14,0x7ff634f11e20
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5052
  - - C:\Users\Admin\AppData\Local\Discord\Update.exe
      C:\Users\Admin\AppData\Local\Discord\Update.exe --createShortcut Discord.exe --setupIcon C:\Users\Admin\AppData\Local\Discord\app.ico
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1912
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1864 --field-trial-handle=1868,i,17592004266107964049,13171937364091266891,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1012
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --mojo-platform-channel-handle=2116 --field-trial-handle=1868,i,17592004266107964049,13171937364091266891,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:796
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "\"C:\Users\Admin\AppData\Local\Discord\Update.exe\" --processStart Discord.exe" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:912
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:788
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:1084
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\Discord.exe\",-1" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:4568
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\Discord.exe\" --url -- \"%1\"" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:3460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1368

C:\Users\Admin\AppData\Local\Discord\Update.exe
"C:\Users\Admin\AppData\Local\Discord\Update.exe" --processStart Discord.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\Discord.exe
  "C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\Discord.exe"
  2⤵
  - Drops file in Windows directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\Discord.exe
    C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9039 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=28.2.10 --initial-client-data=0x518,0x51c,0x520,0x510,0x524,0x7ff634f11e08,0x7ff634f11e14,0x7ff634f11e20
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1776
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2220 --field-trial-handle=2224,i,15365464282863912072,15385243559270331047,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3396
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=disclip --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip --mojo-platform-channel-handle=2292 --field-trial-handle=2224,i,15365464282863912072,15385243559270331047,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1788
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\Discord.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=0 --gpu-device-id=0 --gpu-sub-system-id=0 --gpu-revision=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2748 --field-trial-handle=2224,i,15365464282863912072,15385243559270331047,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4252
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:1820
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=disclip --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3136 --field-trial-handle=2224,i,15365464282863912072,15385243559270331047,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4572
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:2144
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\Discord.exe\",-1" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:1468
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\Discord.exe\" --url -- \"%1\"" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:2432
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord
    3⤵
    - Modifies registry key
    PID:2096
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "\"C:\Users\Admin\AppData\Local\Discord\Update.exe\" --processStart Discord.exe" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:5352
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9157\Discord.exe
    C:\Users\Admin\AppData\Local\Discord\app-1.0.9157\Discord.exe
    3⤵
    - Drops file in Windows directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:5856
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9157\Discord.exe
      C:\Users\Admin\AppData\Local\Discord\app-1.0.9157\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9157 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=30.2.0 --initial-client-data=0x53c,0x540,0x544,0x534,0x548,0x7ff7cea7f218,0x7ff7cea7f224,0x7ff7cea7f230
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5732
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9157\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9157\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1904,i,8347065134365170002,10794715649676303133,262144 --enable-features=kWebSQLAccess --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1892 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:620
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9157\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9157\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --field-trial-handle=2204,i,8347065134365170002,10794715649676303133,262144 --enable-features=kWebSQLAccess --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5240
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9157\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9157\Discord.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=0 --gpu-device-id=0 --gpu-sub-system-id=0 --gpu-revision=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2220,i,8347065134365170002,10794715649676303133,262144 --enable-features=kWebSQLAccess --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:4100
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:3448
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9157\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9157\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9157\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3264,i,8347065134365170002,10794715649676303133,262144 --enable-features=kWebSQLAccess --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5560
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:5544
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9157\Discord.exe\",-1" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:5700
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9157\Discord.exe\" --url -- \"%1\"" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:5740
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "chcp"
      4⤵
      PID:1272
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:1580
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9157\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9157\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9157\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3764,i,8347065134365170002,10794715649676303133,262144 --enable-features=kWebSQLAccess --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3940 --enable-node-leakage-in-renderers /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3740
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9157\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9157\Discord.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --field-trial-handle=4012,i,8347065134365170002,10794715649676303133,262144 --enable-features=kWebSQLAccess --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4008 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:792
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9157\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9157\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9157\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4128,i,8347065134365170002,10794715649676303133,262144 --enable-features=kWebSQLAccess --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4124 --enable-node-leakage-in-renderers /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      PID:4456
    - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9157\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe
        
        "\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9157\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" nvidia
        5⤵
        
        PID:3312
    - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9157\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe
        
        "\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9157\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" amd
        5⤵
        
        PID:5644
    - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9157\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe
        
        "\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9157\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" intel
        5⤵
        
        PID:5580
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9157\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9157\Discord.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --field-trial-handle=3304,i,8347065134365170002,10794715649676303133,262144 --enable-features=kWebSQLAccess --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2972
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9157\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9157\Discord.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --field-trial-handle=4160,i,8347065134365170002,10794715649676303133,262144 --enable-features=kWebSQLAccess --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:8
      4⤵
      PID:1068
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9157\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9157\Discord.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --field-trial-handle=4292,i,8347065134365170002,10794715649676303133,262144 --enable-features=kWebSQLAccess --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:8
      4⤵
      PID:2664

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004E8
1⤵
PID:408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Discord\SquirrelSetup.log

Filesize
2KB

MD5
fd8cb1e4692a943d6df07ea57a51a694

SHA1
3ba4e9b8950c5ae8bca9f9c394fffad8a0198afb

SHA256
842c852ef864722d9f3929d5145e19ebcae6ad1123518f714ea44488698cc077

SHA512
f0bdfee3508615f1bf1bda3cfc292533be30d6fc09ef934f7ee2650af49b106ac7f67b3d9356ec63017f7c5100b91b97f4a0147531d6d9ab91ceec2f4a0eb88f

Download Submit
C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\D3DCompiler_47.dll

Filesize
4.7MB

MD5
a7b7470c347f84365ffe1b2072b4f95c

SHA1
57a96f6fb326ba65b7f7016242132b3f9464c7a3

SHA256
af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a

SHA512
83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d

Download Submit
C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\app.ico

Filesize
278KB

MD5
084f9bc0136f779f82bea88b5c38a358

SHA1
64f210b7888e5474c3aabcb602d895d58929b451

SHA256
dfcea1bea8a924252d507d0316d8cf38efc61cf1314e47dca3eb723f47d5fe43

SHA512
65bccb3e1d4849b61c68716831578300b20dcaf1cbc155512edbc6d73dccbaf6e5495d4f95d089ee496f8e080057b7097a628cc104fa8eaad8da866891d9e3eb

Download Submit
C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\chrome_100_percent.pak

Filesize
163KB

MD5
4fc6564b727baa5fecf6bf3f6116cc64

SHA1
6ced7b16dc1abe862820dfe25f4fe7ead1d3f518

SHA256
b7805392bfce11118165e3a4e747ac0ca515e4e0ceadab356d685575f6aa45fb

SHA512
fa7eab7c9b67208bd076b2cbda575b5cc16a81f59cc9bba9512a0e85af97e2f3adebc543d0d847d348d513b9c7e8bef375ab2fef662387d87c82b296d76dffa2

Download Submit
C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\chrome_200_percent.pak

Filesize
222KB

MD5
47668ac5038e68a565e0a9243df3c9e5

SHA1
38408f73501162d96757a72c63e41e78541c8e8e

SHA256
fac820a98b746a04ce14ec40c7268d6a58819133972b538f9720a5363c862e32

SHA512
5412041c923057ff320aba09674b309b7fd71ede7e467f47df54f92b7c124e3040914d6b8083272ef9f985eef1626eaf4606b17a3cae97cfe507fb74bc6f0f89

Download Submit
C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\ffmpeg.dll

Filesize
4.0MB

MD5
3b144ca3a86b93b598c5e276f8af8ce5

SHA1
3242f79d18ebe5cab597edc5b4d4a7c106122091

SHA256
e1b56237dde36ac4e54a9260edc002eba84013766705b523024ae0487b3d2802

SHA512
c3dd9493bab8737cc40695a504ccd6991ffe016ccb62fa2d638d0bed2ba340cf721aa980dc8ca9f000c349b6e9274f3fd7db9e707bbb68144d7f6f7bfc6e8bf9

Download Submit
C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\icudtl.dat

Filesize
10.2MB

MD5
e0f1ad85c0933ecce2e003a2c59ae726

SHA1
a8539fc5a233558edfa264a34f7af6187c3f0d4f

SHA256
f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb

SHA512
714ed5ae44dfa4812081b8de42401197c235a4fa05206597f4c7b4170dd37e8360cc75d176399b735c9aec200f5b7d5c81c07b9ab58cbca8dc08861c6814fb28

Download Submit
C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\libegl.dll

Filesize
485KB

MD5
d59984d564e0d993b6fd20a2d931edd5

SHA1
0025bcce3adfa89767b2977b75a3fe8e68afb9c6

SHA256
857a81924d76aefc2a6a833b312c1be96f4cbecfb4d49ca5cb587af82f5851b4

SHA512
a20b18464dd4d65b3025452bd109d6d8858bff3d3d5a9a549d29663877c50b0b7d979d3c6aff6070730953470175fe5b397cf133b798e3c16d61207992ad27de

Download Submit
C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\libglesv2.dll

Filesize
7.5MB

MD5
964988bed852087bff9babe0539e82e3

SHA1
80b5ae090578b5a1152a8dd47f33d733baf928d2

SHA256
c11d5607127d476cf5b067cbbbd001f743a56f4fb8d97c0b679c1e235d8db482

SHA512
0275fbfe1dd17b2eda06b9d9503524761eb208229e226b56ab86476e45345922c673944e16e967ca5c4ba6d573304a0332c154bd4bc0cbea4de19387b44ea879

Download Submit
C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\locales\en-US.pak

Filesize
428KB

MD5
809b600d2ee9e32b0b9b586a74683e39

SHA1
99d670c66d1f4d17a636f6d4edc54ad82f551e53

SHA256
0db4f65e527553b9e7bee395f774cc9447971bf0b86d1728856b6c15b88207bb

SHA512
9dfbe9fe0cfa3fcb5ce215ad8ab98e042760f4c1ff6247a6a32b18dd12617fc033a3bbf0a4667321a46a372fc26090e4d67581eaab615bf73cc96cb90e194431

Download Submit
C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\resources.pak

Filesize
5.1MB

MD5
e9056386a2b4edac9f0ffa829bc0cfa0

SHA1
f8d4b8289ebb088c9997a1fde1c2f12aedd6c82e

SHA256
546456d9a1328836a99876824f3beb7279f38403cd001515f5d9eb204939e57c

SHA512
c49e832e5c16a1846ea882395e83f9cbe9f4f6b44be9f0c7276d0a4495b88091bd95593c5e167dba853834058d7ca823db60d2fac73434ed952b7064b2daf6da

Download Submit
C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\resources\app.asar

Filesize
6.3MB

MD5
18c82fef289b0aa9fff73ce8489c69f5

SHA1
76999d747423ef5cd9cc0a1fa039a7fad6c89763

SHA256
c5e9c322296f97c42132aa29cf9e94e372e9de3b83e2fd1266340ab476b2d821

SHA512
529bb2a0c8c399b4815740928a1b74bbce23d04f9cffeb2be2d12b46f3d3aad00d4498ba95fad0e8d82e52850f6b5395041b65931c63123ab5c95c15d5a82a26

Download Submit
C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\resources\build_info.json

Filesize
83B

MD5
2975d2275891f5984e461bdf7c5ac170

SHA1
c324f18d726e6591e56b2117703b2d23e1d335df

SHA256
415f673c0b3933f8bd08e30421b85f0d75f2f2339bd3e4a29f85fc5c7c98f457

SHA512
31f50d242ab3cd59fea7ebc22368f6b42574602ee5abd2905ecc3722cf40fad590c30028e6aa2c2b2be64d5954c09086bdb89900e8d47e3f60ab5dcd1e2a1e28

Download Submit
C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\updater.node

Filesize
3.9MB

MD5
a8bb326aa7d1f1865f17229c426f2537

SHA1
2a45ad79f23b66f80399cc4dda2e0d165440d173

SHA256
bcd90a02b6a33c397b610528c24ba418c28eb85e19c869f2b31ca2f41bbcc7a3

SHA512
95b9ff329d2d7360ed7bc73d723018fb4b4b719e3fe22e3649429f9b69692c11f260efb42f6952d40bca221941855f61f3105bbb9c7ea9500ae401a802e3c106

Download Submit
C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\v8_context_snapshot.bin

Filesize
627KB

MD5
1e4da0bc6404552f9a80ccde89fdef2b

SHA1
838481b9e4f1d694c948c0082e9697a5ed443ee2

SHA256
2db4a98abe705ef9bc18e69d17f91bc3f4c0f5703f9f57b41acb877100718918

SHA512
054917652829af01977e278cd0201c715b3a1280d7e43035507e4fa61c1c00c4cd7ed521c762aebd2ea2388d33c3d4d4b16cee5072d41e960021b6f38745a417

Download Submit
C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\vk_swiftshader.dll

Filesize
5.0MB

MD5
7b30cf3340e7f9455f05ec49bb53059e

SHA1
c3df8f550d9dab1d9385241d5fb58c0e4392ed5f

SHA256
8093951273c4df941d7e843de66bd7ac3a55e70a541a6bdbd14c4b4fea1839ad

SHA512
547c81a4423a6e673e63620631de2ca9f945b44cdac1f4b1c7db7b9eff2a6f12fbfd5a9f6281ea69e3455270c19d566aef1d27b7662bb42b2bdf01fab6f8efe2

Download Submit
C:\Users\Admin\AppData\Local\Discord\download\0019252a2676f18ea385502a56bdcad495ff410934da442b6734051be5a7c86a

Filesize
315KB

MD5
843d1b558584daffb2dec56fae86314a

SHA1
673bbcb5be8db4762745fe84c0b118643831f485

SHA256
0019252a2676f18ea385502a56bdcad495ff410934da442b6734051be5a7c86a

SHA512
9e6d79536e587e479a420c9db644f9c6157b02d38bd9279666fb9327e9a804dce4213023095622a88df3f46e5f5d4dec1dabdc61512071f26ace8c7e9c61d9c9

Download Submit
C:\Users\Admin\AppData\Local\Discord\download\1f51b02580dfa42771ed1e02ad24ce0d1182a878948a06a8c93c3977e814d352

Filesize
9.4MB

MD5
92010c1a3480767fa7877cd3960c2a82

SHA1
85af599d63d591cdfa195f6c313cec2f1ba83648

SHA256
1f51b02580dfa42771ed1e02ad24ce0d1182a878948a06a8c93c3977e814d352

SHA512
a790290986ceda5d01f3d74d6fa23aef43ee6bf2c56f55e825828226a4daf65b893941c8801f4245aff29b853d086178653807724133e9b1ea90c52fee0407a6

Download Submit
C:\Users\Admin\AppData\Local\Discord\download\38bb5692302f851864b92dc27eb5106eca553d424cc64cb7f03fd3f703819957

Filesize
16.6MB

MD5
4ae3305e9c2471f4c1246dfb7bccada8

SHA1
db6f70d9564bacb962ac4440f6efbe179545a27d

SHA256
38bb5692302f851864b92dc27eb5106eca553d424cc64cb7f03fd3f703819957

SHA512
d47f4a24610c920aa3ee01fa1c3e3d6a9ffd5c53ea4fd7c6ab529ea2e925ec8a78d94497a7388535a3e085b7881bbcad9eb63ac1c6c2dc3471e8b5e40391a589

Download Submit
C:\Users\Admin\AppData\Local\Discord\download\4835c1ebfa93b0a858bf4a670386164906ae96b6e97770935c6460efcebc6193

Filesize
187KB

MD5
6fb77c2d6fb560dbb90d2cee4e624e1f

SHA1
36d45959828f7ecc26de52d86f8973248125b450

SHA256
4835c1ebfa93b0a858bf4a670386164906ae96b6e97770935c6460efcebc6193

SHA512
869b132f85f2bf17407fd4d51119c9371f8ad7c0b680c552b55a9cdbfebef7c174777a83e63bdd6fe2adc3671c3f8ad4f98abbcd35e3ec941fab46863efa6de1

Download Submit
C:\Users\Admin\AppData\Local\Discord\download\4fd25a19f65cb07aa6a32ca6e5f088e743814f9ffdebcd257c9055f3c26fe804

Filesize
1.6MB

MD5
1b231cabe908c99a432589e00f66b573

SHA1
816d83bad2803bbb629439ad6514681cae240f73

SHA256
4fd25a19f65cb07aa6a32ca6e5f088e743814f9ffdebcd257c9055f3c26fe804

SHA512
fa274cdd64c9bf7c7511c01124d9809a9adbad465a9cd72c53b4b8934da2d3119cd7266b4eb015c9812287548e89664f577b0dcaf21f24d582a52c4a39ed3b87

Download Submit
C:\Users\Admin\AppData\Local\Discord\download\51224f45d61b973eafe14cdaa0f0c6b5df238e991d16e024a4630dccd367204c

Filesize
413KB

MD5
d591ef0eb08139e189b54d917ffb32f9

SHA1
a26dfd16c1db31ed1fe686904fcf4a15f3dab763

SHA256
51224f45d61b973eafe14cdaa0f0c6b5df238e991d16e024a4630dccd367204c

SHA512
a6e5c808f62a0712f4123a8a90504e7325b09dc8dee1e781e4b53b04d4bbe3a4a07d902d2afea0c806641708ed89dc0e203f61faf9bc470becd67431e66c368b

Download Submit
C:\Users\Admin\AppData\Local\Discord\download\901138f41106b9be41b2060f6c0dca2575fff2ce180648123e13cd1ae0b5a417

Filesize
232KB

MD5
9548b68e9d3f28b4703fda6189ba4ce3

SHA1
610ddd909be78792f6ed8c20b9d3a488d4bc7a71

SHA256
901138f41106b9be41b2060f6c0dca2575fff2ce180648123e13cd1ae0b5a417

SHA512
64a22ad69f551ac6fa5bb0fe012e34d8d1d91536d622019f6172e29267e0db81350ab01435742d38c21a2afa7920db0f8a65f071fe54be5ad4a3dacfae1a9343

Download Submit
C:\Users\Admin\AppData\Local\Discord\download\9a895a19ca16424e86411195de779075638b82c2ef0282987aca91b262cda66d

Filesize
465KB

MD5
9d822d45ded64773490a4971cc91ea77

SHA1
e8484a8f6f053bfdc2b9355dfa5e93ba0fa0d4ac

SHA256
9a895a19ca16424e86411195de779075638b82c2ef0282987aca91b262cda66d

SHA512
97ce8fc0440e701099b23cbb9b47f4b869b9d177b7d38f2ce61689e4276e3841854d2f6adb1c234fcb444a9e2be3c06f68e69abca9bb8ff6265010d7eae80f82

Download Submit
C:\Users\Admin\AppData\Local\Discord\download\d58fdb78575e512b09e8bad7d23704f9a7791617a774dfba7a210b7e455f64d4

Filesize
1.5MB

MD5
0a942bff301c51afa0d203b717b5af9e

SHA1
91cadb449670364b51378a366057e1077f2f2438

SHA256
d58fdb78575e512b09e8bad7d23704f9a7791617a774dfba7a210b7e455f64d4

SHA512
72c61709f3ab61217e887fd1c35616e8dd7db59962609eb878fbf501e2a40925f1d0090560249e520930d71b6d6b816b3a8298e08a90ef1df065b1494c405da6

Download Submit
C:\Users\Admin\AppData\Local\Discord\installer.db

Filesize
120KB

MD5
215ac01272b9a55b524a0e3871c217b7

SHA1
a2b7224896f5a6b089d17f6b6625e0ab66d137ec

SHA256
e9bdd93cae1fac5e967cb4d049d6f933ef6b2ae94620e3a89dea1e4ff2c5dfcf

SHA512
d86bf17a5f959670c668d7fff6a60333a563356c8bca65724243bb4823fe0dd2529ed2b0f57769072fa000f3fa5a56e57b6c0a77cf4aaac327f414f42a8d16ea

Download Submit
C:\Users\Admin\AppData\Local\Discord\installer.db

Filesize
220KB

MD5
165b0f864801969b9456b976ac5b9f6a

SHA1
e528ed1aa08be630910ebacca9520be932fc2208

SHA256
707456a2805cd7b3143f359810bf6a4700fbe350d455c73cd3307f678949c5a8

SHA512
93479bc80639548238d011d4bc364932223bea21102aced1d7b1042a5aee9dd7ca287a1b3a96bb87a7b242caf81efee489938a473a2b2fb7134c384792d692c5

Download Submit
C:\Users\Admin\AppData\Local\Discord\packages\RELEASES

Filesize
73B

MD5
b21c00a8b7404b8382ec366371a92a03

SHA1
6d43c013609b6a45e84cf31ae10053a00437d36d

SHA256
cb304d925efe61ae0f6e45ef03a2c867ecf525aa07909c62f81f25c6c674535e

SHA512
c1b67025b94d97a5875857d69c54645bc6168b071e6d83e0b7486a8ef86d627b23f0f3f4544c3f31e5f7ea5f3db2c57339cece07480cd0eb68b87a37ebcbdecf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Update.exe.log

Filesize
1KB

MD5
4ada7084cc38c692f12f230177e66c30

SHA1
45da6d7b2b61c3f670945bc6b73aa35c975c44f3

SHA256
7b4e3cb73d709049bf3dfcdc19c408e1c647c0f55634635097d8cee75cd63103

SHA512
4cfd2e3bdee8956e4d7103f574b00304967ee38ffeb5c8a1449910593d7b21fe7b1a838e37bb6ba003874ad54f0b276566663b437ef32cf3db953bba2eff0cf6

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES

Filesize
81B

MD5
889e8bb8736b46bdfd7ad23bd01160df

SHA1
28ba62b3cda6201f3f1762f4ad08278ad33cb457

SHA256
c43cd0178df567b13b4f9db6f922837ce469b7d7895d95b67411cadfaba406be

SHA512
8f89155a18d70a161fbf2969e1cbe76c60e2c721327501ee8e87dd47d7eeb5c78e9499a2a7ad148b5f4a3b95cfa3e34cd3c688a3a6d87183de2ce134b87617a4

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe

Filesize
1.5MB

MD5
cda59f2b2d10a302305e981e201e7299

SHA1
6979afd44577adbec13a40d5b7d040f6aea2c351

SHA256
85e1c8011049dcdcde58f2f1bd5a5451485ea27f511c564a58e5b724d13b8a57

SHA512
42b5703c12a281eb8260e0e7bc3a109358ce5a981f34e7e055be3a6d0782cd00e99891c627a99208bc03acf82e2beb6b26a62f479c1c9cd93f40c79e443445b8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\discord\Cache\Cache_Data\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Roaming\discord\Crashpad\settings.dat

Filesize
40B

MD5
76fceb1565ce9b45d54bfbcb3d4e6833

SHA1
164dd5ee9202c4567bbfabe51d15c315a0823aa7

SHA256
c8353130bdbf7b936bf5b52461c9ebe40ef0b06ebf8592e7f1dbd8f37f9270df

SHA512
2fdcc802e3f1394ab34e7067e9502aa1b7590ed1e19c70f02013b355c898a07b60bf065d746371259a41b9c383ecd6fc468f3a2e689996c27d16f4505b4e575d

Download Submit
C:\Users\Admin\AppData\Roaming\discord\DawnCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Roaming\discord\DawnCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Roaming\discord\DawnCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Roaming\discord\Local State

Filesize
434B

MD5
d0c84c8804fdab96f458801359918424

SHA1
cbae7505bff945c1ebfd86245e9873cc470b6582

SHA256
17f71ee36b7cb13298eac9dee55282977060b20aba5e4bc3847d06e36e2e8695

SHA512
d095baa5b5c628618cbfb6a26f8c5450c8a6641fb8ea84fa794342e54f9126e0cf52679c7993389e25e8c0494c28a2bcba34d9eaf31c7b9b16a9203ccac5898b

Download Submit
C:\Users\Admin\AppData\Roaming\discord\Local Storage\leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\discord\Local Storage\leveldb\LOG

Filesize
247B

MD5
96a779f2b496c39d2bd1f7b3f43a9c76

SHA1
79172e1d25a90a72e84db5f47a088c1af26b5d61

SHA256
e3c5724c5e4ed585e044e16e36922f44e50e12aba2e0cdc87defeb36d6e83f31

SHA512
581ad6687b966bc9b1da2876e18128b0ef56cbc5520d84af3f75a57983ea8869887eb2d49e976f09b4381af567a6be876c37c1e062d9b9e1320dc296610f74c4

Download Submit
C:\Users\Admin\AppData\Roaming\discord\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Roaming\discord\MediaFoundationWidevineCdm\x64\1.0.2738.0\_metadata\verified_contents.json

Filesize
1KB

MD5
3e839ba4da1ffce29a543c5756a19bdf

SHA1
d8d84ac06c3ba27ccef221c6f188042b741d2b91

SHA256
43daa4139d3ed90f4b4635bd4d32346eb8e8528d0d5332052fcda8f7860db729

SHA512
19b085a9cfec4d6f1b87cc6bbeeb6578f9cba014704d05c9114cfb0a33b2e7729ac67499048cb33823c884517cbbdc24aa0748a9bb65e9c67714e6116365f1ab

Download Submit
C:\Users\Admin\AppData\Roaming\discord\MediaFoundationWidevineCdm\x64\1.0.2738.0\manifest.fingerprint

Filesize
66B

MD5
d30a5bbc00f7334eede0795d147b2e80

SHA1
78f3a6995856854cad0c524884f74e182f9c3c57

SHA256
a08c1bc41de319392676c7389048d8b1c7424c4b74d2f6466bcf5732b8d86642

SHA512
dacf60e959c10a3499d55dc594454858343bf6a309f22d73bdee86b676d8d0ced10e86ac95ecd78e745e8805237121a25830301680bd12bfc7122a82a885ff4b

Download Submit
C:\Users\Admin\AppData\Roaming\discord\Network\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Roaming\discord\Network\Network Persistent State

Filesize
300B

MD5
03bf815ca21d7ea02a338d968f6d6135

SHA1
89040511626e507b08a980455e360ae8af409246

SHA256
4bb0fad0f398f7dd086a0b4d8517699f202e520d0506aad4574e7ec8cb130ff4

SHA512
797ab57ab8aac1c0f46343e2c33bbac6e9f2c144e4b4c87123af3c09c5a6250ec62d2b3dd2fd7437891dd04a452c45be1727291a41c9330ea096ee22ca5ac58e

Download Submit
C:\Users\Admin\AppData\Roaming\discord\Network\Trust Tokens

Filesize
36KB

MD5
7cd8862624e6351a668a8eb081771936

SHA1
52954f29c41d097829692a34fd7dbe0d19817ad2

SHA256
392896d3b54a13cd2c53da93c3c798c2434a02addd5ab916f156d2fb196e689f

SHA512
fe2e5f59b46ae25f1d5f88a87ec4a0c12fa46ecaf3c4805b6b4abb195594b7ae70c919490f684bd711330c8643c9160688bfa9ddbd44ee1592fe63212e2ab0ad

Download Submit
C:\Users\Admin\AppData\Roaming\discord\Preferences

Filesize
57B

MD5
58127c59cb9e1da127904c341d15372b

SHA1
62445484661d8036ce9788baeaba31d204e9a5fc

SHA256
be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de

SHA512
8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a

Download Submit
C:\Users\Admin\AppData\Roaming\discord\Shared Dictionary\cache\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Roaming\discord\Shared Dictionary\cache\index-dir\the-real-index

Filesize
48B

MD5
801630187f303c0132b319bb4e98a4fd

SHA1
e187324d8156d09f2a79fc0fbb2236151c3b5a65

SHA256
02513175e16f63fd74a17ec67347f47993f93177d9a868d28e1de9888c59f599

SHA512
5bdc9901e05955b4cdeb5fd07828679101499e4abb34f7bd20a715eba2c0d99445620e5160de92a05214edb6dd4770c82e12e5a884f7a8b4f400382b00b7d497

Download Submit
C:\Users\Admin\AppData\Roaming\discord\Shared Dictionary\db

Filesize
44KB

MD5
4d4863ce15ec9c7dfdc50c288a2d2d1a

SHA1
4494a5c4eab04af1efc9a2d7e1d996064d489512

SHA256
2ef9ab8ec9e6b879a77d1d9dbe7d18a2171f50ff37e803bbd0243af1b87dcb15

SHA512
d34f62eac5f9f0540ed0c6f3c6fcf6713c4546a5625eedc43ecb2cead6af30b387764703637fdaa4ae69d0b6cd31b2e47d6639c41b841d46327886c7a5741247

Download Submit
C:\Users\Admin\AppData\Roaming\discord\component_crx_cache\neifaoindggfcjicffkgpmnlppeffabd_1.c900ba9a2d8318263fd43782ee6fd5fb50bad78bf0eb2c972b5922c458af45ed

Filesize
1.1MB

MD5
f265d47475ffd3884329d92deefae504

SHA1
98c74386481f171b09cb9490281688392eefbfdd

SHA256
c900ba9a2d8318263fd43782ee6fd5fb50bad78bf0eb2c972b5922c458af45ed

SHA512
4fd27594c459fb1cd94a857be10f7d1d6216dbf202cd43e8a3fa395a268c72fc5f5c456c9cb314f2220d766af741db469c8bb106acbed419149a44a3b87619f1

Download Submit
C:\Users\Admin\AppData\Roaming\discord\component_crx_cache\oimompecagnajdejgnnjijobebaeigek_1.d9a253514b6a010dfc1916c55246797e5773f13844ea3ec2d25078e845fef760

Filesize
13.7MB

MD5
17c227679ab0ed29eae2192843b1802f

SHA1
cc78820a5be29fd58da8ef97f756b5331db3c13e

SHA256
d9a253514b6a010dfc1916c55246797e5773f13844ea3ec2d25078e845fef760

SHA512
7e33288afd65948a5752323441c42fcc437d7c12d1eaf7a9b6ae1995784d0771e15637f23cc6bc958e40ea870414543d67a27b4c20331fde93d5b6dc6a59cbaf

Download Submit
C:\Users\Admin\AppData\Roaming\discord\module_data\crashlogs\2024_08_08T22_33_03_583Z-0-events.log

Filesize
254B

MD5
6d49cb2840d697eb7d7bf356e00d837f

SHA1
e0a10b44664612f9e3a771acbc1e5fe9b50c1c4a

SHA256
bf1689947b51283bc96c603cb0836511f943d3d3151363c34d28e806381f7a66

SHA512
4d8646676fc105376aaea3e1dcce7844db640cad0c1f5fcef12616021caceb61784caf3877fa63508d368fc89f6978209d61b418f1e283f1b8987af3bec84096

Download Submit
C:\Users\Admin\AppData\Roaming\discord\sentry\queue\queue.json

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Roaming\discord\sentry\scope_v3.json

Filesize
8KB

MD5
fd003e969962752d5df000e442f846e0

SHA1
998c7f71b8b381d79a3359248c1eca6bb11076c5

SHA256
8953de46c64dd69e0940eb13c6f56943b6273e0a666eb27ae7c9399e2e0e5cff

SHA512
e392c221aa2a8a42498d46f413ae095363c7a9eaef4ca7f2a5bd8d32c80041566924c304786937a29c6138fb2a251a0785276f94c542fcae938d65e8b105abed

Download Submit
C:\Users\Admin\AppData\Roaming\discord\sentry\scope_v3.json

Filesize
1KB

MD5
8f8518f5167ced5e7ca35e16c5c66f07

SHA1
ab88b2d5223b0f00dd35df286e404f113f4d508d

SHA256
54dbdb111ed2c19770ba77abfab1757df2ceea0f48f736758e58e38cc6006303

SHA512
6428901be5e56319ed5e1788c953f137b29ffdef3f73fbd5f4a02794e4dd8df3e1f560aa7e4cebc2aa99de1d0733c937f58a9befedd9389aad177e7b955b6259

Download Submit
C:\Users\Admin\Desktop\Discord.lnk

Filesize
2KB

MD5
2cc72e47bd66c9ebf5feccdf5d3f32c5

SHA1
3245b9e05ea13dc69710a34b3da0618335efe94b

SHA256
3653c3a1e47c99a41b3fc91779503183353c57c460098a392ec1a5056086cdd7

SHA512
adf6dd4247e3d9fa4e430c5c5b377966ef076966e65e3120b379c74d10d72f23186f6d84cf65c6a43548fac3d8842d87c7eec8f6c19bc8258423b16598666d84

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5856_1097953756\manifest.json

Filesize
1001B

MD5
2648d437c53db54b3ebd00e64852687e

SHA1
66cfe157f4c8e17bfda15325abfef40ec6d49608

SHA256
68a3d7cb10f3001f40bc583b7fff0183895a61d3bd1b7a1c34e602df6f0f8806

SHA512
86d5c3129bec156b17b8ebd5dec5a6258e10cb426b84dd3e4af85c9c2cd7ebf4faea01fd10dd906a18ea1042394c3f41a835eae2d83dc8146dfe4b6d71147828

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5856_2140654859\Google.Widevine.CDM.dll

Filesize
2.7MB

MD5
477c17b6448695110b4d227664aa3c48

SHA1
949ff1136e0971a0176f6adea8adcc0dd6030f22

SHA256
cb190e7d1b002a3050705580dd51eba895a19eb09620bdd48d63085d5d88031e

SHA512
1e267b01a78be40e7a02612b331b1d9291da8e4330dea10bf786acbc69f25e0baece45fb3bafe1f4389f420ebaa62373e4f035a45e34eada6f72c7c61d2302ed

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5856_2140654859\manifest.json

Filesize
145B

MD5
bbc03e9c7c5944e62efc9c660b7bd2b6

SHA1
83f161e3f49b64553709994b048d9f597cde3dc6

SHA256
6cce5ad8d496bc5179fa84af8afc568eeba980d8a75058c6380b64fb42298c28

SHA512
fb80f091468a299b5209acc30edaf2001d081c22c3b30aad422cbe6fea7e5fe36a67a8e000d5dd03a30c60c30391c85fa31f3931e804c351ab0a71e9a978cc0f

Download Submit
memory/392-196-0x0000000011DC0000-0x0000000011DC8000-memory.dmp

Filesize
32KB

Download
memory/392-197-0x0000000011E40000-0x0000000011E78000-memory.dmp

Filesize
224KB

Download
memory/392-9-0x00000000001E0000-0x0000000000356000-memory.dmp

Filesize
1.5MB

Download
memory/392-198-0x0000000011E20000-0x0000000011E2E000-memory.dmp

Filesize
56KB

Download
memory/620-1367-0x0000021EDC970000-0x0000021EDC972000-memory.dmp

Filesize
8KB

Download
memory/620-1370-0x0000021EDC970000-0x0000021EDC972000-memory.dmp

Filesize
8KB

Download
memory/620-1362-0x0000021EDC970000-0x0000021EDC972000-memory.dmp

Filesize
8KB

Download
memory/620-1365-0x0000021EDC970000-0x0000021EDC972000-memory.dmp

Filesize
8KB

Download
memory/620-1366-0x0000021EDC970000-0x0000021EDC972000-memory.dmp

Filesize
8KB

Download
memory/620-1361-0x0000021EDC970000-0x0000021EDC972000-memory.dmp

Filesize
8KB

Download
memory/620-1369-0x0000021EDC970000-0x0000021EDC972000-memory.dmp

Filesize
8KB

Download
memory/620-1363-0x0000021EDC970000-0x0000021EDC972000-memory.dmp

Filesize
8KB

Download
memory/620-1371-0x0000021EDC970000-0x0000021EDC972000-memory.dmp

Filesize
8KB

Download
memory/620-1372-0x0000021EDC970000-0x0000021EDC972000-memory.dmp

Filesize
8KB

Download
memory/620-1374-0x0000021EDC970000-0x0000021EDC972000-memory.dmp

Filesize
8KB

Download
memory/620-1375-0x0000021EDC970000-0x0000021EDC972000-memory.dmp

Filesize
8KB

Download
memory/620-1376-0x0000021EDC970000-0x0000021EDC972000-memory.dmp

Filesize
8KB

Download
memory/620-1368-0x0000021EDC970000-0x0000021EDC972000-memory.dmp

Filesize
8KB

Download
memory/620-1373-0x0000021EDC970000-0x0000021EDC972000-memory.dmp

Filesize
8KB

Download
memory/620-1377-0x0000021EDC970000-0x0000021EDC972000-memory.dmp

Filesize
8KB

Download
memory/792-1444-0x00007FFF073B0000-0x00007FFF073B1000-memory.dmp

Filesize
4KB

Download
memory/792-1445-0x00007FFF070F0000-0x00007FFF070F1000-memory.dmp

Filesize
4KB

Download
memory/1912-270-0x0000000005210000-0x0000000005230000-memory.dmp

Filesize
128KB

Download
memory/3396-408-0x00000245762B0000-0x00000245762B2000-memory.dmp

Filesize
8KB

Download
memory/3396-404-0x00000245762B0000-0x00000245762B2000-memory.dmp

Filesize
8KB

Download
memory/3396-402-0x00000245762B0000-0x00000245762B2000-memory.dmp

Filesize
8KB

Download
memory/3396-400-0x00000245762B0000-0x00000245762B2000-memory.dmp

Filesize
8KB

Download
memory/3396-399-0x00000245762B0000-0x00000245762B2000-memory.dmp

Filesize
8KB

Download
memory/3396-398-0x00000245762B0000-0x00000245762B2000-memory.dmp

Filesize
8KB

Download
memory/3396-405-0x00000245762B0000-0x00000245762B2000-memory.dmp

Filesize
8KB

Download
memory/3396-406-0x00000245762B0000-0x00000245762B2000-memory.dmp

Filesize
8KB

Download
memory/3396-407-0x00000245762B0000-0x00000245762B2000-memory.dmp

Filesize
8KB

Download
memory/3396-403-0x00000245762B0000-0x00000245762B2000-memory.dmp

Filesize
8KB

Download
memory/3396-409-0x00000245762B0000-0x00000245762B2000-memory.dmp

Filesize
8KB

Download
memory/3396-410-0x00000245762B0000-0x00000245762B2000-memory.dmp

Filesize
8KB

Download
memory/3396-411-0x00000245762B0000-0x00000245762B2000-memory.dmp

Filesize
8KB

Download
memory/3396-412-0x00000245762B0000-0x00000245762B2000-memory.dmp

Filesize
8KB

Download
memory/3396-415-0x00000245762B0000-0x00000245762B2000-memory.dmp

Filesize
8KB

Download
memory/3396-414-0x00000245762B0000-0x00000245762B2000-memory.dmp

Filesize
8KB

Download
memory/3396-413-0x00000245762B0000-0x00000245762B2000-memory.dmp

Filesize
8KB

Download
memory/4100-1354-0x000001D589F70000-0x000001D589F71000-memory.dmp

Filesize
4KB

Download
memory/4100-1348-0x000001D589F70000-0x000001D589F71000-memory.dmp

Filesize
4KB

Download
memory/4100-1355-0x000001D589F70000-0x000001D589F71000-memory.dmp

Filesize
4KB

Download
memory/4100-1356-0x000001D589F70000-0x000001D589F71000-memory.dmp

Filesize
4KB

Download
memory/4100-1359-0x000001D589F70000-0x000001D589F71000-memory.dmp

Filesize
4KB

Download
memory/4100-1358-0x000001D589F70000-0x000001D589F71000-memory.dmp

Filesize
4KB

Download
memory/4100-1357-0x000001D589F70000-0x000001D589F71000-memory.dmp

Filesize
4KB

Download
memory/4100-1347-0x000001D589F70000-0x000001D589F71000-memory.dmp

Filesize
4KB

Download
memory/4100-1349-0x000001D589F70000-0x000001D589F71000-memory.dmp

Filesize
4KB

Download
memory/4252-358-0x000002F74EB20000-0x000002F74EB21000-memory.dmp

Filesize
4KB

Download
memory/4252-359-0x000002F74EB20000-0x000002F74EB21000-memory.dmp

Filesize
4KB

Download
memory/4252-390-0x000002F74EB20000-0x000002F74EB21000-memory.dmp

Filesize
4KB

Download
memory/4252-391-0x000002F74EB20000-0x000002F74EB21000-memory.dmp

Filesize
4KB

Download
memory/4252-392-0x000002F74EB20000-0x000002F74EB21000-memory.dmp

Filesize
4KB

Download
memory/4252-393-0x000002F74EB20000-0x000002F74EB21000-memory.dmp

Filesize
4KB

Download
memory/4252-394-0x000002F74EB20000-0x000002F74EB21000-memory.dmp

Filesize
4KB

Download
memory/4252-395-0x000002F74EB20000-0x000002F74EB21000-memory.dmp

Filesize
4KB

Download
memory/4252-357-0x000002F74EB20000-0x000002F74EB21000-memory.dmp

Filesize
4KB

Download
memory/4252-396-0x000002F74EB20000-0x000002F74EB21000-memory.dmp

Filesize
4KB

Download