hxxps://vencord[.]dev/

Analysis

user interaction
yes
max time kernel
225s
max time network
226s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 04:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://vencord.dev/
Sample260802-esrphach39

Score

8^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
244	5028	msedge.exe
299	5028	msedge.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	Discord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	Update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	Discord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	Discord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	DiscordSetup.exe

Executes dropped EXE 17 IoCs

pid	Process
5620	DiscordSetup.exe
5516	Update.exe
4716	Discord.exe
5436	Discord.exe
560	Update.exe
6048	Discord.exe
880	Discord.exe
1776	Update.exe
5220	Discord.exe
5856	Discord.exe
5084	Discord.exe
784	Discord.exe
5912	Discord.exe
4456	DiscordSetup.exe
5724	Update.exe
5224	VencordInstaller.exe
6072	VencordInstaller.exe

Loads dropped DLL 12 IoCs

pid	Process
6048	Discord.exe
6048	Discord.exe
6048	Discord.exe
6048	Discord.exe
6048	Discord.exe
5220	Discord.exe
784	Discord.exe
784	Discord.exe
784	Discord.exe
784	Discord.exe
784	Discord.exe
5912	Discord.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Discord = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\Update.exe\" --processStart Discord.exe --process-start-args \"--start-inactive\""	reg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
184	discord.com
185	discord.com
187	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DiscordSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DiscordSetup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5028	msedge.exe

Checks processor information in registry 2 TTPs 50 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Discord.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301175718997440"	msedge.exe

Modifies registry class 30 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Discord\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9250\\Discord.exe\" --url -- \"%1\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Discord	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Discord	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	DiscordSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Discord	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Discord\shell	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Discord\ = "URL:Discord Protocol"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{902C31A5-8E22-48D4-9E38-574937BAEF86}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Discord\shell\open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Discord\shell\open	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Discord\shell\open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Discord\ = "URL:Discord Protocol"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Discord\URL Protocol	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Discord\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9250\\Discord.exe\",-1"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Discord\DefaultIcon	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Discord\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9250\\Discord.exe\" --url -- \"%1\""	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Discord	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Discord\DefaultIcon	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Discord\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9250\\Discord.exe\",-1"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Discord	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Discord\URL Protocol	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Modifies registry key 1 TTPs 10 IoCs

Modify Registry

T1112

pid	Process
3488	reg.exe
5088	reg.exe
5552	reg.exe
4640	reg.exe
4568	reg.exe
5084	reg.exe
4616	reg.exe
644	reg.exe
4532	reg.exe
5460	reg.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
6000	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5944	msedge.exe
5944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4716	Discord.exe
Token: SeCreatePagefilePrivilege	4716	Discord.exe
Token: SeShutdownPrivilege	4716	Discord.exe
Token: SeCreatePagefilePrivilege	4716	Discord.exe
Token: SeShutdownPrivilege	4716	Discord.exe
Token: SeCreatePagefilePrivilege	4716	Discord.exe
Token: SeShutdownPrivilege	4716	Discord.exe
Token: SeCreatePagefilePrivilege	4716	Discord.exe
Token: SeShutdownPrivilege	4716	Discord.exe
Token: SeCreatePagefilePrivilege	4716	Discord.exe
Token: SeShutdownPrivilege	5220	Discord.exe
Token: SeCreatePagefilePrivilege	5220	Discord.exe

Suspicious use of FindShellTrayWindow 62 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
5516	Update.exe
4384	msedge.exe
5724	Update.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5224	VencordInstaller.exe
6072	VencordInstaller.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 1576	4384	msedge.exe	84
PID 4384 wrote to memory of 2352	4384	msedge.exe	85
PID 4384 wrote to memory of 5028	4384	msedge.exe	86
PID 4384 wrote to memory of 2352	4384	msedge.exe	85
PID 4384 wrote to memory of 2352	4384	msedge.exe	85
PID 4384 wrote to memory of 3596	4384	msedge.exe	87
PID 4384 wrote to memory of 3596	4384	msedge.exe	87
PID 4384 wrote to memory of 384	4384	msedge.exe	88
PID 4384 wrote to memory of 384	4384	msedge.exe	88
PID 4384 wrote to memory of 384	4384	msedge.exe	88
PID 4384 wrote to memory of 1608	4384	msedge.exe	89
PID 4384 wrote to memory of 1608	4384	msedge.exe	89
PID 4384 wrote to memory of 1608	4384	msedge.exe	89
PID 4384 wrote to memory of 4252	4384	msedge.exe	91
PID 4384 wrote to memory of 4252	4384	msedge.exe	91
PID 4384 wrote to memory of 4252	4384	msedge.exe	91
PID 4384 wrote to memory of 2976	4384	msedge.exe	92
PID 4384 wrote to memory of 2976	4384	msedge.exe	92
PID 4384 wrote to memory of 2976	4384	msedge.exe	92
PID 4384 wrote to memory of 4836	4384	msedge.exe	96
PID 4384 wrote to memory of 4836	4384	msedge.exe	96
PID 4384 wrote to memory of 1284	4384	msedge.exe	97
PID 4384 wrote to memory of 1284	4384	msedge.exe	97
PID 4384 wrote to memory of 4824	4384	msedge.exe	99
PID 4384 wrote to memory of 2356	4384	msedge.exe	105
PID 4384 wrote to memory of 2356	4384	msedge.exe	105
PID 4384 wrote to memory of 2356	4384	msedge.exe	105
PID 4384 wrote to memory of 2828	4384	msedge.exe	107
PID 4384 wrote to memory of 2828	4384	msedge.exe	107
PID 4384 wrote to memory of 4880	4384	msedge.exe	108
PID 4384 wrote to memory of 4880	4384	msedge.exe	108
PID 4384 wrote to memory of 4880	4384	msedge.exe	108
PID 4384 wrote to memory of 1164	4384	msedge.exe	109
PID 4384 wrote to memory of 1164	4384	msedge.exe	109
PID 4384 wrote to memory of 1164	4384	msedge.exe	109
PID 4384 wrote to memory of 5356	4384	msedge.exe	112
PID 4384 wrote to memory of 5364	4384	msedge.exe	113
PID 4384 wrote to memory of 5372	4384	msedge.exe	114
PID 4384 wrote to memory of 5384	4384	msedge.exe	119
PID 4384 wrote to memory of 5384	4384	msedge.exe	119
PID 4384 wrote to memory of 5384	4384	msedge.exe	119
PID 4384 wrote to memory of 5232	4384	msedge.exe	120
PID 4384 wrote to memory of 5232	4384	msedge.exe	120
PID 4384 wrote to memory of 5232	4384	msedge.exe	120
PID 4384 wrote to memory of 1016	4384	msedge.exe	123
PID 4384 wrote to memory of 1016	4384	msedge.exe	123
PID 4384 wrote to memory of 5908	4384	msedge.exe	124
PID 4384 wrote to memory of 5948	4384	msedge.exe	125
PID 4384 wrote to memory of 5908	4384	msedge.exe	124
PID 4384 wrote to memory of 5948	4384	msedge.exe	125
PID 4384 wrote to memory of 5948	4384	msedge.exe	125
PID 4384 wrote to memory of 1772	4384	msedge.exe	127
PID 4384 wrote to memory of 1772	4384	msedge.exe	127
PID 4384 wrote to memory of 4076	4384	msedge.exe	128
PID 5620 wrote to memory of 5516	5620	DiscordSetup.exe	135
PID 5516 wrote to memory of 4716	5516	Update.exe	136
PID 4716 wrote to memory of 5436	4716	Discord.exe	137
PID 4716 wrote to memory of 560	4716	Discord.exe	138
PID 4716 wrote to memory of 6048	4716	Discord.exe	139
PID 4716 wrote to memory of 880	4716	Discord.exe	140
PID 4716 wrote to memory of 4568	4716	Discord.exe	155
PID 4716 wrote to memory of 5460	4716	Discord.exe	143
PID 4384 wrote to memory of 5692	4384	msedge.exe	144
PID 4384 wrote to memory of 5692	4384	msedge.exe	144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://vencord.dev/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff92152c188,0x7ff92152c194,0x7ff92152c1a0
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,17131815313677015578,6866001659628887042,262144 --field-trial-handle=2272,i,12068097869190124359,3019581379654054693,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,13031547739853330376,9491831472147205538,524288 --field-trial-handle=2272,i,12068097869190124359,3019581379654054693,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,6195620065750273506,11682828475235405359,524288 --field-trial-handle=2272,i,12068097869190124359,3019581379654054693,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,855080987255194130,637027870633564514,2097152 --field-trial-handle=2272,i,12068097869190124359,3019581379654054693,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,13394844209392650128,953658356756863699,2097152 --field-trial-handle=2272,i,12068097869190124359,3019581379654054693,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,1642300658654247406,9154176071211268851,2097152 --field-trial-handle=2272,i,12068097869190124359,3019581379654054693,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,137925707537379601,2709961962906189740,2097152 --field-trial-handle=2272,i,12068097869190124359,3019581379654054693,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,4128040342945882548,6553583566653060959,524288 --field-trial-handle=2272,i,12068097869190124359,3019581379654054693,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,3311040207219349858,13359963854100850126,524288 --field-trial-handle=2272,i,12068097869190124359,3019581379654054693,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,9023695540625237676,4117589870888023030,524288 --field-trial-handle=2272,i,12068097869190124359,3019581379654054693,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,9023695540625237676,4117589870888023030,524288 --field-trial-handle=2272,i,12068097869190124359,3019581379654054693,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4524,i,12396659766729742369,13725701969840576365,2097152 --field-trial-handle=2272,i,12068097869190124359,3019581379654054693,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,7973579244915481591,17496450998651165961,524288 --field-trial-handle=2272,i,12068097869190124359,3019581379654054693,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6740,i,9371069752047472171,9859711166759683008,2097152 --field-trial-handle=2272,i,12068097869190124359,3019581379654054693,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6392,i,10157687420969260437,2002263327188079107,2097152 --field-trial-handle=2272,i,12068097869190124359,3019581379654054693,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,5046211766388583072,13232971092645334579,524288 --field-trial-handle=2272,i,12068097869190124359,3019581379654054693,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,6948720087293609066,1518100109240102622,524288 --field-trial-handle=2272,i,12068097869190124359,3019581379654054693,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:8
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,8117904242071685252,12106298926142250404,524288 --field-trial-handle=2272,i,12068097869190124359,3019581379654054693,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:8
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7036,i,1177616350459421430,11599678183288259207,2097152 --field-trial-handle=2272,i,12068097869190124359,3019581379654054693,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7156,i,11162660379210829534,15378300879298255131,2097152 --field-trial-handle=2272,i,12068097869190124359,3019581379654054693,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,17311999448763223489,1268757025419515046,524288 --field-trial-handle=2272,i,12068097869190124359,3019581379654054693,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7352,i,8498705792101833541,12771321619575249020,524288 --field-trial-handle=2272,i,12068097869190124359,3019581379654054693,262144 --variations-seed-version --mojo-platform-channel-handle=7348 /prefetch:8
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7332,i,3913457657126889479,8067587363135063948,2097152 --field-trial-handle=2272,i,12068097869190124359,3019581379654054693,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:1
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7844,i,16011174266284146460,7088124456093876478,524288 --field-trial-handle=2272,i,12068097869190124359,3019581379654054693,262144 --variations-seed-version --mojo-platform-channel-handle=7864 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8028,i,10408522247153929757,5132422802633033816,524288 --field-trial-handle=2272,i,12068097869190124359,3019581379654054693,262144 --variations-seed-version --mojo-platform-channel-handle=8008 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,4092398519435844663,3190622905469482226,524288 --field-trial-handle=2272,i,12068097869190124359,3019581379654054693,262144 --variations-seed-version --mojo-platform-channel-handle=7336 /prefetch:8
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7716,i,10437792560289042072,10662177784741321156,262144 --field-trial-handle=2272,i,12068097869190124359,3019581379654054693,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,9421303122646397067,16999136482683322139,524288 --field-trial-handle=2272,i,12068097869190124359,3019581379654054693,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7080,i,10706319457261257497,6161792329099577339,524288 --field-trial-handle=2272,i,12068097869190124359,3019581379654054693,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,17723954112880099179,6910582802606670054,524288 --field-trial-handle=2272,i,12068097869190124359,3019581379654054693,262144 --variations-seed-version --mojo-platform-channel-handle=7660 /prefetch:8
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=5496,i,12565406235056130837,6341526053613764566,2097152 --field-trial-handle=2272,i,12068097869190124359,3019581379654054693,262144 --variations-seed-version --mojo-platform-channel-handle=7644 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7108,i,9083180411224523131,16185803502857722294,2097152 --field-trial-handle=2272,i,12068097869190124359,3019581379654054693,262144 --variations-seed-version --mojo-platform-channel-handle=7124 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7440,i,8613479980070939628,16950231346861538177,524288 --field-trial-handle=2272,i,12068097869190124359,3019581379654054693,262144 --variations-seed-version --mojo-platform-channel-handle=8160 /prefetch:8
  2⤵
  PID:1844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3832

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2436

C:\Users\Admin\Downloads\DiscordSetup.exe
"C:\Users\Admin\Downloads\DiscordSetup.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5620
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5516
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\Discord.exe" --squirrel-install 1.0.9250
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4716
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\Discord.exe
      C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9250 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.7.1 --initial-client-data=0x51c,0x520,0x524,0x518,0x528,0x7ff691b05098,0x7ff691b050a8,0x7ff691b050b8
      4⤵
      Executes dropped EXE
      PID:5436
  - - C:\Users\Admin\AppData\Local\Discord\Update.exe
      C:\Users\Admin\AppData\Local\Discord\Update.exe --createShortcut Discord.exe --setupIcon C:\Users\Admin\AppData\Local\Discord\app.ico
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:560
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1900,i,2087691327618406593,3977276961474042030,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1904,i,16672528851707411807,9376155996142291537,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1896 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:6048
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=1900,i,2087691327618406593,3977276961474042030,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1904,i,16672528851707411807,9376155996142291537,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1996 /prefetch:3
      4⤵
      Executes dropped EXE
      PID:880
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v Discord /f
      4⤵
      Modifies registry key
      PID:4568
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "\"C:\Users\Admin\AppData\Local\Discord\Update.exe\" --processStart Discord.exe --process-start-args \"--start-inactive\"" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:5460
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:5088
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:3488
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\Discord.exe\",-1" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:5552
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\Discord.exe\" --url -- \"%1\"" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:5084
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4568

C:\Users\Admin\AppData\Local\Discord\Update.exe
"C:\Users\Admin\AppData\Local\Discord\Update.exe" --processStart Discord.exe --process-start-args "--start-inactive"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1776
- C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\Discord.exe
  "C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\Discord.exe" --start-inactive
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:5220
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\Discord.exe
    C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9250 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.7.1 --initial-client-data=0x4fc,0x500,0x504,0x4f8,0x508,0x7ff691b05098,0x7ff691b050a8,0x7ff691b050b8
    3⤵
    - Executes dropped EXE
    PID:5856
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1748,i,6146920772921585843,4893485040008289471,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1816,i,1619816122811410060,12172615036726487191,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1844 /prefetch:3
    3⤵
    - Executes dropped EXE
    PID:5084
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1748,i,6146920772921585843,4893485040008289471,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1816,i,1619816122811410060,12172615036726487191,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1812 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:784
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:4640
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1785643475193061 --launch-time-ticks=592958850 --field-trial-handle=1748,i,6146920772921585843,4893485040008289471,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1816,i,1619816122811410060,12172615036726487191,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2804 --splash-media-format=webm /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5912
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:4616
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\Discord.exe\",-1" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:644
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\Discord.exe\" --url -- \"%1\"" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:4532

C:\Users\Admin\Downloads\DiscordSetup.exe
"C:\Users\Admin\Downloads\DiscordSetup.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4456
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:5724
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\SquirrelTemp\SquirrelSetup.log
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:6000

C:\Users\Admin\Downloads\VencordInstaller.exe
"C:\Users\Admin\Downloads\VencordInstaller.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5224

C:\Users\Admin\Downloads\VencordInstaller.exe
"C:\Users\Admin\Downloads\VencordInstaller.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SquirrelSetup.log

Path C:\Users\Admin\AppData\Local\Discord\SquirrelSetup.log
Size 3KB
SHA256 9f85bdaec6a9e0f43bab293a58a93b0206500afd2b9b2b72737ce9022fc463b9
MD5 0206de10120606f17ffa07f861c46997
SHA1 d2b87a6eb46c1730cd6862e6b7ed5ecd95dc4e62
SHA512 20c537536be65f2e9b87660d992d653c267c0e93c0b70c41cd8606971e0c52c16d9031a8747aa8be764cf792ffac275833a791e50635387444964d1be1177718
TLSH
T15161EFC30B9A851E08C7909BCB69B68EC393E845726A2A15E774490C75C2518FBD7CCF
MD5 SHA1 SHA512 TLSH

Submit Download

app.ico

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\app.ico
Size 278KB
SHA256 dfcea1bea8a924252d507d0316d8cf38efc61cf1314e47dca3eb723f47d5fe43
MD5 084f9bc0136f779f82bea88b5c38a358
SHA1 64f210b7888e5474c3aabcb602d895d58929b451
SHA512 65bccb3e1d4849b61c68716831578300b20dcaf1cbc155512edbc6d73dccbaf6e5495d4f95d089ee496f8e080057b7097a628cc104fa8eaad8da866891d9e3eb
SSDEEP 192:uz/QWppKvrIXANuBox26FIeSyyEh9Y1kM12wngfi3TjOueN3/R/l:E/QWppKvrIXANuBc6gq3TjOuevl
TLSH
T1D25444E56118FF0ACA31CFBC08B186526C79BD17A923640777453BCD0A77ADB5232D92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\chrome_100_percent.pak
Size 117KB
SHA256 15a5bcb49a5c02d6a4e736e8dfa11dabb0bac0589641a4e25f0c06472ccaae6d
MD5 750913d55e87def9108e55728ba67d00
SHA1 a5944bc170d1f6c3223195c043134566471dae1d
SHA512 f5663ae3c775e2ec12dda6255afea99291673b8586048b131ca657a10be88cca61e298bb56797bcc34723fc8bf0a3dd966ad8b9f0e77747f963d8dada4f25edf
SSDEEP 3072:7lj4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:7lcYWFUbGz8LI1TdjQBQCrC
TLSH
T1E9C3D0E773B0AD7DDA464BB743560070FCB31B2907C2160E4B9AE479652AB88D9C93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\chrome_200_percent.pak
Size 192KB
SHA256 b7acfb068fa681f4ecb8f782bd4e3926590076c61fd0de3de4a12dde227cf52b
MD5 d476c19d21b3c2861f08c1c82fffddcb
SHA1 6f61aab7b6fba4fed5a7c222bdb96aee11f23bd9
SHA512 36acefce9f4e6837609f801bb340380f8e3e0de3f01872ef1e9bfd769f61ec2804191b91cfd01d90fb874cc9f4e685de7f2d03c21cd7e0bc6c7d8907f41dc12a
SSDEEP 3072:y6FJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:y6IGQ+N6uSZQDQYakvyAk9jQBQNd4
TLSH
T1DE1401D323B4AD3DDA530BB3926600B0FD7A20291AB3511E569FED397925F8889C9343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\d3dcompiler_47.dll
Size 4.5MB
SHA256 320565434e5d8a77e13980e9c0e641daa08d12693ac0d77df9ccf2b25d9e526c
MD5 20d9ebd5020c322365d11bfe49740609
SHA1 0c4248028be99dd04c48428537d98c19b20f12fb
SHA512 05c98a4ae88e305ca02c961526fb7a947036a197ab8d564fa9f530325192233b1285dd3880467db89f3f8a77b84f674c6c1716ad8e62b7b74a4db32d599578b4
SSDEEP 49152:y6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3h/d:yUdeqt737jFmRtF
TLSH
T177268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\dxcompiler.dll
Size 24.5MB
SHA256 d6f8ef1639d8db16be27efb25343bf0fd66ab59ad9bce308bfd6afd1a286a832
MD5 d95042eb38f8e86ae765e277ad9eb4e1
SHA1 0f771e589ae200497caad2a36e994f9e2a36e3b7
SHA512 0cacc0f0d0e0b0d4b52efdd7572c52b0820586207d3c68469d7bf7300d9969a28d889c2c149c56275f9a0eed5fb715993acc28057eb84a6e2723da123dfde310
SSDEEP 196608:rHf84ZxuoteIYgR8hBBphc+cNak+E3plFvSLhm76Nq7jYxQ:r/84ZxuoteIYfBpy+Dkn3pDvOm76YjSQ
TLSH
T15B4728122646D49DC059C879C7678B26CA6C30E73FA7B9EBC0F451252B79EBC1B39234
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\dxil.dll
Size 1.4MB
SHA256 39dbd950f39f75f5c37bcd224c524accba76686adaa372b8287facfc46892b1c
MD5 7067112277d2f68627618e4ace28860b
SHA1 47cf0ffd301d069be17b2460f736f54e5c7673b9
SHA512 cd092e1eee27c679314898b940d8d4f96c3ce24c0dbca88dc7fbf0d9640672941dde68f78c1be897be3a7db310ff8c3d96543f03e039726d13ac17c0724262a3
SSDEEP 24576:bcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/3:bsHMPzbOxBduHdSCde8ZF1/0Wy4oV6b6
TLSH
T150656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\icudtl.dat
Size 10.4MB
SHA256 bd8c145abdf3f8383276ce01dfa4ae48709bef9fef1c0711eb7c3fab4f6eb7c2
MD5 0a7cbe8e902379fc03c5c6c7c08c7d3b
SHA1 18ff020331534d21f24d922d4da3c253668e44d8
SHA512 88b94c5d350c2022aa27481e3a5c6bc74dd13ed1f2157dec4219d9b847469f7191f6fdc7305f3d27533c69f146324da8fdefbd8acbd2081965e74e8926d1e9c9
SSDEEP 98304:1/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndPj89o:1/cBhORok2HiXUxO/RJk3IWhlYntjdOo
TLSH
T180B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\libEGL.dll
Size 479KB
SHA256 491453005be0a7e987842a4361aa9998f86bbe73b6f093b4eb745ea0190a3d0e
MD5 90ac25ca50988ef3c64c6197f9e3fd4a
SHA1 7bf7b50ffadc47cee76fdc5c95840b7bef7a0cf7
SHA512 a7a9b234b9b691adac4962bb97f116a9f3b615132ca04d421b839f5eb37f0d3547a5ab12509faead627924b92acb44ed11b54af113275175b619c87212408e32
SSDEEP 6144:MH4Pv145l3Vs5LeKuC/TaD98SAPBdeEcOOzjzoH26y3OlSY61gl:Rv14PVeVuufSAPBdeEcOgj226yiU1gl
TLSH
T150A48C05B7E449B9E07AD138CA538647EB7178420B61F6DF03A0D2792F77BE45A3A321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\libGLESv2.dll
Size 7.6MB
SHA256 018044c76654fa1252736bee8d87f44aea7514f21adce05a48f00d1632283496
MD5 0c5fc615edb48b27ec8560e36d11c6ff
SHA1 ba721cf92d79e3234ae25ec522468b0a7ed287df
SHA512 8ee4ec0efda3c750dd777c89e13b2b3ebb1807d15eb1865dda3299a4f1c597530df14e29598ace9fd5dee7d630a2ca354cbcbe6f7b5bdcf141b4c20619a675e9
SSDEEP 49152:1go8b38JAGEhY562v+9QOxj+k/HdBP5AaKpsDS3afGooRpw+9ITW2R+VVkcNlKlR:p+38cm+dZgFR8hSkOlKQZPS9jmO
TLSH
T138867D03F69681D9C05DD2788B67A223FA34B8450724B6CF2AA457152F6AFF0EB3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\locales\en-US.pak
Size 550KB
SHA256 a46e37e61c7cdedf5d407f2be6440a895decb42f408ebc4f0cd0575026214ec6
MD5 5ae2ae804d645924629018eb3ca804a1
SHA1 d61cdc8f5ce36bee2e1dc2db68ff941e01dfd931
SHA512 492a7fb03429912ef0901c5c0471dd4d849155e9bfbfca7a6ea703b67fbdd5f31939c0ed1174a0eaecb37428295062060c08d74b56f7b77bda448023b94efd15
SSDEEP 6144:nryUXUBrjTlnRxjhrjJHfBLOFcGfIzUMP99QKJUfaYQrpqwvGjnngsZ/8twj:nryPZRDJHfBVAMTQKJVcjWwj
TLSH
T1F5C44C1FF744122A05A352A27F0995A2FF32D06CB35112563CBD812C33B6B6693B76F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\resources.pak
Size 6.3MB
SHA256 c0061855e2714674043841c3db83ddffb764890c2e6c03894a4a537f126af701
MD5 e562debd9ab17c436215911a8c561eb9
SHA1 6ca068c21ae26d14b2ec7a160c1129baf5495943
SHA512 38ba57625eed4f862dd70a4c8e06bea34c0693d223df80bab7df8c78c1f180baa7461a1c1eb94504342dab7f10b848a03ea381b0f32d5d2bc0fa90dd88d3b972
SSDEEP 196608:VEBRHPfIXoDvu4bkriACmZnC3gEL34tVrW:GTvrbkrDntEoVrW
TLSH
T1976633D277E2A80FCE90537A45488F3A469C6F2961D1B1D348DD6158EDADB2C0BC4A3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\resources\app.asar
Size 3.4MB
SHA256 4614a5244c6014c156c8d928764eab3f3b5fbb8d147310e036647d540eb47630
MD5 2e4fd4b87799870ba8c90a3a1c73d5c1
SHA1 9d25f38ab07772d09c7bee3077d3267160c1a9ab
SHA512 49b6c8c04a7182a5975d8f6d2c2a0a03cc5cdd0e460b21cba005a9a65e8f5da9396d53b5e5bc3082c13f220d03376acfa25ef8f3afe3b628d42cb1d1b60acd45
SSDEEP 98304:+Hkye5TDaKprumIhbE4UCCYv+UHh4EOnA7:+uK70CCYv+UHh4M
TLSH
T19DF59EE5725269734FEB22EDE932550276B9C006B05460BAFA6CCECE15C8409B3B773D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

build_info.json

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\resources\build_info.json
Size 175B
SHA256 23f2ee81d06a32c4378adb3fda96453a48ce097be6f73d1818bd457da7de2caa
MD5 a1aa38302abf9232e4174038fc296e6a
SHA1 084be31ca0531a5eefc6cea4454b69d9ed281076
SHA512 6da03ddc1ca9702825770fa2be3a256ab1cec0ca5a1a7ddbde19668035f4121485092046d3571a489c47b0f26b57cbac822fb402e5387f02558591459f46b861
TLSH
T107C012537520163B02F0D776860050A55184FD4F0274C96E207F890822738601581E14
MD5 SHA1 SHA512 TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9250\v8_context_snapshot.bin
Size 704KB
SHA256 47efa82a5cbdce5a4810e9e62e9dc04c52cbce5c7afeb38bb2b331f4243fa9d9
MD5 bde0f190c282485a3d699d35a71907fb
SHA1 34421e62dd29b71664fc298d3ead4d85cbb3cfd6
SHA512 70a2cac76289564d694fd7bb7d39f22665604c23f49843d3a1236ab5ab156ce482bba9008b581f4b7f3705cf0ef67da53b98e322826ebe145e5dd7fdfda6ec11
SSDEEP 12288:/15XrgXJ0ph2NdOeP8POqYUdEMH+jURWYS:/1uSP4H8POqYkEMH+AtS
TLSH
T14DE49676FB0ACA26C8657A7D8DE74B063A34B2DD8EC6EB077011937CB4B86544D1E20D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Update.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Update.exe.log
Size 1KB
SHA256 e96331392d474ca0fbc51036c7d55aa3a37aae6b074d50ebd106a277b0cb4097
MD5 6eb96c16eb677b6a8c1df381a0497a1a
SHA1 d4596baadc2d4bee89d57e1718ab30c0b7d563ec
SHA512 3d472d56ceb73a3df3f65eff6af088b3a81ab553153cbda925091500a6543cf83e84872f2bc81f218deddecd8f3c9868d784c2fe08ece95f915138becaecfb0b
TLSH
T1F0310F312271B0D88D133F53193C258563EF4358FA505F187519624FEA3A00B6F261F3
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 19d9440b69744ba26e22eccbd688860d4c15edaeba45f0c10f517f4246a67cc7
MD5 40006a9cfde056f721473e3bbbdc51e8
SHA1 f3b77aad13ade0360c0d68f0aab74462d1d5d4c6
SHA512 464d1d533b854806ef67c1a852c368468ac16f397bb0e310864492e9a514b20f0d9aa5d096529f9748aad312e85bab589785ec64d251c07d95772062334dcc36
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
TLSH
T1ADB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 cf2cf0df7208efbc3a1ed63977982a907c857fd4f2924c1fa239ec7f138bcff0
MD5 ddc4b22d030474a931a9c78c33eb7864
SHA1 d13fe626514d08e193843a7b5cb204d930943590
SHA512 44680c51b6378d5d47fdfdf6ca69d95de4c064fcd1db9ac1d07b4e50bb2703e323c1e46b8e03804885830d59522a7d80ce01acda562828340b83d962534f0053
TLSH
T14FE026E50BCEC22E9B51A58792A8830CC3C2360B9ACCA90A3B0884DE3005060A3C2DA8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 e1864f0d6dcf6d8400d462cc689925eeef789b3797fe0189e55ed5373de071a6
MD5 fe01548ac89a123ad2890fc20f56adc1
SHA1 5c2a963ff0b21dbf0c99b1af66e87bef872a3504
SHA512 b1c513f04c14b9a671a042b1e2b391e67327ee7248db98eee7cbb82f6fba9933db30cb6fb83369ad4cc30975cf178e66ea47ce0e16e50738373b76e1267a3425
TLSH
T11EE0D86E9ACAC1AB4503A547A0CE9338C3AA71079DCCE45D3306E48C94240124BD9EAC
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 249358b1eab901f0b034023569e7f01b1f94c9179591789d99d6f279761d6e1c
MD5 e3fe72c0f542fbb29d9eb8933eefb382
SHA1 fce9a5a6bf89b76d58b4c0f0c691531330ab3b3e
SHA512 f71315278d44c74df19833e56e16d62705ddd45cc9bbabd13be55f51927a3d7464736846a1c4bcda6770c5b8c0720e1defbfbddb5206de648079efb1a9250340
TLSH
T17EC080D9BD4D845FD385187E5716F00007906511942796171650FDC032419A01E29220
MD5 SHA1 SHA512 TLSH

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
Size 32KB
SHA256 eff9dfe4ebe815c15fa6087a8b712ccacea7a59dddcb55a5c819293252d73c32
MD5 cba69340542e691fa9e4b30334a07507
SHA1 4af443e83868d3a18fc9ad853e58eaf39bb065f7
SHA512 4f8d78c0ae8e04e27dfbcef602d3d46cdefd8f01085cc549edd35805d775065c4f78b75da617adf5f8f699a9edf7fa69db7c267917e5f9cb967e59563f905227
SSDEEP 768:wOsAPzChBrMSp8DxHnpmf3ILP1KpbjtXPgYVkutZ:lsArKDqtO8KZtXPgYXtZ
TLSH
T17AE202DF0C15679A01C371AE6A7C6024EBB3E07B3035CA1B1E764CD250B6660E5DB8BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 96KB
SHA256 6c501148aada1207002c4dc6fb8794554897d71abeb97e92d9d15c8cf61a8448
MD5 76c1b9685c996f14f4cc8b585ddfb467
SHA1 e774b883f6b5736a9f0f0f05cfed247fdd8bdf6d
SHA512 d67c98951d327ea38ba3e761a229436782094e823847d989ddda919aa4de613bc7c5bb057968856414ecf2f2fe82e823bf3a04691d62ad7b67f7b6c142a807d1
SSDEEP 3072:rYsgcoaeqVBTILAbL7ABGMeTDm0ZSfKaXH:raU6qL7ABGMMmEFkH
TLSH
T1F7A3127B369F8CD14907CC51321A335688F4D0ADE2BA066B3D102E6A3B0B75F7A86F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000075

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075
Size 405KB
SHA256 2b036b7e09fee4750d77ccd8ad23938777524be6c38c71f7055906813870d60b
MD5 da77c21ff0fb800a00576fbbc57832a6
SHA1 def9ee27b7f44abc2dbeaf1b56f242c140993adc
SHA512 5b463b253d5f9c713e7f89fade6509db42bad397158b5d42bd541b5ca15e79067ae0199d7382de54fae92f9d712b0f66003ede6f5a45d15317023a2c2242c41b
SSDEEP 12288:Wkbz9yLTEpq7JjSozRS7Wlc6YpUl1TQ8cQZB/1wmx:/bxyLYgjrEsuYwmx
TLSH
T1969423D7F25924C0D1A4DB4CCC83102FD55328AA66246B0EDAB8164F3D67D4FFED982A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 67KB
SHA256 76cf4c97264a6758f3d6ba9b78ce0a4130fe0804100305819fe8e9145526e432
MD5 abae0fb3c48e9ff2101729741f639220
SHA1 3ff3b23eb90676ea32a6c03a454e6d85eb269a0b
SHA512 bf88989d4c60813fd61473092975c79a3e257e2c5d99cc30ec6ed322ba75042cb42e6051e958608033e9e7f8ed60807d8e433793e2528aefbacd46c28e447f9d
SSDEEP 1536:FVlVdK2EiPI19zT1jQrvVqorLuZJHOj5R8v4yPqBpkzTjVRz:Xl3hEiPIr9je5/uTHOj38QySLkzThRz
TLSH
T1A06302F37E5CC85E8EC4B2B837DA19A1B027D4D63E5580F5ABF910C3E1E424A07D949A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 1d457898b38b207bc7acaa4b5bb444d3f3577113e89b97e8fd24477abc795aa7
MD5 bd853afa7dc28dc05d10e964e132ea7c
SHA1 6f2a9255ae25834e1396b37cefc0b2b2377d66e8
SHA512 54482219d7f815ae8d64ae3689a457aa85643ca6ccc2fe4f58ef7c6d79857dfef030efb0b71fc2bcc8bd8ef568b059716dbf956862096782efcd5c4ba76409a2
SSDEEP 96:aEFY49cdflAclAAh+TNfV9rotgcDXSswmk01TSR6IO:5Y4eJq/6+TBvI7xkwevO
TLSH
T1D002B53251F05BA2EBD550B169F11A4AB27388DAFC033E87DE4365B0170EFF49691329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 a8ee4f041300e2ca789840b24806f0e8e3ac6c843170dd4b869080275698d0dd
MD5 152a302057b2a12e9728b7969f636969
SHA1 6a3301032db796a504e130a586906a82acdd2ee4
SHA512 239b9ac80d6b29ba64b2de4bc5133b52dadbd602da488cda9e9405f627a3e33e732fcfd7ec0686958efb8824041edfefe01bb102cb54e5f233e42ac4152f3cdd
SSDEEP 96:RKR5EFxhcdflAclAeAh+TNfV9iot7ZDXSswEkXkh1fSR6Iu:RKixiJq9e6+TBG67vkXk3Kvu
TLSH
T18B02A43250F05BA2EBD851B169F5190A717388DAFC033E87DE43A5B01B1EFF89695329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58de93.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58de93.TMP
Size 3KB
SHA256 98d25dddaebdeaa75ecdbbbd6e74bca8410ba497d85e7380b94c23e85701e94d
MD5 ef375c826d57c817ec8c983ff4a04be5
SHA1 1d49a514f4163aff5ee65451513454269354efc0
SHA512 1f2cafd2706360af8c6dbfa4af5c57fb2865dcf3ca8879e71bfc7e5a50107f8414fa6d4969c198cc669bc454250eeba960fce1d152eabb9a3fbc2369badff2c4
TLSH
T1E8719335552693DFF7E602B290C12255F6328DEAFE273E412F2379B45E01FA08169388
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 221ae6ea05f6ea02175163e951a49cca11cbe3b28592a4743ee605b64509f860
MD5 90ea4ca4fd4d916164d139ac736bc935
SHA1 23d519baa6b9f9a9b61d43c37652751d094d86c2
SHA512 4e46b7bbb6a9137aad80f064fe76d83482d1fe64c2038cf823989a24e819ae33dc5f50361814c593782c61819291d7cf54c59a62bd079ef17a30ed48817b6b37
SSDEEP 192:Db6g2RVq6+75snSxjYt50idzo5GtWvUBruYffar/Krxvg4x:Db6g2RVq6+75snSxjYt50idzo5GtWv8T
TLSH
T1B5F19AF3C7E9862DD91152F0AB147E1FCE2D095543683D2A84E4AF4B97E24B1F181B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 9864570c8b9419a1f6d339342f99359c0e72185fa796f16c0d6276b20e139ee0
MD5 fb6c2e66a0dab98e3f9fa49fe63388a1
SHA1 33cf02a29911e823d25dccdfe61be84ddf5bc41c
SHA512 55f1b0891946cd768fd0384c9e72f46914eae0732a68d79c87ca9d5feaeff68a7f4eb56c3f1cc900601a70187a9902011247e396414d98c65ef2efc294db218c
SSDEEP 192:Db6g2RVq6+75s0zSxjYt50idzo5GrvUBruYSr/Krxvg4GIifx:Db6g2RVq6+75s0zSxjYt50idzo5Grv8q
TLSH
T122F19BF3C7E9862DD91152F0AB147E1FCE2D095543683D2A84D4AF4B93E25B1F181B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 93da99301f934846f96614dd0ecc7a855d2434c7b742848f0f3064f0265d0dc3
MD5 8b3fd586279843fd4dfe3b5e33989ad4
SHA1 3764c45056a099c80350398304dfdea6aa466d3f
SHA512 b044def0c131c0e5556d3a15c9274e4bce3b48b7ea46b785d73c4233d10c3198f59fc03ea1bfb87b54afc6b52f1cf2772aeff43202b1ed4c5ab54b62eec4da40
TLSH
T1EDD02273370132BAA56C3FD1A06AACCFC33A002E4C52EDDA50D0E89D1A3286D1D07289
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe587913.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe587913.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

a74779b8-0651-48ec-a5b5-90bfc59058ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a74779b8-0651-48ec-a5b5-90bfc59058ed.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 713a764826e0bb2a8105abdf378af44b63032525edbf28214519dd3202a722d0
MD5 1e5a57068bcda85f350f001276b5eeb9
SHA1 5e3b984a80a0774d01a3439887697a7b5c398b3b
SHA512 9dba02772222f26c165ce6eed2bef41cf22c4dd431168b19ec5760c5f464699833f6fc44b8f181a99dddfc05157578315c2f1c5208dabbc24daf70709cb7c5d8
SSDEEP 192:sxZzRpyM/jK1Ml8MWOY/fysSvwPJjbSgdpmK+HW6+WNBDwvWU/YIz61YIg5wJ:sxZzPuOY/fys8wPJiwuHbWV/Di
TLSH
T1C862F7126A34597B8CDFD209F9457B63E6F8047396A40E54AAFCD91C04E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 6c10bea8743e2d7d1b5169abad08d0c3bf32e379a088a84204bc2e7c1547ff3b
MD5 7bc8430888c43fd0588fe591fa1fbae7
SHA1 34e1fc1635cca8b1befbcfcce99da28c02facc29
SHA512 f4ff2ae2d24112ccdaf9021e6a42ef8a405898c23d4e301d08152a8bc2ae0cb7c978d82afe93f1461a8e06fab16910a4b3eb43c7680b034a38a33df222261bbf
SSDEEP 192:sxZzRpyM/jK1Ml8M0cB1Y/fysSvXPsaqbSEddpmH2i+HW6+WNMmDwvWUHih/YIpc:sxZzPsm1Y/fys8XPsa9e3HbaVE/JULb
TLSH
T13282E7526620997BCCDFD609B9217F52E7F4146389644E5CAAFCC90C04EA7FD221782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 3aeb805ffe5c3e7216c2d6a4551c1b91a70803f1c3c64a5f0f812343bba1a694
MD5 8225572441bc1b9491536db6cc17cfac
SHA1 879cc15f5f9bf53770b9b8c8cc37914c51c47aa0
SHA512 26dcfab67a39d72bca23c00f178a1a265a9bb2973ed5ab97c6580d2836fcbd439d720d2f7976aff04bc02727394a41005afe953f3984ca1e674474b8dfa193ac
SSDEEP 192:sxZzRpyM/jK1Ml8M0cB4Y/fysSvXPnaqbSEddpmH7w++HW6+WNMmDwvWUHKZXYIa:sxZzPsm4Y/fys8XPna9edHbaVkXpULb
TLSH
T15E82E75266209977CCDFD609F9217F62E7F414638A640E5CAAFCC90C04EA6FD2217C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 2b859fff9b1e61e06db2c800e0a2eb40a31112133e11955f99bf9e694e744c93
MD5 24735d4761bb3271a410edfd2e11b76f
SHA1 c61091e3e6cc073571c67dc87f9b7845c68636ba
SHA512 1417621ec33b17744c34b1c318b0d1d2deaf2738840231251a749213f27b09a3edf41d3220a4c386aae5b2ab1561f05aa91858ce3823b5f747e69f718c555970
SSDEEP 192:sxZzRpyM/jK1Ml8UQ4qcB4Y/fysSvXPnaqbSEddp4H7w++HW6+WNMmDwvWUHKZXI:sxZzPqXm4Y/fys8XPna9eTHbaVkX9ULb
TLSH
T19C82F752A6249977CCDFD509F9217F62E7F4146389A00E5CAAFCC91C04EA7FD221782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9948a742c976a0cf4bcd0ea02a535b5b2925f4d0f7fa03aeeb360ef780f89fce
MD5 0f88e1a1bb62bdc059b53528d8932dda
SHA1 0361045181f91b57237bd4d7cf1fd1273471339f
SHA512 b0e54a0fd55bb4cdbbd62cd32b4978f5811b002322a7e55cb8011fb746694f72f19f981c4a0337d213b3793663259c295de8686c0b75a4689bc53194c544e948
SSDEEP 192:sxZzRpyM/jK1Ml8MkY/fysJvwPSIdpT+HW6+WNoWU/YIm61YIgrJ:sxZzPMY/fyslwPbyHbq/C9
TLSH
T1C752F7126A34A977CCDBD209FA45BF53D6F51472A2940E44AAFCD91C04E7BEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d6185ce6509b220235556021b6c0087d7e61f9b6529264477a166b55319e222a
MD5 7fdb11e8ac910cf3e5778fed75f0147f
SHA1 2758fa8b3b9c8f112d23447e8a83084539d1d439
SHA512 de1c4ef865ad641947126adb6455ccd4a805f75be8b578db205749c6778ceab49c1a4926cabbbe912b42460482aa7390dce25159b44d8992b9024257215ceadc
SSDEEP 768:rbsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9Qroj7U:rbsqxXlWvJD6Tu1ja54LAs97jY
TLSH
T156D21B3B694CC77E4F840E5CEC266FD66ED801CBA6988D5447FA880C03CB3EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\783ff0be-338c-40ad-8053-33ee09a8d709\index-dir\the-real-index
Size 72B
SHA256 52c08cbc001905ef78e5d5d3adb4ab7d5fb63d3c174093cc22dee7fa6e67a530
MD5 0509f0f524c423e6ead76deb10c31b26
SHA1 8aa61b544b8a50423e5975c079c397286b5526ee
SHA512 5c9d72cad9be4e0230cc0cf511214bd4829de1eeaa5736766d86307f5f5a0157f96dfec25c0eda612af7b6060dd7a100ecedc1935281de2fd23ffb53bab12bb7
TLSH
T131A0022013849245C11212F6AD9202417300CCA265141747819E70D4DC504C08EC204E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\783ff0be-338c-40ad-8053-33ee09a8d709\index-dir\the-real-index
Size 72B
SHA256 b2636382f381a28293899725005a4b51c45fd35eeb07a1573eb3d04fdb175b87
MD5 eaefbcfe76a41e70510d6ad9bb8603fd
SHA1 c897d807ac9d52b80488883db4515d593ebb4668
SHA512 f717bce48912044a26cc5e2fcbb66e6037afee846f202ad6586f678207610649a2512b8aa64bfa89b8d09ba2ad6a6edb257f90c112572361575166c0b13f513d
TLSH
T10AA0025442E03001D01312B366F741A223205DA04216132942D0005CCDD4B774A47D0C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index
Size 3KB
SHA256 38f068ce0d78245cb340699cdb37002ecc0c09ea968f338c6c8caf140bbef164
MD5 e95fe742df4fc34592d71a26c66ba86a
SHA1 6130aaff0cd138f36b078d94e91dbb25b840631f
SHA512 7cfbf66119b71d4e43bed393970de3f1acad13c0a012aa0c62f27b871bd676f3e7c510b0a21d8a46c5b8003f529b13af0966037c7f5ab0409e21503a4994f840
TLSH
T16551C74E8E476B6ADCAC24B31CF61845373264FE46849F1BA55CE4303CC33251E2D516
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58219c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index~RFe58219c.TMP
Size 1KB
SHA256 f213d3f221f6276e29563889fbdbce9dc53043d2c6c2cd35e8e99f350a23bb4d
MD5 1f7993b611d31ca7ed160b341d1c05f3
SHA1 abfc6b3330f08d8d2ea9b81962c1af746369f6f8
SHA512 6f3db7651af2fb6c7fc02316b60a69f85eb45c5eb6c1a8b12c8242bf01c12906545425a42788468427228c90b9c5583cdf68ee8d30a230348660b690dff65955
TLSH
T19831358B4B51591FD8E840760952A4B83379C840632277C3D87D633E6C7579D2E5F0C9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58abdb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index~RFe58abdb.TMP
Size 1KB
SHA256 1ec8ebab9dc9cf139c83fbe4582598958069b7211b4f5a258b79e5364a68f0a5
MD5 cbe2d26ff26772622e0620f534ff6663
SHA1 1398e0b90c86db9cf040ca188a186c0ef338435c
SHA512 adc6fb4df0e219bd8a40873fa1fc9efc4296789d96f2f77e9b5e82b1cf79f9356b003ddfe8c1344487a6a485dab194192b3b48bcb49a4fdc764966c5eb94285b
TLSH
T1C63130CD8E51A99FE5A488B2107271A477B0C9CC6B11E7138D7C62773C2634A2A0B1C8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 c7fbdaac6f878c58c748371fc63f84a920ba92489412f91537862efe92a0bf2c
MD5 073be249ab2417affc3fcec3b8f63c68
SHA1 6acb1307229858b826b8ea089eb70c0e51a6fc17
SHA512 12e9489427a1fb45938ea3c84260cc6a9ec7c7801955515430951f4507e2af680f76e09d011fe3447a2eda37bb02ef6331d297080038243ea2fed75c8355e207
TLSH
T1ADE068B62AE70804A8ABD3DA087254960401F428C851EC5F0029968310722612825C26
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 cc1620e297fb6195024b05d21dfa25d21c984322f358f72dc5e9340f74a7c607
MD5 79bdeb8a5623131142abe3020da469af
SHA1 63faaa0a0779e5f074f1b2440f093763ca185569
SHA512 53ab55b6f6b614962954e3b9dde4deacbf847654a2a9fa44cbb3769c3014d2f3a13d9edd16fba7f1ac0d8ecda829a1d1d12e38aba8295b00a568f9cf9f446518
TLSH
T183A00221CDE48443D10113B49AB511856A948CF84709331196AC0064CDBC14096B3204
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5880f3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5880f3.TMP
Size 48B
SHA256 6fc8b35b8e23568f44b6fc4e7f5e865000f52d88bc22b5d217046e21ed5c3e4b
MD5 f70bfd54fcc23c0cff1e06371b58773e
SHA1 1c4cf295e68828f927fe54c81107120117eca391
SHA512 2dea9437f04a171faf7b00300f6d331a433c830b3c2072178d707f9be8d992544fb0980c8f5b67aad3f7ea3e7c272a62f3ef27af831a2c3d10535408e5ebc854
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b0d8d7d7add31b8701f44018ac33e8d960cecaf7351d75016a195336f21d3b04
MD5 295bd4d9381629dba94eeb71ef358ff9
SHA1 c78ea2b4780a4fccf80524a3f68e37751c58b7fe
SHA512 2c76b58e52b3ed5177433c12827e2212d7797c82b87c049356ee47c663c44faf51421fd3388fb773d515aaf18ec8f097dd01053e243b372fac2fa4bcc361576d
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTy3JMdIdKegIvyNHIFKMko/a5Gaw5:KYbaKYIKvdCKegCeHuKMk0
TLSH
T15E91001A757A0212387D29A8B266D93B4F413A63701CE46E3FB850660BA7E110DFDDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ef940a25-5f89-4fd3-a2b6-368fd3faafce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ef940a25-5f89-4fd3-a2b6-368fd3faafce.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58c80e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58c80e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 9eed6407de4b68133e534059d6ab3baadc83ff42241f762b9cb52f55fd69fe7a
MD5 081f9f466b5b896015af5ac5b3b7ebbe
SHA1 5f28221d3e7f19d1967fc2decbc34e37192d1ae9
SHA512 8f2e8590f18d19d9f7b5bc51352f4cae07c3448881f26705791ace1e999f43b77d3c600b9a525db62f64cc180a4b235f7787d76be460ae7d308ed275bed53884
SSDEEP 384:t4iFiZcIrzsN08TUNTUlIlhTr6WOb47ViVRNmd2OYo4al9kY:pFQ/ZwgJZwHmRQu9P
TLSH
T115B219F248E7583ADAAE5B03A77E3D134EBCD027B9D46650B3985A0CCD961BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 4ae40bce9968d3f895fe29a1d5864ea79e4bf55799367c9ce4bd4267118582a1
MD5 9fbd6774729bd41a2241adc06b581a0a
SHA1 fcd818e6212bbe85368d778311105829c225b472
SHA512 b27eba7cbfe749b57eafc3f75b0168a0a08e5eb219ecbe9d4a2a9b49c8182f1905a21cee40f9bcc03441eb424fe1584027e7ecd88f22ab86312eea89f8d89462
SSDEEP 384:t4iF1ZcIrQsN08TUNTUlIldTr6WOb47ViVRNmd2OYohal9kY:pFN0Zwg5ZwHmRZu9P
TLSH
T12AB219F248E7583ADAAE5B03A77D3D124EBCD027B5C46A50B3D85A0CCD961BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 c421dc5052f3047c4ea7133e2066273d675dc6c6bae06d3b48b0ee6e9ef1f48c
MD5 2f25a3045750ced7783445b0883abd37
SHA1 47b6c88db84139729a719b14d2eb2977055f31e5
SHA512 67a3240c5755132f7ec9680ec4ccd66041b97f7b6d7d770dfc5c293c761a18f50ed33da898b25a24b2a886aa8132a6c6ac759a38926b0ba0755e427b2873515e
SSDEEP 384:t4iFrZcIr5sNX8TUNTUlIldTr6WOby7ViVRNmd2OYo2al9kY:pFzdcwgzZwHmRuu9P
TLSH
T19BB229F248E7583ADAAE5B03A77D3D134EBCD027B5C46A50B3985A0CCD961BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 51f8b8944d842eab6c75d588d8c92bf2d3efc5385fe061b50dcba0cc9319ddd9
MD5 79b383118dc21d3fc6492670580dc3f2
SHA1 acee57743179ebe05c180eb75a5d6e81be93e6f5
SHA512 51bbac7d7003e5feedd638aca0568584a594f949f18851f8efe97f959fcae831e3f2c208f7624348e12458cae68bfc6363ec1401b7ad6f0a85584f3bbac0244f
SSDEEP 192:ueLsN8GQ9T6WLkRbS7QmiU1hIB4VRN5+Fd107ptpefPwoUvSRyqwfl9kpl:fsN8GE6WObE8uVRNmd2OYotal9kv
TLSH
T1DF423B366C786C7B8EE66445F44B35136FB49167EAC92F8096ED9F0C01DB6AC130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bbc584187b430242adc7d10f229169475c2be708dce8fd1ec32b0bdae3b195c5
MD5 96ea1c2b820f55b4965a7476e3b6f1cb
SHA1 7b7af7a72f70bbc13f2fb423905d1b36151eb2fa
SHA512 3e25a35c94b6ae3e59ec2924813841df945b1e71c0f5db060dccd85d63e4b15841c7a5f4fce0a9e0820e5813b17f50fdf22e93c89326f502353b07e25a92dc4c
SSDEEP 192:tON06JkRtQmiUyuiW+RN5+Fd107sh34RHJU6:tON06UrAW+RNmd280JU6
TLSH
T10F02C835AC382CBB8FF66D0AB58B37135FA4217BBA952B84D6E85F0C01D765C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 c49956872d1130ea058693a31e30f755aea84c4bbc55cf14c2e573a20db2dc45
MD5 0adbc12f7fdd971ec10626bfe6d906b5
SHA1 b115638a68412649e78aa3cad04ac57f6183a7cc
SHA512 f084f772d143a84d892816acb1d282c1e2e7b2e50131b01dec7a699a60dd1b8317e4dbf817696328b4d5ee9b2ebf00b8e7fe7d1ca6974c8a193a0e8a0b81e86d
SSDEEP 384:gZcIhsN84Tr6WOb47IP2VRNmd2OYotal9kY:eh8MPUHmRVu9P
TLSH
T18E727E325C782C7B9EEA6405F98B35135FF49037EAD92B8095ED9B0D01DA6AC131BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 8a78a6ee112adffabf3aa9153ca31456214c0f496c43cd96d2d2ad17823e56e0
MD5 f33a8502eca14d285b1d4b27496da1fa
SHA1 bdbf2acab59ecbb4be4a609f3a6d51b27cbe48c6
SHA512 f6274e49b56fca146d42c6841a313077a8d3116459d01b997f8f360ca8ff75bbf9970fb93d004503278c2a4f5e925f957f81262e6fb411238c34ee90a6213591
SSDEEP 384:t4iFPZcIrZsNX8TUNTUlIldTr6WObq7ViVRNmd2OYo/al9kY:pFHFcwgLZwHmRnu9P
TLSH
T1B7B219F248E7583ADAAE5B03A77D3D134EBCD067B9C46A50B3985A0CCD961BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 4943f8db73f5362a61c589378668d37829e2831918fee55bd83d2ab0b898dcc9
MD5 7189ac9cbd6f65cbc09271f1f0cf040d
SHA1 79bb34acad771a86f98727913f6f8495afd99174
SHA512 95a848deeb6d95a3f1d8b71c66a07dcea88cc726cf2cc3ecd458e17060f0aca07c4f129915c6b0ecd2d7af8c4a3ba4e721176e1c758f997891081caafd3576c3
SSDEEP 384:V9ZcIhsN8hTr6WOb47viVRNmd2OYotal9kY:7hHzwHmRVu9P
TLSH
T166727E315C782C7B9EEA6405F98B35135FF49037EAD92F8091ED9B0D01DA6AC131BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 cea8244ed75128b0af8ae18a827145b78ecfc6c0e6c6adabaf17de57b43030ab
MD5 a6386c5accf3df0de25f3453b39f5c0c
SHA1 628466091aa43bab03c8eef7844f79e972d328c9
SHA512 2857af3ac7a65d5e0e666aa13436fb57d2c53f6c3a46c2b8dadbc8ac4fe0d20bf8451a129a0866b35e97bf9a36b1b7b0d7abc8cee8f502e2b7c6e37116a84c40
SSDEEP 384:t4iFHZcIrZsNX8TUNTUlIldTr6WObq7ViVRNmd2OYo/al9kY:pFvFcwgLZwHmRnu9P
TLSH
T1CAB219F248E7583ADAAE5B03A77D3D134EBCD067B5C46A50B3985A0CCD961BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 71ea43382358623f24d0dc7bc88ef2d76832610b74314fa9ed502a57509ba48e
MD5 453e0cc73611979d6ae2286477dffd85
SHA1 a0dec6652cacc6dadebe9f71afa690bf1537f54f
SHA512 a7030b1b8f0f10346e0c048deb57c77476e9f7f90a06983fbbfddee51724e34cf2747bd2dae60f36e1aaa025685b54ef5cafa102aafcecf69876593922c34681
SSDEEP 192:zONl6JkRcQmiUypiK+RN5+Fd107ptpefPwoULVcyqwflU6:zONl6UstK+RNmd2OYofalU6
TLSH
T11C120A356C786C6B5EE66845F48735135FB4512BEEC93B8096EC1F0C01EB6AC130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ab09b50fe04fba7d0151cecefc80fe5586a72d7a393f258e6ea5a79982235c39
MD5 dd3a4e1a855c398a77d5f65f1ab0f112
SHA1 504f55d496067cf2fede7d512a2de068e8458e9e
SHA512 7aebb7f9659abdb7234f251a0bb03f12ac7f398558b52a74150ba063b386da0ba6245022764767d9cde89d972f3d66fbb3cb00b379a3cfa1402baff6749438bd
SSDEEP 384:t4iFPZcIrNsNI8TUNTUlIRdTI6WObt7ViVRNmd2OYowal9kY:pFHR5wgvZwHmRou9P
TLSH
T1AEC219F248E7583ADAAE5B03A77E3D135EBCD027B9C46A5073985A0CCD961BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5faf871e22685f4e95c3e69d461f3c1317886f0da05fbd4f5a6abe86c63986f7
MD5 4508c4e3fd3f9d36e9d6c96fa7525e7d
SHA1 2782fa38f8a0c28a605db5a76cf7fe3c0956fc51
SHA512 8b198990a1677fe03c06a52edd232581d145ec6d254642edf2699fe1b7f1924425cbf801e0e771848de5bd04264a588e8f3968dbcf9d595aefd3a02485ff23e0
TLSH
T11BE002015340007FC03C833000C32B303EF5D01013F38305562002686D373142770FD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 92a1b39eb6a92892541a9fed83ca8579fa34d47ba635f4c2e3590d76ca213d79
MD5 b97df76bfef125e03d78d4dfd129204d
SHA1 76e43e99d2cdb2483f86363c63bad8535ff6e80f
SHA512 e0b8b3fb9d611479cd8adf2695ced9c4cbcca996c44a74e4785301842758e8c480a999417c5ccae4159650a4d8745b44f6f04bf58029534574aa7320f4c73991
TLSH
T12EE002011340007EC03C833000C326202AE5D01003F34305551002545D273141770FD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe587f5c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe587f5c.TMP
Size 392B
SHA256 5abf510d2c1138e3da6d553cbb3e4e8e16b912d5e41a24d134d59d0c24d2b0e1
MD5 fac027637ee6c4e1254ebc055daa8bd3
SHA1 581a1c449e572c7b4168e7dfd63bf1d0814285a9
SHA512 bab1ae9067a2c985f572b673de1ad8d22106d4317730c5eeb095165d3583ccfe05da11fc5514c34ea34edba1698921810a8a2b383827284aef4e7eb7211b3833
MD5 SHA1 SHA512

Submit Download

6387bf1f-6a35-44eb-8b0d-d1c78681e8e1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6387bf1f-6a35-44eb-8b0d-d1c78681e8e1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d71dc121d8871fe384a3121dd888afef22aabb68c18bcca3a0a831f8d0bb38d3
MD5 7929fc56db3d8e0d5c9bc26091d026a0
SHA1 731b54a1ed4c9b303d2309dcda2c48ba5bb30344
SHA512 1ffeac1fadb9afae47b5610d711bc5d61b06729046e30b0859b7ddf82a14df135ab3ff15b286b1329b2ee41d41430bf9e6316b3ddb4561d15b43535a8c5aa27c
TLSH
T15F412B9CA6FA1148B3B76E5A9BF6686D487FB8772F06D45D10110E4E0622B40CDB1B37
MD5 SHA1 SHA512 TLSH

Submit Download

RELEASES

Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
Size 81B
SHA256 91303824c70cdb089067009f289609ac6464bf10457a2ccbd7676575c26f9f92
MD5 076a34c6858b5b6a1379fec65cef8d0e
SHA1 bd8a438603331ed156407e8a9e9a8e88d2f51702
SHA512 b0f4dea861ed6d61803b0b241d750c36a0e0cebeeed082fb18ae0447a2e72524b03a26c329be28a87257ce020441d55d164418e6730b39763a3356fcdc5874c8
TLSH
T1C5A01269330061FCA8C8228808260053114414400446361D2D04C1421D69188021F804
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 1.5MB
SHA256 2d3d94c4f9b223e7426c13c346950ee9b1b26a6450d9cc913d9aa81cd5380c1b
MD5 3e3cca2648f5c9ed4d990f3fd49eab08
SHA1 3198ffb8ff331af44aef0e554637c78b2d0ccf52
SHA512 e85718d2ada95da5b7ce541241394cd4332323b49c91074b184816c37df3bb557923ec3be5847e97667d64cec51eefd776d8466062ae9a87e23cb84e919dda0b
SSDEEP 24576:3BJkrlr7AiOlwOpJeYOdTNK9RgIM/aR9Gl7MRHc:3BJkAlwO/X9Glm8
TLSH
T1C4753911B7E88A2BE4AE57BAB071016547F3E5866376F78F6A4CA1781FD37804C02367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

044d1d9a-8089-42b4-bf57-5c030c8eccba.tmp

Path C:\Users\Admin\AppData\Roaming\discord\044d1d9a-8089-42b4-bf57-5c030c8eccba.tmp
Size 57B
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a
TLSH
T101900297652634755E1F1D65400B889B5CF905704E0B5E0641D032969A2A45D088705F
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\discord\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\discord\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

memory/560-1698-0x0000000005970000-0x0000000005990000-memory.dmp

Download

memory/784-1885-0x000001F3430B0000-0x000001F343865000-memory.dmp

Download

memory/5224-2033-0x00007FF7566A0000-0x00007FF757919000-memory.dmp

Download

memory/5516-1471-0x00000000005A0000-0x000000000072A000-memory.dmp

Download

memory/5516-1486-0x0000000007BD0000-0x0000000007BD8000-memory.dmp

Download

memory/5516-1490-0x0000000008420000-0x000000000842E000-memory.dmp

Download

memory/5516-1489-0x0000000008450000-0x0000000008488000-memory.dmp

Download

memory/6048-1781-0x000002540EEA0000-0x000002540F655000-memory.dmp

Download

memory/6072-2034-0x00007FF7566A0000-0x00007FF757919000-memory.dmp

Download