hxxps://dnstwist[.]it/

Analysis

geolocation tags

eueuropelondonukunited-kingdom
max time kernel
359s
max time network
363s
platform
windows11-21h2_x64
resource
win11-20250610-en
resource tags

arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
submitted
20/06/2025, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://dnstwist.it/
Sample250620-ppf4psfm3y

Score

8^/10

defense_evasion discovery persistence spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
111	2768	chrome.exe

Executes dropped EXE 13 IoCs

pid	Process
1248	DiscordSetup.exe
3188	Update.exe
2788	Discord.exe
4692	Discord.exe
1944	Update.exe
4020	Discord.exe
5932	Discord.exe
2784	Update.exe
3752	Discord.exe
4152	Discord.exe
2600	Discord.exe
3476	Discord.exe
1988	Discord.exe

Loads dropped DLL 10 IoCs

pid	Process
5932	Discord.exe
5932	Discord.exe
5932	Discord.exe
5932	Discord.exe
3752	Discord.exe
2600	Discord.exe
2600	Discord.exe
2600	Discord.exe
2600	Discord.exe
1988	Discord.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Discord = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\Update.exe\" --processStart Discord.exe"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	discord.com
16	discord.com

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_url_fetcher_3752_483187839\neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3	Discord.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	Discord.exe
File created	C:\Windows\SystemTemp\chrome_url_fetcher_3752_761331023\oimompecagnajdejgnnjijobebaeigek_4.10.2891.0_win64_acwxtxt2znguar3w2o252umtomsq.crx3	Discord.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\DiscordSetup.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DiscordSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133948962265330651"	chrome.exe

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000_Classes\Discord	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000_Classes\Discord\DefaultIcon	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000_Classes\Discord\ = "URL:Discord Protocol"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000_Classes\Discord	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000_Classes\Discord\shell\open	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000_Classes\Discord	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000_Classes\Discord\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9196\\Discord.exe\",-1"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000_Classes\Discord	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000_Classes\Discord\shell	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000_Classes\Discord\ = "URL:Discord Protocol"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000_Classes\Discord\URL Protocol	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000_Classes\Discord\shell\open\command	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-903960561-1545645218-4290906778-1000_Classes\Discord\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9196\\Discord.exe\" --url -- \"%1\""	reg.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-903960561-1545645218-4290906778-1000\{A2079025-3AB2-4CD5-A4B8-15903A3F381C}	chrome.exe

Modifies registry key 1 TTPs 6 IoCs

Modify Registry

T1112

pid	Process
2772	reg.exe
1436	reg.exe
5700	reg.exe
5460	reg.exe
3548	reg.exe
2184	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\DiscordSetup.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
444	chrome.exe
444	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 46 IoCs

pid	Process
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6064	chrome.exe
Token: SeCreatePagefilePrivilege	6064	chrome.exe
Token: SeShutdownPrivilege	6064	chrome.exe
Token: SeCreatePagefilePrivilege	6064	chrome.exe
Token: SeShutdownPrivilege	6064	chrome.exe
Token: SeCreatePagefilePrivilege	6064	chrome.exe
Token: SeShutdownPrivilege	6064	chrome.exe
Token: SeCreatePagefilePrivilege	6064	chrome.exe
Token: SeShutdownPrivilege	6064	chrome.exe
Token: SeCreatePagefilePrivilege	6064	chrome.exe
Token: SeShutdownPrivilege	6064	chrome.exe
Token: SeCreatePagefilePrivilege	6064	chrome.exe
Token: SeShutdownPrivilege	6064	chrome.exe
Token: SeCreatePagefilePrivilege	6064	chrome.exe
Token: SeShutdownPrivilege	6064	chrome.exe
Token: SeCreatePagefilePrivilege	6064	chrome.exe
Token: SeShutdownPrivilege	6064	chrome.exe
Token: SeCreatePagefilePrivilege	6064	chrome.exe
Token: SeShutdownPrivilege	6064	chrome.exe
Token: SeCreatePagefilePrivilege	6064	chrome.exe
Token: SeShutdownPrivilege	6064	chrome.exe
Token: SeCreatePagefilePrivilege	6064	chrome.exe
Token: SeShutdownPrivilege	6064	chrome.exe
Token: SeCreatePagefilePrivilege	6064	chrome.exe
Token: SeShutdownPrivilege	6064	chrome.exe
Token: SeCreatePagefilePrivilege	6064	chrome.exe
Token: SeShutdownPrivilege	6064	chrome.exe
Token: SeCreatePagefilePrivilege	6064	chrome.exe
Token: SeShutdownPrivilege	6064	chrome.exe
Token: SeCreatePagefilePrivilege	6064	chrome.exe
Token: SeShutdownPrivilege	6064	chrome.exe
Token: SeCreatePagefilePrivilege	6064	chrome.exe
Token: SeShutdownPrivilege	6064	chrome.exe
Token: SeCreatePagefilePrivilege	6064	chrome.exe
Token: SeShutdownPrivilege	6064	chrome.exe
Token: SeCreatePagefilePrivilege	6064	chrome.exe
Token: SeShutdownPrivilege	6064	chrome.exe
Token: SeCreatePagefilePrivilege	6064	chrome.exe
Token: SeShutdownPrivilege	6064	chrome.exe
Token: SeCreatePagefilePrivilege	6064	chrome.exe
Token: SeShutdownPrivilege	6064	chrome.exe
Token: SeCreatePagefilePrivilege	6064	chrome.exe
Token: SeShutdownPrivilege	6064	chrome.exe
Token: SeCreatePagefilePrivilege	6064	chrome.exe
Token: SeShutdownPrivilege	6064	chrome.exe
Token: SeCreatePagefilePrivilege	6064	chrome.exe
Token: SeShutdownPrivilege	6064	chrome.exe
Token: SeCreatePagefilePrivilege	6064	chrome.exe
Token: SeShutdownPrivilege	6064	chrome.exe
Token: SeCreatePagefilePrivilege	6064	chrome.exe
Token: SeShutdownPrivilege	6064	chrome.exe
Token: SeCreatePagefilePrivilege	6064	chrome.exe
Token: SeShutdownPrivilege	6064	chrome.exe
Token: SeCreatePagefilePrivilege	6064	chrome.exe
Token: SeShutdownPrivilege	6064	chrome.exe
Token: SeCreatePagefilePrivilege	6064	chrome.exe
Token: SeShutdownPrivilege	6064	chrome.exe
Token: SeCreatePagefilePrivilege	6064	chrome.exe
Token: SeShutdownPrivilege	6064	chrome.exe
Token: SeCreatePagefilePrivilege	6064	chrome.exe
Token: SeShutdownPrivilege	6064	chrome.exe
Token: SeCreatePagefilePrivilege	6064	chrome.exe
Token: SeShutdownPrivilege	6064	chrome.exe
Token: SeCreatePagefilePrivilege	6064	chrome.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
3188	Update.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe
6064	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3668	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6064 wrote to memory of 5108	6064	chrome.exe	81
PID 6064 wrote to memory of 5108	6064	chrome.exe	81
PID 6064 wrote to memory of 2768	6064	chrome.exe	83
PID 6064 wrote to memory of 2768	6064	chrome.exe	83
PID 6064 wrote to memory of 3004	6064	chrome.exe	84
PID 6064 wrote to memory of 3004	6064	chrome.exe	84
PID 6064 wrote to memory of 3004	6064	chrome.exe	84
PID 6064 wrote to memory of 3004	6064	chrome.exe	84
PID 6064 wrote to memory of 3004	6064	chrome.exe	84
PID 6064 wrote to memory of 3004	6064	chrome.exe	84
PID 6064 wrote to memory of 3004	6064	chrome.exe	84
PID 6064 wrote to memory of 3004	6064	chrome.exe	84
PID 6064 wrote to memory of 3004	6064	chrome.exe	84
PID 6064 wrote to memory of 3004	6064	chrome.exe	84
PID 6064 wrote to memory of 3004	6064	chrome.exe	84
PID 6064 wrote to memory of 3004	6064	chrome.exe	84
PID 6064 wrote to memory of 3004	6064	chrome.exe	84
PID 6064 wrote to memory of 3004	6064	chrome.exe	84
PID 6064 wrote to memory of 3004	6064	chrome.exe	84
PID 6064 wrote to memory of 3004	6064	chrome.exe	84
PID 6064 wrote to memory of 3004	6064	chrome.exe	84
PID 6064 wrote to memory of 3004	6064	chrome.exe	84
PID 6064 wrote to memory of 3004	6064	chrome.exe	84
PID 6064 wrote to memory of 3004	6064	chrome.exe	84
PID 6064 wrote to memory of 3004	6064	chrome.exe	84
PID 6064 wrote to memory of 3004	6064	chrome.exe	84
PID 6064 wrote to memory of 3004	6064	chrome.exe	84
PID 6064 wrote to memory of 3004	6064	chrome.exe	84
PID 6064 wrote to memory of 3004	6064	chrome.exe	84
PID 6064 wrote to memory of 3004	6064	chrome.exe	84
PID 6064 wrote to memory of 3004	6064	chrome.exe	84
PID 6064 wrote to memory of 3004	6064	chrome.exe	84
PID 6064 wrote to memory of 3004	6064	chrome.exe	84
PID 6064 wrote to memory of 3004	6064	chrome.exe	84
PID 6064 wrote to memory of 496	6064	chrome.exe	86
PID 6064 wrote to memory of 496	6064	chrome.exe	86
PID 6064 wrote to memory of 496	6064	chrome.exe	86
PID 6064 wrote to memory of 496	6064	chrome.exe	86
PID 6064 wrote to memory of 496	6064	chrome.exe	86
PID 6064 wrote to memory of 496	6064	chrome.exe	86
PID 6064 wrote to memory of 496	6064	chrome.exe	86
PID 6064 wrote to memory of 496	6064	chrome.exe	86
PID 6064 wrote to memory of 496	6064	chrome.exe	86
PID 6064 wrote to memory of 496	6064	chrome.exe	86
PID 6064 wrote to memory of 496	6064	chrome.exe	86
PID 6064 wrote to memory of 496	6064	chrome.exe	86
PID 6064 wrote to memory of 496	6064	chrome.exe	86
PID 6064 wrote to memory of 496	6064	chrome.exe	86
PID 6064 wrote to memory of 496	6064	chrome.exe	86
PID 6064 wrote to memory of 496	6064	chrome.exe	86
PID 6064 wrote to memory of 496	6064	chrome.exe	86
PID 6064 wrote to memory of 496	6064	chrome.exe	86
PID 6064 wrote to memory of 496	6064	chrome.exe	86
PID 6064 wrote to memory of 496	6064	chrome.exe	86
PID 6064 wrote to memory of 496	6064	chrome.exe	86
PID 6064 wrote to memory of 496	6064	chrome.exe	86
PID 6064 wrote to memory of 496	6064	chrome.exe	86
PID 6064 wrote to memory of 496	6064	chrome.exe	86
PID 6064 wrote to memory of 496	6064	chrome.exe	86
PID 6064 wrote to memory of 496	6064	chrome.exe	86
PID 6064 wrote to memory of 496	6064	chrome.exe	86
PID 6064 wrote to memory of 496	6064	chrome.exe	86
PID 6064 wrote to memory of 496	6064	chrome.exe	86
PID 6064 wrote to memory of 496	6064	chrome.exe	86

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://dnstwist.it/
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff916e3dcf8,0x7ff916e3dd04,0x7ff916e3dd10
  2⤵
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1416,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=2080 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  PID:2768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2052,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2352,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=2504 /prefetch:13
  2⤵
  PID:496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3112,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3120,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4108,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=4184 /prefetch:9
  2⤵
  PID:4896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5112,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5124 /prefetch:14
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=212,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5540 /prefetch:14
  2⤵
  PID:2096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5568,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5504 /prefetch:14
  2⤵
  PID:1768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5528,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5520 /prefetch:14
  2⤵
  PID:5940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5372,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5384,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5640,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=4320 /prefetch:12
  2⤵
  PID:3928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5780,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=744,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5828,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5856,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=6168,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=4272,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=6360,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=6512,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=3092 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=6160,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=6080,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=6700,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=6712 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=6568,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=6576 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=6836,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=6848,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=6692,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=6812 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=6540,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=6756 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=6604,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=7192 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6784,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=7304 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:5248
- C:\Users\Admin\Downloads\DiscordSetup.exe
  "C:\Users\Admin\Downloads\DiscordSetup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1248
- - C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
    "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:3188
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9196\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9196\Discord.exe" --squirrel-install 1.0.9196
      4⤵
      Executes dropped EXE
      PID:2788
    - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9196\Discord.exe
        
        C:\Users\Admin\AppData\Local\Discord\app-1.0.9196\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9196 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=35.3.0 --initial-client-data=0x4f8,0x4fc,0x500,0x4f0,0x508,0x7ff6d5d7a064,0x7ff6d5d7a070,0x7ff6d5d7a080
        5⤵
        Executes dropped EXE
        
        PID:4692
    - - C:\Users\Admin\AppData\Local\Discord\Update.exe
        
        C:\Users\Admin\AppData\Local\Discord\Update.exe --createShortcut Discord.exe --setupIcon C:\Users\Admin\AppData\Local\Discord\app.ico
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1944
    - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9196\Discord.exe
        
        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9196\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=1868,i,7936095805690034036,8944391190761177123,262144 --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:11
        5⤵
        Executes dropped EXE
        
        PID:4020
    - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9196\Discord.exe
        
        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9196\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1868,i,7936095805690034036,8944391190761177123,262144 --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1864 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5932
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "\"C:\Users\Admin\AppData\Local\Discord\Update.exe\" --processStart Discord.exe" /f
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:1436
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
        5⤵
        Modifies registry class
        Modifies registry key
        
        PID:5700
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
        5⤵
        Modifies registry class
        Modifies registry key
        
        PID:5460
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9196\Discord.exe\",-1" /f
        5⤵
        Modifies registry class
        Modifies registry key
        
        PID:3548
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9196\Discord.exe\" --url -- \"%1\"" /f
        5⤵
        Modifies registry class
        Modifies registry key
        
        PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=7988,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=4540 /prefetch:14
  2⤵
  PID:2220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --field-trial-handle=5712,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --field-trial-handle=5812,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=5820,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --field-trial-handle=6420,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --field-trial-handle=7068,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --field-trial-handle=6236,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --field-trial-handle=4248,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=7288 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --field-trial-handle=6240,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --field-trial-handle=5692,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=6820 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --field-trial-handle=5840,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --field-trial-handle=5976,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:5640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --field-trial-handle=5736,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=7772 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --field-trial-handle=6248,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=6500 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --field-trial-handle=7940,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --field-trial-handle=7280,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=7180 /prefetch:1
  2⤵
  PID:5920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --field-trial-handle=5908,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --field-trial-handle=5988,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --field-trial-handle=5968,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=7776 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --field-trial-handle=7712,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --field-trial-handle=7892,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:5636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --field-trial-handle=7188,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=7012 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --field-trial-handle=5848,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6600,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5716 /prefetch:14
  2⤵
  - Modifies registry class
  PID:788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --field-trial-handle=6404,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=4540 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --field-trial-handle=7908,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --field-trial-handle=6832,i,16048763377585009263,16127848631298538027,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:3136

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5672

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004D0
1⤵
PID:1088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Discord\Update.exe" --processStart Discord.exe
1⤵
PID:760
- C:\Users\Admin\AppData\Local\Discord\Update.exe
  C:\Users\Admin\AppData\Local\Discord\Update.exe --processStart Discord.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2784
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9196\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9196\Discord.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:3752
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9196\Discord.exe
      C:\Users\Admin\AppData\Local\Discord\app-1.0.9196\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9196 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=35.3.0 --initial-client-data=0x500,0x504,0x508,0x4f8,0x50c,0x7ff6d5d7a064,0x7ff6d5d7a070,0x7ff6d5d7a080
      4⤵
      Executes dropped EXE
      PID:4152
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9196\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9196\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1860,i,8568744272895889204,10416365336037980088,262144 --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1856 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2600
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9196\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9196\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1860,i,8568744272895889204,10416365336037980088,262144 --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:11
      4⤵
      Executes dropped EXE
      PID:3476
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:2772
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9196\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9196\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9196\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1860,i,8568744272895889204,10416365336037980088,262144 --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1988

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

app.ico

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9196\app.ico
Size 278KB
SHA256 dfcea1bea8a924252d507d0316d8cf38efc61cf1314e47dca3eb723f47d5fe43
MD5 084f9bc0136f779f82bea88b5c38a358
SHA1 64f210b7888e5474c3aabcb602d895d58929b451
SHA512 65bccb3e1d4849b61c68716831578300b20dcaf1cbc155512edbc6d73dccbaf6e5495d4f95d089ee496f8e080057b7097a628cc104fa8eaad8da866891d9e3eb
SSDEEP 192:uz/QWppKvrIXANuBox26FIeSyyEh9Y1kM12wngfi3TjOueN3/R/l:E/QWppKvrIXANuBc6gq3TjOuevl
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9196\chrome_100_percent.pak
Size 144KB
SHA256 6ce0ccf6a0cc4ea8be11262d168a344bc3ee78a4a6365d755ffb5570bc48d6d5
MD5 facae785097b1c688da1dd683207b47e
SHA1 ac937080ebeb034a8cefa4f1c62442a30ef1c38b
SHA512 18daee712567e7ec259d3c4fccbb32ced1b2a51cee6f3a3466943d3828ab417456b752c27b5ba27339568086fdb7187356a354dc1430014ac7f044c8878cf3cb
SSDEEP 3072:iz8rCGIQRTwsWr8o9RHi/T9P1L2o418Gb0+VRLf0ld0GY3cQ3ERVh2I:iz8DI2TOr8EC/T95K18Gb0OV8ld0GecH
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9196\chrome_200_percent.pak
Size 215KB
SHA256 68e92cde2557d68eddcf8df21ce4d1ef7a85581fb28cd5ab93db20812217e073
MD5 3c2498da8019596dfd760412e71e019c
SHA1 40c8d082822dcaba3f67d3533a1e19fe53df4cf4
SHA512 9ad9fe63673b3bae1a6dc17c056896f21baf4781a20a415734be978dc5ed00617b334375fda42b0e18890925520b5a45ae4d5bd5a1c919d01fef1e8290bd6234
SSDEEP 6144:LDQYaBN6svyAEWnIEb7r8EC/T9ugx5GMRejnbdZnVE6Yoppx4:4fBN6svyA1F4B79a6edhVELoXx4
MD5 SHA1 SHA512 SSDEEP

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9196\d3dcompiler_47.dll
Size 4.5MB
SHA256 3e64d99cde651491afb4cbdfbb2ba5fda38c7e70b211cf8d3f022b8cfee8f9b8
MD5 58b825ee07c40b7e8a9ce930ff212e04
SHA1 af94d34221c19458c0da1ee98ab10ecad2d4c2b9
SHA512 a3c051461a633ea912f8a09c27776d468f9c3f075345af97cf3c5d35b570f447e3ac9c01ba22f5c8220672b85d32acfb6b811044c663afe9de8c2e8678e3a592
SSDEEP 49152:gWuvo7BNNsHF/a5T9+xnP7d5MD6zm843rvmOLYW9RY2aYglQ2bb9+m7HUDZnX86X:HdBA/8CdOo2uUb9G5fN9+JKMxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9196\icudtl.dat
Size 10.0MB
SHA256 a9f6072e858ea29cb66501847856d403c862f23d03cac2656d1e0fa2865fdc7b
MD5 ba9e45bfca3621e4086e6a1870f8cc41
SHA1 8d1b2d42707812608907f8000041c16e7755532a
SHA512 07ac486039098753d77b53ce0638a172c583620d6feae0447da9b8931fe9e0f8b108ca7c8282b6596bdcfb252b3600bdfe7cb01c96b3564605084a932dc7298b
SSDEEP 196608:fwPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2YEs:fswkpHiXUxY/iJ53IWhlVjEeIHs
MD5 SHA1 SHA512 SSDEEP

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9196\locales\en-US.pak
Size 484KB
SHA256 6893de9d9c58b2cfb52892463d6621263d9482dcf236b3943d58e0ef45046215
MD5 9a56cff32d16317aeaba0ef4c0be4694
SHA1 9f293fb2d29057c7e240f95587675ebe6c69f188
SHA512 1868e63e24b77923c5b06be7d181475d851579dddf0ffc582715ebfa03e27caf3fd454887b7c243b9af8d2ff9d6322988224d2e5d7f8bd714af5cb0686073493
SSDEEP 6144:9m68V8Lvz+a2qFmg1MP9eQQxV3faY7I3W605DBxaing2Z/9SwB:hJ1MbQxVo+51x0wB
MD5 SHA1 SHA512 SSDEEP

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9196\resources.pak
Size 5.5MB
SHA256 55b77a62bede7119ceab57f4574e832492b6f969f11eee35d16c419272ce0ccd
MD5 2c6e2dc80494504741b44cf272494b2b
SHA1 eb3e7dc4abe25883d38e1fe174fad931eca3702d
SHA512 f3b5ba701385afccc28a0aa0b2473a4c060a4d1844d196b907770844df74239fa1e20c6086a0c179bb37af337522691454834768bbea155dc035ae50bc749a17
SSDEEP 98304:JX9gAcZ/hPOXD1VXGhJiqQN9HOMh/rwrTO/jV0nlkMt2OMLAqWpwUkz1VuO2:JOl/hWXD1689HD/krS/zMgOMJda
MD5 SHA1 SHA512 SSDEEP

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9196\resources\app.asar
Size 7.6MB
SHA256 1a80eca0160ec7e5dc9cb3cf5834dc30882f1e40a9607f4f801f0150a059db26
MD5 50ed48e83a62c7ad9f9799b88b04582a
SHA1 32222be883cd7ba3a748adb8cfb396f935103af7
SHA512 49ca38631723690d8ef7243bd72465ddf02f7acedd525b3c3af1cc6b9371f39a0fe62988508443660d25cd6b31ce2cd27e5c1dc31d8ca57f148f963ddb749666
SSDEEP 49152:t+zbND/ppgFSXcm08sq4+TTCCUugJUS1C9iguUgFFn4QNhAejRmf4vjRmz4y5jRY:olqHb4QE4O4yQoAUo46B
MD5 SHA1 SHA512 SSDEEP

Submit Download

build_info.json

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9196\resources\build_info.json
Size 83B
SHA256 0c23914e90aec6e8fb6284eb13acac394a82169b32dfb36cbe8b7e5d4b03a01b
MD5 52048c9fac072bb85fcde9732bc44f38
SHA1 44093fed1ea402f2c2ca47c13ad069b330fe96cd
SHA512 30f8a3dcb03b7a07eb17f2ec3d12fc920432c445831806357ddfd812a3e09e2980719a5a6695417bd227b13f853a2e460574f0af793d9db992168a825f334926
MD5 SHA1 SHA512

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9196\v8_context_snapshot.bin
Size 685KB
SHA256 462919f1b49c9e913042f9e9a738e9510884d5920a426a8a5f1b188e28c4da91
MD5 d4b195232a23682da49bb49b43dac7a9
SHA1 24671a21f74cc904f0d5cc48816f6aa95c3e3f72
SHA512 ca5f7b4e72313b365362d0ea4cb07eabc3cb08ce2a54afe4c53803f12a87909c827cd1a4c1724841468bf5647e4bdc61936a7bd5fdf2feaada1c694cfc3e4526
SSDEEP 6144:ri2g51RJBR+t+8mfdz4l3znkF52BhbV/n8Xn4xFoR:rr8ZYDkF5yn24/A
MD5 SHA1 SHA512 SSDEEP

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 41c2365e9b3ce6e8f0b2dd3b0e4e137623a51c63c1d7d338b96d723df471bdc4
MD5 3a02acb68664064481898daab00ca451
SHA1 ee06f72a5227b33f40315c32e9887b789f068231
SHA512 9ba235d7b37d3a33c61bd1c17a22d2dbdebd55bc5226a1c172aef1b68d3db39eae5d8411a462fd7bbd0fce9206d14b2f255d424cbaded441223e08ac95edbb13
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 4b37f69c639d0ee602b1b91046c194cde7fd8128431ab79d5bb10e3010907e9c
MD5 e6c415c54b01dade4f82366a9ae84dd9
SHA1 9523c60a4b6008ea0cfab68e898e16f34e16ff0e
SHA512 7d24a3dbb66d19a4b3ad6e0a261d348e8edc0c3c4dc0ff678efeed95a5d7e7f0415926bd030652760777c73a4d34d649a5ae06964f42e1fb4079368fecf46bdf
SSDEEP 96:I0NIdezxfTjQ57yfddXnyqeXczud9fEtDqhCScBIqJMLzso8f9eLXZzhvqI6BF5R:IiBs4ssSJXjA
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 e6f0f57142176dcfecc6f8c79ac7c5365bfe97d77e396fb57fc06517d9f41c42
MD5 d5e6230b1033c11572110769b1f6faf1
SHA1 af98ceb8ae2fb996a65d22609d3e7e6c709b1368
SHA512 bdd88a385f2fbd5192876dccf684ac5793f599493b8652017f51cf7ffefb418f4b7a7039b341d12ed154070adc37fe74914d864bd85a3da9b1019ad2182c79d3
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 34c202e738755585487f3288498acdccbe82a7050b7a5e2f11e5fabe9af7515b
MD5 55e31984ce958f69b6031a548a6fa153
SHA1 dba9e9eacf96bfbb2a5cb841b3696fd058ab4965
SHA512 d54c75efc3f77433f195905103bb6e283bb40918cb6d7380a29c1a9236b5b17ba3501738fc24857fb4d564b98cb53e2dfe88068f6423aca19cb25c1d9fc2bc65
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 328bfacf38dac44e8d250e2c22cbd5721b7636896435d65c2c85b23fe13a72c5
MD5 857d8b65ca0bcf86bb8a8a473086ef23
SHA1 56f0a1c9a582d0ab18b71d15ed2984175ca7a6a7
SHA512 a51f461b080667d338063b0c102f89cf56bef8c4ebd10752c803a0616be763b4d1dd19af6a9c00ba1b46c612c8ef6a3588d108ba39bfb9b15b12399e8d47205c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 febde56a4a2adfc23f104dedfd5b305e8d9149e52d0871a0d3d5f1108a10e3d0
MD5 7bbbd4c29305ecef643ffe11162b2b8b
SHA1 cb15f89bc4bfc0dd7c253252758f39fa26ab3fe8
SHA512 6c98a7fdb2ae2adbb0ef409b2a647b76521db25b20bff848283a768510d502c001189cf135f6fd1e3be301e506bdb1ff25ea44d4cd75398bf47470b8f0c965e1
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7b81bf3d3df32223ddce76e46e87886f7c2ea23804cb106e46c31244466b3bd2
MD5 b3301a946a072bd6dbb0915756db697e
SHA1 b5767ebf9fb04b094a5b776c9e2e0881184399ea
SHA512 ae873f79da0cc4f9f55a223f4b3e633c80166aa09f78c8b6b62a93ae8545ab9126dfd5e831c474b9c55f0e311e03d1a81aee9ebc503e3f1ce3c77f9690ae245f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 81d0a8370035ced1d73d4b4633decc9304ca9287d941e161c565b66b48d890d3
MD5 d0e43deb9f14a74792c2aacb00b3c8bb
SHA1 ae600cd72aad6356ff4d60dea98a9c9d1d45ebc3
SHA512 2aed583f0f3e5fd388d96ceab0affeb18920ffd2b003212ceb6b12eb7990a0486344453d1fb3b0d23ca272638797bd82da72b626f92dbec4db603df8f8c3e7ca
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 9df03d2b3b8657906184615a99405edf893d2d9d071427d285fd0b09729bfb56
MD5 d29e15b8cbc09ed391a6487e9094245a
SHA1 1cc476e3869b476bf9a8cec45dc69cc5fcaf3e02
SHA512 ef4f8ca7d925faa942bb2b4abbc2f4446bdd8a18992f9f69a600972a45fc5ee697a716006755e2aba17d9dbdc3813a06f5836fa041373baba38f305bc9342b0f
SSDEEP 192:K2rZ/mEB7U+jfy4ufKD0Iv2JcldVhCOnTZT++08l3tvlr32BRSt5:K2rZ/mEB7U+jfyvfKD0YISdVhCOnTZTV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 eff75cccddba3fbd10c3ac0113ee08151e80363be0218d1cd29b951a9e258cef
MD5 a494a311ae0ac707c0babf81c63b59e1
SHA1 feffef9c4f3f1ff20ee9a4697797d002f1a55c9a
SHA512 512d83e409180c3b98dc7e6f080baa7498d2d5239415d259b943df04b8da26d3c8e3abcdac1d60e8a696ea6a3a69e83a28491666352965ce24c1617790d20c61
SSDEEP 192:K2rZ/mEcJ4ufKD0Iv2JcldVOOlTWJ3tmSaEIRPI70DPhlVURwYh1+sRJEC4lWb:K2rZ/mEcJvfKD0YISdVOOlTWJ3tTaEIS
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 3594e8925f4c13c0491259ebba8d2542e3ff758dfed0fb851998a07b15cffedd
MD5 c599119acda6e8c238bd06128ad78838
SHA1 f88aed6297fef893da8da9d22791450fb81632e2
SHA512 74990e9edabde33e2a69d5305ad814def8e81d77dccb2dcd0fbe9144c38b4a506fc33a8a7751bbe4a860794d9c5084fd6b9ddc77ff0e56c7da85ccadd32bb972
SSDEEP 192:jY9X+p6ev5/YB78kyMyZ8PRpyKHS+WN9BjEmfeerfjbpQyIsnA/g2:jY9X+p/9G78kyMLXyecD4mZZ2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 7c95b2226696f58a382567494392ea6d16c8c9583064a8154cd6e9ce358e6237
MD5 226c8900d9e9b79bc97a8296019a7837
SHA1 88d957ef042dc627991a63925981ce9f7ac276bb
SHA512 c2640240b8c1470e85706edaada3c10fa6c685e26b0770e67da439db29f44c270e72adf7ac877738f77d929dfe9a550dad8a2cbb5f794d33bf470b6fcb6680e9
SSDEEP 384:jY9X+po9a78kyMEXPWneBMqMV9SAx1+7g2:mnmeBMqd9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 f7c1a2fadc6b0a04501b4cb228b424caf5502e189789f2cba8076c3239b0caa1
MD5 f517505d113fddedb153a774d19abdb0
SHA1 efd0cb6cccb813fdf80e8239b076d0c47532812f
SHA512 ed6474490f14df8558fe3f6ea000a06db05b453d5b48f6bac6cd3d229d17cf7ce37b5c21a30394bd2d271f98b563e19a9c583d825f4575fa1fd0033a391c7f0b
SSDEEP 192:jY9X+p6ev5/YB78kyMPZ8PRpyKHS+WN9BVWYueerfjVpfyIsnA/g2:jY9X+p/9G78kyMEXyecDIYog2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 dc5e1508638d7ce4b94fa0b3e59696e81a7f6628cfa8364372c5394ae0e04318
MD5 efbddf777281eeaf2d191643140d3c74
SHA1 5e8a1c3781f9243ac61dc47eaad42db84d4317f6
SHA512 b65387645efa2d638fcfb3e35b5366bdac46020ac421519c9098813dd79051304cd796ca2a0e7699d84b91bceb4abbd3145514bd5cb9498357ccbfbbcc7c4b8d
SSDEEP 192:jY9X+p6ev5/YF78kyM4Z8PRpBWkKHH+WNMqGBZQq8JH+4eerfjVpfyIsnA/g2:jY9X+p/9a78kyMZXBWkeBMqOSxp+Wg2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 070d3eb9cf66153d78c7017de0e461fce63d59a26cae33b167b58f5fbfbcf514
MD5 f9b23df5d74af30e682b3b8891b97dd5
SHA1 f5e2c8295d80b4251209470ae9cf4deadd815a44
SHA512 ed23af4bf98375e0b084d4e2c67ce82b565f413db65e07bafa389a13854eb8564433790e4b2af9e5abd3813396b3b8a1d36e7281da71ab412221e4e56816083d
SSDEEP 384:jY9X+po9M678kyMUWXPWne1dMqI1CKjCNV9SkAEt5F+/Hdg7:mnUeTMqI1CKjCGPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 5cb17ca82b8412a858b0813960c0f66d99ae6d74be5a4be20bbbe8be02ec3b44
MD5 41d763a911cb8b17acb8e3e46f25911a
SHA1 957504d2579106abfda7b025da8a99b27e97c5d8
SHA512 a68ffe961875d279cd3376ce3a352dfd54bb29f35666ac9ad270a3830050373ab11a4cc2c0197b7a750dff52ae500cd5c5bc363c4ef96a7a3a67dc813c156c34
SSDEEP 192:jY9X+p6ev5/YB78kyM8Z8PRpyKHS+WN9BVWYNeerfjbpfyIsnA/g2:jY9X+p/9G78kyMFXyecDIYzg2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 74ddeeca6d5cd5d5fa88cfd66446af2d652a11cede0120e12fdb78e647f7c848
MD5 c7a1290ac259f817bd0bb86c4d483a94
SHA1 183023e2b99a3f197b89c7a7e95bf6683d2cce86
SHA512 f8ec7d1f126ddd24e760dede7da5412c624481365ffaec2f29de8837b138b2b16e7865c9df194b369ffb74fd09507af38e851eb5b7c87b16e96519530050468c
SSDEEP 192:jY9X+p6ev5/YB78kyMgZ8PRpnKHS+WNMqFBi26J8mReerfjVpfyIsnA/g2:jY9X+p/9G78kyMBXnecMqriHJ8mNg2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 217fd70cae4bb0f1151135d8764219a0befa3e0748d715b7ed774744aa6c72bc
MD5 6ba7842be21d0c196bcdda7bda6144b1
SHA1 f10a96209eed2279152d9b6eb250ef42915fcae9
SHA512 825a068386503dfd82cc6e6b322eb206d656dd92492c1e1c583890a3294656326fa0a2b97cc25fe85132c099a7783c8cc424f5eb274acb5088ab6775380f23c4
SSDEEP 192:jY9X+p6ev5/YB78kyMuZ8PRpV9KHH+WNMqGBi26J8mReerfjVpfyIsnA/g2:jY9X+p/9G78kyMPXV9eBMqOiHJ8mNg2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a0e826b7104b933f97b176b637c6922ebaf8f5528eca7f962b7cc7763b170d5a
MD5 8e8e8d3042f889769dbc744516067f89
SHA1 fffc1cd0e632eb2d67af475e901d63e431eb05e4
SHA512 d98ebc288dfb93204793c64c9e52a72581b87f5d8ad4f1410242dcc4b1329122f1e145ceb821f0b4ed3c7e1e0b92b886c01b82c0d117728959719e4d1c46f7be
SSDEEP 192:jY9X+p6ev5/YB78kyMKZ8PRpVW9KHH+WNMqGBb82keerfjVpfyIsnA/g2:jY9X+p/9G78kyMjXVW9eBMqOA2Cg2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ec71addab1cbe9f3274fa6d6c159933097ef73217b20f49042177c2228eaf2cb
MD5 dda9c66854c540cdc84b1f21de82993f
SHA1 9d16894c8ccda048589b7116ac37de97181e496e
SHA512 41f65c7a0cfcd6116e224434b46989799c623900e2ca319f1ef3c81ef8715bd628632488654077c0602f94ff98bfcb4fbc143523b2d2b41bb5547af2e5a4770e
SSDEEP 192:jY9X+p6ev5/YB78kyMvZ8PRpBW9KHH+WNMqGBezq82EeerfjVpfyIsnA/g2:jY9X+p/9G78kyMkXBW9eBMqOex2ig2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5c4b3478bc6bf9176a234f8af7992ba7fdb3d65ac84215e49fdf5d6c2b042dd3
MD5 7a4dd7ced5c0c789db2cc580f40fda91
SHA1 8692adbe21b6e175de69a528407bfdc376e63ecc
SHA512 032664b9135eba7d4b6ca80575e7833d578c73ac2c0f7cb3e3b9c35f71180440b5b4c3c683cae2b5f554d8f7049cf348ec16e9f8b2d6107484618aaee8031241
SSDEEP 192:jY9X+pKev5/YF78kyMSwZ8PRpBWnKHH+WNMqGBZQq8JH+4eerfjVpfyIsnA/g2:jY9X+pP9a78kyMSRXBWneBMqOSxp+Wg2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 6bc67096f3ae6becbf6f65dbdcc2394d230f21dfc333072999d361312dbbcd65
MD5 69d1dd5a24a4d5f09b057c3a520dd15f
SHA1 6228e320b3e7179ede3e34c911ffe14d825e82e3
SHA512 39121d97cf736adf1490e5cb09b6fb8128d2cc8bde710b517999201a68d9bfc20b4e3a5906a5fab2fcf97937b66c74a2395105da489742459d4c313812d701e8
SSDEEP 192:jY9X+pVev5/YF78kyMfZ8PRpPWnKHH+WNMq2BZQXQq8cu+LeerfjVpfyIsnA/g2:jY9X+po9a78kyMUXPWneBMq+SAx1+7g2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 2300f6e923eaff67cba5916596019bb86d744de2f58ffcbbebb65af212ff54ef
MD5 09d5216228f71cedab86f8827fe2fff3
SHA1 66a19b18d098ade20625fa45d5454f70e861b5fc
SHA512 71d6717dcad85fda2c3af861c47a3b846dd69ac29a537bcd12a0d4dc3473df768e0d24365920b652aea2e3183f89879be6dc5caa33fdd98bff25566791eeeab5
SSDEEP 384:jY9X+po9a78kyMyXPWne/MqMV9SAwF+Lg2:mnge/MqAt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 36721543dfdeacce66cdae3ffb74d37a754057e8ddd39b5e8283bf78c7006171
MD5 003b188cd9cc7f704ce1b934c1b547ba
SHA1 27e83eaac42513c252e0394c87461486708b80b3
SHA512 3a7a9ac3fbeb0652539b5b5afea2ed6378adfb18783c14ae932a94a4c8155b4605e2bb7b10497b1d35d456a6dc13a9b5a3ef09e3696a99069dd4d1fddb16484f
SSDEEP 192:jY9X+p6ev5/YB78kyMWZ8PRpyKHS+WN9BOp+ueerfj+pQyIsnA/g4:jY9X+p/9G78kyMXXyecDU+RZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ca077edf798d0ab005421cda2c09236f61d7b4f8bbfc12d2f9deca0e3202b3fb
MD5 9f99595a0fdadcde6907013c54ab0e23
SHA1 7d8f2639a140be878db001d031b009866aeb0f7e
SHA512 b965d27f6b3c7728fe29e65360dfb40f336714050ea0c2fa1b00eae1c4d3764391206e772d63c3b75c00d1248868262214fda3c9b34ad525361ed923c0c9fb68
SSDEEP 192:jY9X+pVev5/YF78kyMrZ8PRpBWnKHH+WNMqGBZQq8cu+FeerfjVpfyIsnA/g2:jY9X+po9a78kyM4XBWneBMqOSx1+xg2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 80cdfc1236997cd4afa61c802deb758d17e9f1f14ea4a0dba4185058bccdae1a
MD5 f0ad020aa755c6b94cddbea903ac64c9
SHA1 f5f73b1d1720b3cf554a14503909ac2bdee56803
SHA512 5ece1377f83d318b974b6ba2969ef31d64ec4f399699fa4738edfec4d8410fd851b1c21d0ad4d8d8a11858854b4b8c97a0e04bb71c925f6b3264d209e0ff8356
SSDEEP 384:jY9X+po9a78kyMufXPWne/MqI1CKjCNV9SkAEt5F+/Hdg7:mnqe/MqI1CKjCGPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 403cb78172efef810a5894e723e5d2433f591909fc588935682193207475341d
MD5 b17038eee3f259c92d955c5688085c1e
SHA1 2ed117d5977e8514b41e47cce4b8aa9db52e6a49
SHA512 4cc12632b6f96ec9f588e2e09b1c4e83777ce4fa4c7096df25fce5bf8e01bb92431fe7c8c33b5d1550d34cb2adb3f41285a14d8434ef59cbd10c48263e06ff3f
SSDEEP 384:jY9X+po9a78kyMiXPWne/MqHV9SkAwF++g7:mnoe/MqS/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 f602d20a7de6989f27a59bdaba75e2fa76479f7ad956fef5148b9df3750b19c2
MD5 7ed2a7eceffddf33844b38e745480614
SHA1 52d9d591f420d044d0d7be861cd06db88c72b255
SHA512 ca50ed5c411302d892110c19ad1e629181a36bf271181c6f82839679f1071365f590c9df510c737ea9b9d204fd7f7a77575757838ea85921cb4ff4f7a7ce0bea
SSDEEP 384:jY9X+po9a78kyMgXPWne/MqHV9SAwF+Lg2:mnye/Mqpt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 7e0348d8187ed56e1073dc505da43bc12c82c0b5d95edfb65b03d84c4e23f760
MD5 9e8ef01f5a1cab34ea4ab831fef343bf
SHA1 ebc3633e024813f854e85568b45d3542dc0827b0
SHA512 885e17717544abe82cc8779aa7b39be2faa5b292b53a3836fc88a5426a7f40c2892454fa530ad9cfbf86f004d1a0be446f52d778292516a42de2305c527020c2
SSDEEP 384:Oy9s7pLuLcgh2zXcNPkXqKf/pUZNCgVLH2Hf1iTrUjwHGsP/n6Py:Oms7pLuLpIbcNPkXqKf/pUZNCgVLH2H8
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 efd324e6a49824236deae528f374db621114f691b7d44421d5edd8d97c211246
MD5 2e21830002330c389a2762e87d046354
SHA1 b1c31ce8377c873e7ad8b9262f8195a74ba32162
SHA512 200309e1f7272f288ee611787b8bc2b5cd9c3077b0c3dea07e3b4ec63974d440fcb81fe7ed50ccf4ebac8868ddc01660a150ad835fb3f45d6aa353d1414b09d9
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 6f720187ded2b287e5e68c85b12abadb43d78e19437064e00c08644440baba6e
MD5 143ce7bba6b442fc5a598aed9c7cdda7
SHA1 26850938d6e588ef40e294e58d912cffbed14af9
SHA512 f21c5efe16ed0c2d421bc4581fe30d48a3d907fbb3df00e13e51703ef9e9d64e78876bd876c9a52943b5a8d4ca71422a9e8428110a5413fd5ec51ed6a24fc3d5
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5e6a31.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5e6a31.TMP
Size 48B
SHA256 ae95193cc5a7cad7d0312b5ea78781606c82267744575b0ea73522b57e7c08c0
MD5 86f29b4437954176989499c354135245
SHA1 df6a0e44c2684118ab204f9958a0ed1b3ef37cfa
SHA512 376071551ccfdaffb3bf685585d77cdde316c7061e7ad8086e7f22df9d61e5fb64789e96aa20fe1718fc72d7bc8277b8c0d58dadc6dbb78eac606b2e5cfee02a
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 83KB
SHA256 b0d9d34785087f37e34e188f466bb4cc8ecc77d74e03dfbe72846bed8be41208
MD5 867d13fadde5efda46fe4eb91d63bb29
SHA1 333abcc3b302211cc5fa91106e96f2411cfda6a1
SHA512 937122a9a778a4c4305f6b1636c9421fad8740130cf1fc295f134d7e2881e7de5104751ff07c6014899ada26f126e67a972f6165190a46ade7a33f80a8baa5ce
SSDEEP 1536:hksGdn5OpSEwcrySR05w5haVHhhd/TyezEHMT5QhLA/oWjIm0myR:uTd5OdDrPMw/I9TymEsdQRA/jUl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 83KB
SHA256 3a079d2aeb7a3c754da60897796e9a5e0056cf29e4d134c404b555b46201e65f
MD5 45b5b2facde5a0538c0cdfa1b0e5052d
SHA1 07fb5c1fa1b226a736ad83e9fa47beb2d25f8e3f
SHA512 4d2bf4a3c56d9841f26de11917faa5f7ecf7cbaf75fab72514ae0e19236fee059c15da35ed0e3fa00649571bde2322f864ae1e855f9a0f5f6579f0239219a546
SSDEEP 1536:sksGdn5OpSEwcrySR05w5haVHhhd/TyezEHMT5QhLA/oWjIm0myR:vTd5OdDrPMw/I9TymEsdQRA/jUl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 83KB
SHA256 62cd5a6abfdf87da848845bb44d05be27eb48cedb03ca789a965a794d61050e8
MD5 5dcd7ea04b7dbbfe2e897b0d58a338ce
SHA1 6c98818211f134958afe5a1472d0eb4a59e75da2
SHA512 538bf67fc61d60cdb0fe2e512b2439ceb0dbb52520d57389d8faa88c65d8f53aca24b23f88c2a4551b7600bf08a6398826be5f3a0a6d9c4eb515524205ff9914
SSDEEP 1536:eksjddn5OpSEwcrySR05w5haVHhhd/TyezEHMT5QhLA/oWjIm0myR:JUdd5OdDrPMw/I9TymEsdQRA/jUl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 83KB
SHA256 379712101386ede0b3f8946c01af004399ae998080735cb6427b8f67671c8f1f
MD5 0ab7f9a3e55e7fabba02409015067a6c
SHA1 40e1fe631d287fa40a182460319a0c56da9f88e5
SHA512 0e89cf200fa50e9b121e6f190c790787e54ea8aaecc5ec304868a0a1fd6c5b5402fb73b6b81eb9ba95ba87673397d1dbd93c9e8b6c21c6e9e831802f6136333d
SSDEEP 1536:eksWddn5OpSEwcrySR05w5haVHhhd/TyezEHMT5QhLA/oWjIm0myR:JFdd5OdDrPMw/I9TymEsdQRA/jUl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 83KB
SHA256 2085b6eea7a22899624f5899b4043893e02ee3c369165d784be7ffe399fb4c6f
MD5 8e31e66a27fbccf8f79a9a82d5b353df
SHA1 0830fb2a1a34cd2d9f7a76cf81b8dc5070cc2d01
SHA512 2c5ac7fc47f057b0823503e7d2a8f08f10dda38e49e6114bf39e5200d0b66ce1e4a1c04ef0e00633d40a72d9fea04cfedb2b910ceb022ed922aec2cb5c279522
SSDEEP 1536:eksnddn5OpSEwcrySR05w5haVHhhd/TyezEHMT5QhLA/oWjIm0myR:JYdd5OdDrPMw/I9TymEsdQRA/jUl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 82KB
SHA256 86913137f7250b5789769da49e4d78330e196d18af06d1341eedda9ecd06327a
MD5 4e7e17dcb723a71f4348dc8da53b6fbb
SHA1 803ffff38189a289b3ab6cf16bebf0fe14be3e8c
SHA512 0d110aeaf31a4bb8f76f1cbc60649bc1804d11955fa3668c64e53f3f58eef976293d2cbe81376ae8299610c2fdf71a4e5d9d9b334c56e53f38eae7f11139e2b8
SSDEEP 1536:sksmdn5OpSEwcrySR05w5haVHhhd/TyezEHMT5QhLA/oWjIm0myR:v/d5OdDrPMw/I9TymEsdQRA/jUl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 83KB
SHA256 4dc27168040536aeb4f2e49be8f58bceedfeb6e955c04e243a672095852231ac
MD5 ce0080f1534941c72030f48a0292fad3
SHA1 cd3c839200b98c0f40d5c502e837d874928ace98
SHA512 2c723748e56af944ba27b1e025a5574c901d4bfda53c4cf3beaab1f391f854e72239ce676cb0211102de918f73c42b628b9fb8b7eb2515873442b85b129eec0a
SSDEEP 1536:hks+ddn5OpSEwcrySR05w5haVHhhd/TyezEHMT5QhLA/oWjIm0myR:uddd5OdDrPMw/I9TymEsdQRA/jUl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 83KB
SHA256 9727f44e627c1e5d006e9f1185c243f2527fd5f35e07ae7f3b5e4a360fb41a47
MD5 f2d3b44fa3068c3493da8eb290174297
SHA1 7acb65c9b3bee769958e2fb22417f8637e5ea514
SHA512 0e7126c3e3ddfc499ec6f55b2f820129a2a82af4632f13af28b6356b2b32ba5a6b07b43c61f949faa2adc0e82da8227dff0e1453a5beac20d4de23607b858adf
SSDEEP 1536:hks6ddn5OpSEwcrySR05w5haVHhhd/TyezEHMT5QhLA/oWjIm0myR:uBdd5OdDrPMw/I9TymEsdQRA/jUl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 83KB
SHA256 ab093c7594a9ef09be9c084a3f97bf972107a5074158d440a1db8c629c6f832e
MD5 5bd3ce6ac4fdfe67277e886b06a5f0e4
SHA1 490320d3622038b034aee9d8e96a12733b504498
SHA512 23ff8c151e7f52428c4ac69116d90a924ea0ba9853f22b8387a895398e4700a24a9382076f1d5f1f31ce12775a68cc8a6c41938ed8f65dd3947276bb18b7310b
SSDEEP 1536:eksIddn5OpSEwcrySR05w5haVHhhd/TyezEHMT5QhLA/oWjIm0myR:J3dd5OdDrPMw/I9TymEsdQRA/jUl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 83KB
SHA256 8c305da68a2107bdef24c70a1ed82c2ad6436548461506540707d52688ca1dc5
MD5 efa2fbd96ef896c510031da5b841d902
SHA1 5d2936168396edefb213104abfb8ed621440d353
SHA512 2417dc8fed57255b8a6789a072069292aa82936eff8da57df8df39907c92460d5c344b870a37b118556cbbb419e14a84bb1866bfabd09b0c5d10c2f7c3ae176d
SSDEEP 1536:eksxddn5OpSEwcrySR05w5haVHhhd/TyezEHMT5QhLA/oWjIm0myR:Jedd5OdDrPMw/I9TymEsdQRA/jUl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 83KB
SHA256 cfe1f55d92d5483ac640baa15dc02eea3a44778dc41b7530b06a0fc04d3f72d7
MD5 da2d10ee5e6d7d522990e8c4e3d04885
SHA1 198f28f34e992b69aff6bdb12cc643743bddece3
SHA512 66d0e271985476a9c456e9cc259f2c46b4b9a88f20a1b0bc46e8ed88e04eedf15a9afb2c794863fd269095e00b43026fd396495b9cb1f609ef80c90bae1d13dd
SSDEEP 1536:eksdddn5OpSEwcrySR05w5haVHhhd/TyezEHMT5QhLA/oWjIm0myR:Jadd5OdDrPMw/I9TymEsdQRA/jUl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 83KB
SHA256 6ca353f1af5f52ea032a847d10a238cb22040d09c6225f85d54f3b82e82e239c
MD5 c6fee106db4cac9ac19a2074268a5dfc
SHA1 a811d6902a41e2eee96187499df22512b64c8ddc
SHA512 9f4bd12ce89b72e28a7a7d879467104d272819d617c3b55cdde015de35c84adfc81a885a8f26e55cdf3fb3b6cfe8d6ba719c380768227368422f82315e8c7da3
SSDEEP 1536:hks0ddn5OpSEwcrySR05w5haVHhhd/TyezEHMT5QhLA/oWjIm0myR:u3dd5OdDrPMw/I9TymEsdQRA/jUl
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 22KB
SHA256 01107a20db9da721b83b3072c9d8aaaf413bc3ea32798be639c0dab1537eed46
MD5 35ca3c3270f713397de9a8149fdd2a13
SHA1 1f07f2738518b3142bd37d40d47e1c30bbcd4523
SHA512 6dcaa64404b0713f0555999e5403f865ba1c74b26d82f4043b9111c3add894e7cde480cbebde925841f6caf44f14923c7c866ab3af0cf60e1536eebabd4f0685
SSDEEP 384:BBJWJaVMa12krtuJhpmvlBOVjeQ8RJoeRghpjUMrWq5PDm5Z+GDa50WLCWYAVIci:F+aVMWrWl8RJRRgvjUMrH4Z+GDa50WLK
MD5 SHA1 SHA512 SSDEEP

Submit Download

RELEASES

Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
Size 81B
SHA256 6e0b20752f2a0c39de04621b373716cbad7f73433c6bc9956ffb7cf660490437
MD5 09b2564d41dd30079e9ab7b4a006b843
SHA1 a3187fd506a37ec6300a85a923d87df8335277ab
SHA512 c0be1759156ff587c2206a9475e2a54fe860922adb19def31a95dbb2842561a3a8721067cf854df227160e74d277e8b48017f30c4347ab81a49890cd11d1f05d
MD5 SHA1 SHA512

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 1.5MB
SHA256 0618a3dd573dc6a4901265ae76ed00a07ce7b427c263a4fe06150c0114aa58e5
MD5 afe80fc2ebbeed67c0621367b3b413f2
SHA1 0c12f06342d5e0354cde7af757ef2c8fc7f5da4e
SHA512 3e092993dfe0ab87e560c45e06b947623926bd2981de4de668324234bb59214613608fc1d673694f317dff35200e9d1ec1f12dbf39cc729599d2dc9ad8ef682e
SSDEEP 24576:eBJkrlr7AiOlwOpJeYOdTNK9RgIM/aR9Gl7MRHK:eBJkAlwO/X9Glmq
MD5 SHA1 SHA512 SSDEEP

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download