20d26a2e4f5d5f542bac77bc3296e3d536a5387e33dc9be89109339d29b994b2

Analysis

max time kernel
148s
max time network
155s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
01/05/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Discord.Bot.Client.3.1.0.Portable.exe
Size 83.4MB
Sample260501-e7zzesby4s
SHA256 20d26a2e4f5d5f542bac77bc3296e3d536a5387e33dc9be89109339d29b994b2
MD5 7abfb7b07fb82841d58323ea74cbebb0
SHA1 8c098cdf224d6d7799527afd6fbf4e64bc3e6012
SHA512 fb45735310ccc43ae1638ef54bc8b376f99a6c92f190de771ad19f6b6d45bb7fe241a4bb81a1d79b584382ea78140caf6de2389c1b101913c28a764b448da28a
SSDEEP 1572864:szbY69SQSdZ8hMEVixK+oGPpMAmjtT+zbY69SQSdtQKN5KwB/kqnlfcPXK+GuULb:6bt1SdShGddiMbt1Sd3KwqktcPK+B0fz
TLSH
T1F9183360D95F3A31F0F5EEB53A71B0F96C3CB14681D3AF628B66D5ADB5B00094803D9A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3579476765-2645189491-1706875375-1000\Control Panel\International\Geo\Nation	Discord Bot Client.exe

Executes dropped EXE 5 IoCs

pid	Process
5228	Discord Bot Client.exe
5908	Discord Bot Client.exe
3452	Discord Bot Client.exe
5396	Discord Bot Client.exe
1640	Discord Bot Client.exe

Loads dropped DLL 12 IoCs

pid	Process
4424	Discord.Bot.Client.3.1.0.Portable.exe
4424	Discord.Bot.Client.3.1.0.Portable.exe
4424	Discord.Bot.Client.3.1.0.Portable.exe
5228	Discord Bot Client.exe
5908	Discord Bot Client.exe
5908	Discord Bot Client.exe
5908	Discord Bot Client.exe
5908	Discord Bot Client.exe
3452	Discord Bot Client.exe
5396	Discord Bot Client.exe
1640	Discord Bot Client.exe
1640	Discord Bot Client.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
11	raw.githubusercontent.com
12	raw.githubusercontent.com
23	discord.com
24	discord.com
29	discord.com
39	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Discord Bot Client.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Discord Bot Client.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Discord.Bot.Client.3.1.0.Portable.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Discord Bot Client.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5396	Discord Bot Client.exe
5396	Discord Bot Client.exe
3452	Discord Bot Client.exe
3452	Discord Bot Client.exe
1640	Discord Bot Client.exe
1640	Discord Bot Client.exe
1640	Discord Bot Client.exe
1640	Discord Bot Client.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4424	Discord.Bot.Client.3.1.0.Portable.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 5228	4424	Discord.Bot.Client.3.1.0.Portable.exe	83
PID 5228 wrote to memory of 5908	5228	Discord Bot Client.exe	84
PID 5228 wrote to memory of 5908	5228	Discord Bot Client.exe	84
PID 5228 wrote to memory of 3452	5228	Discord Bot Client.exe	87
PID 5228 wrote to memory of 5396	5228	Discord Bot Client.exe	88
PID 5228 wrote to memory of 1640	5228	Discord Bot Client.exe	96

C:\Users\Admin\AppData\Local\Temp\Discord.Bot.Client.3.1.0.Portable.exe
"C:\Users\Admin\AppData\Local\Temp\Discord.Bot.Client.3.1.0.Portable.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Users\Admin\AppData\Local\Temp\1fgKR8NCLZW0Rc2y2msKtxGY1pJ\Discord Bot Client.exe
  "C:\Users\Admin\AppData\Local\Temp\1fgKR8NCLZW0Rc2y2msKtxGY1pJ\Discord Bot Client.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:5228
- - C:\Users\Admin\AppData\Local\Temp\1fgKR8NCLZW0Rc2y2msKtxGY1pJ\Discord Bot Client.exe
    "C:\Users\Admin\AppData\Local\Temp\1fgKR8NCLZW0Rc2y2msKtxGY1pJ\Discord Bot Client.exe" --type=gpu-process --field-trial-handle=1688,6513157645108751217,1948219312718549005,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1696 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5908
- - C:\Users\Admin\AppData\Local\Temp\1fgKR8NCLZW0Rc2y2msKtxGY1pJ\Discord Bot Client.exe
    "C:\Users\Admin\AppData\Local\Temp\1fgKR8NCLZW0Rc2y2msKtxGY1pJ\Discord Bot Client.exe" --type=utility --field-trial-handle=1688,6513157645108751217,1948219312718549005,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2328 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies trusted root certificate store through registry
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    PID:3452
- - C:\Users\Admin\AppData\Local\Temp\1fgKR8NCLZW0Rc2y2msKtxGY1pJ\Discord Bot Client.exe
    "C:\Users\Admin\AppData\Local\Temp\1fgKR8NCLZW0Rc2y2msKtxGY1pJ\Discord Bot Client.exe" --type=renderer --field-trial-handle=1688,6513157645108751217,1948219312718549005,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\1fgKR8NCLZW0Rc2y2msKtxGY1pJ\resources\app.asar" --no-sandbox --no-zygote --context-isolation --background-color=#fff --enable-spellcheck --enable-websql --disable-electron-site-instance-overrides --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2620 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:5396
- - C:\Users\Admin\AppData\Local\Temp\1fgKR8NCLZW0Rc2y2msKtxGY1pJ\Discord Bot Client.exe
    "C:\Users\Admin\AppData\Local\Temp\1fgKR8NCLZW0Rc2y2msKtxGY1pJ\Discord Bot Client.exe" --type=gpu-process --field-trial-handle=1688,6513157645108751217,1948219312718549005,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAEAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=908 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\1fgKR8NCLZW0Rc2y2msKtxGY1pJ\D3DCompiler_47.dll
Size 4.3MB
SHA256 4b074a3976399dc735484f5d43d04b519b7bdee8ac719d9ab8ed6bd4e6be0345
MD5 fea40e5b591127ae3b065389d058a445
SHA1 621fa52fb488271c25c10c646d67e7ce5f42d4f8
SHA512 d2412b701d89e2762c72dd99a48283d601dd4311e3731d690cc2ab6cced20994fa67bf3fea4920291fc407cd946e20bdc85836e6786766a1b98a86febaa0e3d9
SSDEEP 49152:cwBNwAqRvTvbehyCZ5xRmhErU6jFyU+dQZTHchy0eQago4I+oiP85+hA6+Se4QQU:SUZ5P7FwcAgLbz+3s0Bm
TLSH
T181267D5676A810E9C17BC178CA474317EBB1B81403349BEF1590C669EF73BE26E3A724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\1fgKR8NCLZW0Rc2y2msKtxGY1pJ\chrome_100_percent.pak
Size 175KB
SHA256 419cfcc6dc5f38b2e0c970ebd4fad1ef55054579d5c0db2521d7ae494996aac3
MD5 7c4728b2d58afdd97c4549c96b9561cc
SHA1 1e0d251eedd67e7021fc764b9188184617465c54
SHA512 82d0931e4d1cf38f88050980f518cdacdc981c382771b1732bfbe69f601074a0e7378e27a7470c7dea4e287cb1617a5c038052908ed85134abcd5b6591b4e7df
SSDEEP 3072:NSzwVnpE/JcG42w5+vfdYCJdx10khejSTS9SO0vVm7O0U27IIABNHlJsgfI:NSzwVYn4x5c1YC7x10fSucY7OP2ITQ
TLSH
T13E04D0E3B3B4BC3EE65B1A3375550B77E93B413906A30309C2869A712D5AB80D9DD387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\1fgKR8NCLZW0Rc2y2msKtxGY1pJ\chrome_200_percent.pak
Size 312KB
SHA256 edecf8e1ac353bfdae534e42507e5a59973cb4cab76fbb1ff1a470363e725bc4
MD5 6af049ad6fd11ee90ad9db31c4e02082
SHA1 5d2f9a59a74dc584b5dd78aeb6de583e969e3eb7
SHA512 c7fa6e1a57861e62b9b4d615a988c98d13cde8abc23eaed7c36c2ecb86409da4b65b1f579ca2f307e90eb4d08d14b07f7f41ccb8d8c165d6de67c09c16009715
SSDEEP 6144:KDQYaR+9b2nEz73QYV85u/oFYvwoytKi6obByPGlPFYKKo+:PfIyAg5u/oFFpxLlFYb
TLSH
T10664F1D7F3F8AC38D9971E3361120AB3DD7755350AB2430AC19AAD343D96B9488C938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\1fgKR8NCLZW0Rc2y2msKtxGY1pJ\ffmpeg.dll
Size 2.6MB
SHA256 98adb4e59043d1e7eae99e5535042380be0f6f7eaaf00e41abed8563975834f8
MD5 2a446587405297638961971e31a5c9a7
SHA1 01f322b9753ac1e45b3b96ea848e6080e6657291
SHA512 ae0c0eac34ab6aa383fbfddbfa4acfc89e783410f77b48836b98df5e04fcc1cad4a6c8b965c420db5c85f9098b8645c03ae17eb63a91b8f304ae958803c625b8
SSDEEP 49152:7eQ7nWBO4+L16gqkpkk4v3Hda7osRUAp3+UikWfqgjnP1Fy4Xoi:SLBOjMUq04b
TLSH
T144D58D46F26256EDC056C53087EBA633F630780B47257AEB1BE09A212F3AFC0567DB45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\1fgKR8NCLZW0Rc2y2msKtxGY1pJ\icudtl.dat
Size 10.0MB
SHA256 594637e10b8f5c97157413528f0cbf5bc65b4ab9e79f5fa34fe268092655ec57
MD5 3f019441588332ac8b79a3a3901a5449
SHA1 c8930e95b78deef5b7730102acd39f03965d479a
SHA512 ee083ae5e93e70d5bbebe36ec482aa75c47d908df487a43db2b55ddd6b55c291606649175cf7907d6ab64fc81ead7275ec56e3193b631f8f78b10d2c775fd1a9
SSDEEP 196608:gmXwSv9AAQMlptodliXUxR0rHf93WhlA6tnoB:gjKlQMlpgliXUxR0rHf93WhlA6tnoB
TLSH
T167B62846B2EB4EC2F9FBAE70D9F463675426BC016E31815946042F3B1C777E08761BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\1fgKR8NCLZW0Rc2y2msKtxGY1pJ\locales\en-US.pak
Size 79KB
SHA256 35adc5aeeebfe440e295b88d2a4089360ada33c353843b1f5438f4118501878b
MD5 98c8cfc3cb98ab34e06d4323b8bcb043
SHA1 2c0bda072161530b710fa0a1dfc3c23926184afe
SHA512 25edeca13b4a29f63bdc4f135eda1b1b8c72f3a58315f57895950bdc15f56b2af1aca42affe397716f5965437ece836f683265a33ec919b8b26056634612ed3c
SSDEEP 1536:Ac3Zhd268Ubwdno0fDEprAhD3Q2trhr5uBxgCSODJedMprpqhxrNfDggl+CmfZFu:rZTgDDEprAHqBxgOmxZggl+COwv
TLSH
T11D834E5BE3C4213A059303627A4663A6A725E0A5E35251973CACC22C3777FE4C2776EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\1fgKR8NCLZW0Rc2y2msKtxGY1pJ\resources.pak
Size 4.6MB
SHA256 ddc85d749b19cbabae11a0b8f7114daf75900179a2147280dd0f9f8faee7d65c
MD5 d9022282a7fbf3aa354559ab6a9c7926
SHA1 ff1f2b77d80848bc1a51e48c21a033eb57d8776c
SHA512 6b9ab157cf8e10d8a79ea2ad4e247210fe2a7fd75dab086eb55951d4e028af3060e1f42175be936c6b093abc2c3071c0fd1c45afee3c567a79e1b722fe5f5d97
SSDEEP 98304:aAVqybB1h8fawgGMLdWiz1Z/de8xJtHDgAQcchH:aA4ybnhjwYdWm1iovjgAQcchH
TLSH
T10C2602193AEA2231C423B179AF8F6150B7398007321AE9B4B9CC97941FD653452F6FF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\1fgKR8NCLZW0Rc2y2msKtxGY1pJ\resources\app.asar
Size 211KB
SHA256 7299ec734607ef98a77aef7941d0c062208603831f8a6feb8639b9992214395c
MD5 5bf28687b75636a69a14b031597448f6
SHA1 141a9cf70b8d9ca6a66d4b35cf6f3bcf00c4bf7d
SHA512 a9e04559577478e9dd48ded1da48c2ace01f5753ba40774efc8deadb85fa9df3c06f9f0dd7851037c18ed221a10b8b4cf80faede258500ad3b58f503835bef32
SSDEEP 3072:bbqYGisoDfnWEHcbmrhDQkF/BphkxeBphkxNBphkxD:bB5sm38bmtkkF/axeaxNaxD
TLSH
T1F1243C92FFAD713303E121B49C5678CFA33C9036359998B5BC9C84B829D546CC3B5E9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\1fgKR8NCLZW0Rc2y2msKtxGY1pJ\swiftshader\libEGL.dll
Size 391KB
SHA256 78b4e800e3ee548069316412a6a0137e8103e6e25b86de2acda9d4e39e2db40b
MD5 663a38aa43c2e13044e2ed27b8e8adc8
SHA1 02239febfb419904af737a0bfb64ede8b5578b32
SHA512 012843d57aae9502ad58ef244f5ea91ace41829ffeec96373d348af8130e1fa01d3e80fd133f1841d99c84a77de47f8220851184aa53a77e9b17b9a34a227cbf
SSDEEP 6144:ysqYoNTci8GIcredpDrm/ILgcGHNP6DHa8rrEk5OmluhJ7:ysqYoNTIcrIEltP6DWk5huhl
TLSH
T1A4847D16F7A048B9D067C034CA738A42DA71BCDE0E65E29F2395425D2F77BA49F39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\1fgKR8NCLZW0Rc2y2msKtxGY1pJ\swiftshader\libGLESv2.dll
Size 3.6MB
SHA256 3e484255a4ea2c8fbce03f650001a99d2a63cc78284c6b1733982ec43036e26a
MD5 a46541cf6eb3118c318226ba1bef7a98
SHA1 1e91a60cd994a6440bde2f48a007033856c0aef5
SHA512 aea0f39edc5741e8fd9edf53939902cf48c9f31023df2962cb021b77ed41923c4c4a8200928ed18d94682a567c9d0625d9108ce9555fa3097bace946a8dbbe78
SSDEEP 49152:RFUjzv9Y/VGNVCltvHgslwXiLQ2hHBc7HQ2u2fqRAJE57qscrGRmL9YE6ndbmEL:g2/heXiEoHCu2fE57qleG
TLSH
T18F06E803D66F90EFE056E635A71BB332D1B578C574387976676239112BE27202B3B388
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\1fgKR8NCLZW0Rc2y2msKtxGY1pJ\v8_context_snapshot.bin
Size 166KB
SHA256 9010758e1b4453957e561dfe6dd1c891400d7a0fb78097e8e67d9a8076644588
MD5 d9b62a61b9242c2d29da71d58421f08c
SHA1 62eb4411599dba13fe617a860096fe21a8141d0f
SHA512 1d0bd25bd3c5cb55e80592bc2a15ec94c31263fc518533c8f8d6434e9896f11aabeda2a8fa08601829fcb395ea5c69629ce2ded43d1f8106d982e1d21946832a
SSDEEP 3072:p6g5lUjAKVKhzo+bLt0WVEdRCvLsc5GVcPDLMBCulglTeiR6o:q3ENGJc5wGvMBtlgIW
TLSH
T1D2F32327ED38808AEF0641F405EA4DE39895F55C45BEE9D4B96E00D7BB448EEDCC4828
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\1fgKR8NCLZW0Rc2y2msKtxGY1pJ\vulkan-1.dll
Size 609KB
SHA256 2e86beef2b06299cc8608710ac21d6af89dd438f7a735f3a27768ae2caa4eed9
MD5 068e15bbf9929053253a250bdb3848d9
SHA1 b389b252c63be735d58879007264ed045ae0226b
SHA512 da13181f672b37b7915b9f75df231de87d52d41ef258cfb989fa9b54460a52f0c59bd34ac1063ec1ec5029010965f2a03a510293a78afc021d0295986d504e47
SSDEEP 12288:5JYn9maOHPsbVV5kZXwW41a1TXmtoYSPFj:5M9maOkutwW4AT0qF
TLSH
T1D1D47E2977D0456CE469C03CCE038626DA71BC564A78B5DF13A0231AAFBB7E41B7DB18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf37B6.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf37B6.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf37B6.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6162b5c5-9714-410e-8c73-e86c90e7990f.tmp

Path C:\Users\Admin\AppData\Roaming\Discord Bot Client\6162b5c5-9714-410e-8c73-e86c90e7990f.tmp
Size 256B
SHA256 8013d7139a193980c4354e68d834bf59bf9b31d457fe5a56f1f070d35389051c
MD5 d72d6052f7f743e9102ad6e4aa2cc6df
SHA1 802493e5cfd5c44ae34e7492507f844a066498cc
SHA512 15e728b33ec3d2b7ff329ab9ee68e89d6df9fb7f31ea594f646fbc4edb45b45907cd4a138cdf09c3cadcad8e1de8c873cda55764ee42781d055aabaee12c1f31
TLSH
T1ADD02EBB467028FF0302C3A489153A03C6FE008A230CA8AE9A142B2C85359AB940888F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe596b24.TMP

Path C:\Users\Admin\AppData\Roaming\Discord Bot Client\Network Persistent State~RFe596b24.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1640-254-0x000001FCDD570000-0x000001FCDD69B000-memory.dmp

Download

memory/5228-230-0x00000265B1E50000-0x00000265B1F7B000-memory.dmp

Download

memory/5228-214-0x00000265B1E50000-0x00000265B1F7B000-memory.dmp

Download

memory/5908-215-0x000001BAF1DD0000-0x000001BAF1EFB000-memory.dmp

Download

memory/5908-176-0x00007FFBBFEF0000-0x00007FFBBFEF1000-memory.dmp

Download