Overview

overview

8

Static

static

3

EndcordInstaller.exe

windows10-2004-x64

8

EndcordInstaller.exe

windows11-ltsc_2024-x64

1

Analysis

  • user interaction
    yes
  • max time kernel
    264s
  • max time network
    267s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/08/2026, 13:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    EndcordInstaller.exe
  • Size 6.1MB
  • Sample260810-qqt8dszbjb
  • SHA256 a7a9d829082fcd7ca61f5790e8cfed10af8a4002170e7e5f64150bc2e93f0fa0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistencespywarestealer

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 16 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 40 IoCs
  • Loads dropped DLL 47 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads ssh keys stored on the system 2 TTPs

    Tries to access SSH used by SSH programs.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 64 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 32 IoCs
  • Modifies registry key 1 TTPs 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 59 IoCs
  • Suspicious use of SendNotifyMessage 41 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\EndcordInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\EndcordInstaller.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4500
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c taskkill /f /im "Discord.exe" /t
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3512
      • C:\Windows\system32\taskkill.exe
        taskkill /f /im "Discord.exe" /t
        3⤵
        • Kills process with taskkill
        PID:2684
    • C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:5144
      • C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe
        C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9251 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.7.1 --initial-client-data=0x510,0x514,0x518,0x50c,0x51c,0x7ff7db215098,0x7ff7db2150a8,0x7ff7db2150b8
        3⤵
        • Executes dropped EXE
        PID:3732
      • C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe
        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1756,i,17125679191703999132,15065224491570205581,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1760,i,11893734725187444997,11529170730243920894,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1744 /prefetch:2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5332
      • C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe
        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1756,i,17125679191703999132,15065224491570205581,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1760,i,11893734725187444997,11529170730243920894,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2000 /prefetch:3
        3⤵
        • Executes dropped EXE
        PID:5388
      • C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe
        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1786368017943995 --launch-time-ticks=732116836 --field-trial-handle=1756,i,17125679191703999132,15065224491570205581,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1760,i,11893734725187444997,11529170730243920894,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2476 --splash-media-format=webm /prefetch:1
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1140
      • C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe
        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\resources\app.asar" --no-sandbox --no-zygote --enable-blink-features=EnumerateDevices,AudioOutputDevices --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1786368017943995 --launch-time-ticks=740385351 --field-trial-handle=1756,i,17125679191703999132,15065224491570205581,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1760,i,11893734725187444997,11529170730243920894,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3816 --enable-node-leakage-in-renderers /prefetch:1
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        PID:6084
      • C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe
        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\resources\app.asar" --no-sandbox --no-zygote --enable-blink-features=EnumerateDevices,AudioOutputDevices --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1786368017943995 --launch-time-ticks=740624979 --field-trial-handle=1756,i,17125679191703999132,15065224491570205581,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1760,i,11893734725187444997,11529170730243920894,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=4036 --enable-node-leakage-in-renderers /prefetch:1
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks SCSI registry key(s)
        • Checks processor information in registry
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        PID:6108
        • C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe
          "\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" nvidia
          4⤵
          • Executes dropped EXE
          PID:4984
        • C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe
          "\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" amd
          4⤵
          • Executes dropped EXE
          PID:4916
        • C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe
          "\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" intel
          4⤵
          • Executes dropped EXE
          PID:2076
        • C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe
          "\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" windows-media-foundation
          4⤵
          • Executes dropped EXE
          • Modifies registry class
          PID:4896
      • C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe
        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1756,i,17125679191703999132,15065224491570205581,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1760,i,11893734725187444997,11529170730243920894,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4140 /prefetch:8
        3⤵
        • Executes dropped EXE
        • Modifies registry class
        PID:5836
      • C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe
        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1756,i,17125679191703999132,15065224491570205581,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1760,i,11893734725187444997,11529170730243920894,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4208 /prefetch:8
        3⤵
        • Executes dropped EXE
        PID:3260
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discordapp.com/handoff?rpc=6463&key=f6586521-2ad3-4117-8899-bec6b7306619
        3⤵
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        PID:4272
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7fffab97c188,0x7fffab97c194,0x7fffab97c1a0
          4⤵
            PID:4536
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1888,i,6690147822707865784,10382384368287070807,262144 --field-trial-handle=2168,i,18171974874225889963,3509729063050391965,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:2
            4⤵
              PID:5760
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2032,i,16300785443512859898,15667552347988079463,524288 --field-trial-handle=2168,i,18171974874225889963,3509729063050391965,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
              4⤵
              • System Time Discovery
              PID:5916
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,322154226917891758,10109474586149874429,524288 --field-trial-handle=2168,i,18171974874225889963,3509729063050391965,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:8
              4⤵
                PID:6036
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,16303760597151093883,15644682621774328137,2097152 --field-trial-handle=2168,i,18171974874225889963,3509729063050391965,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
                4⤵
                  PID:5936
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,9643916798805875957,11738874892218900154,2097152 --field-trial-handle=2168,i,18171974874225889963,3509729063050391965,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
                  4⤵
                    PID:5128
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,4891448455708880463,13885560610030706666,2097152 --field-trial-handle=2168,i,18171974874225889963,3509729063050391965,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:1
                    4⤵
                      PID:4596
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4408,i,10117486079538615252,5611576760297501134,2097152 --field-trial-handle=2168,i,18171974874225889963,3509729063050391965,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:2
                      4⤵
                        PID:5160
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,14849222009542429247,4325145070780821880,524288 --field-trial-handle=2168,i,18171974874225889963,3509729063050391965,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:8
                        4⤵
                          PID:5524
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5208,i,777041941450965732,1986022344436062900,2097152 --field-trial-handle=2168,i,18171974874225889963,3509729063050391965,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
                          4⤵
                            PID:5488
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,16571908956158989879,17618419334974365547,524288 --field-trial-handle=2168,i,18171974874225889963,3509729063050391965,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:8
                            4⤵
                              PID:6168
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,4644495756470944980,12403568716958027581,524288 --field-trial-handle=2168,i,18171974874225889963,3509729063050391965,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
                              4⤵
                                PID:6500
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,8738921140165702696,16442796095458891692,524288 --field-trial-handle=2168,i,18171974874225889963,3509729063050391965,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
                                4⤵
                                  PID:6508
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,5891381637631210705,6631737539051629032,524288 --field-trial-handle=2168,i,18171974874225889963,3509729063050391965,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
                                  4⤵
                                    PID:6612
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,5891381637631210705,6631737539051629032,524288 --field-trial-handle=2168,i,18171974874225889963,3509729063050391965,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
                                    4⤵
                                      PID:1708
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,454047648912209597,9545852990632390585,524288 --field-trial-handle=2168,i,18171974874225889963,3509729063050391965,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:8
                                      4⤵
                                        PID:7132
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,15655367559682654981,17396431433403082791,524288 --field-trial-handle=2168,i,18171974874225889963,3509729063050391965,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:8
                                        4⤵
                                          PID:6252
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,3257480353234969990,5266926394868545835,524288 --field-trial-handle=2168,i,18171974874225889963,3509729063050391965,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:8
                                          4⤵
                                            PID:6352
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,6585154068004953176,3175245131310985082,524288 --field-trial-handle=2168,i,18171974874225889963,3509729063050391965,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:8
                                            4⤵
                                              PID:6344
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,5563878531655804928,13826617553835364248,524288 --field-trial-handle=2168,i,18171974874225889963,3509729063050391965,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:8
                                              4⤵
                                                PID:7088
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,8667159678145276165,17926992353710131782,524288 --field-trial-handle=2168,i,18171974874225889963,3509729063050391965,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:8
                                                4⤵
                                                  PID:3344
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,13580356283444124016,17958924618661174482,524288 --field-trial-handle=2168,i,18171974874225889963,3509729063050391965,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:8
                                                  4⤵
                                                    PID:6712
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,14675246890133145052,1073104132060645370,524288 --field-trial-handle=2168,i,18171974874225889963,3509729063050391965,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:8
                                                    4⤵
                                                      PID:6656
                                                  • C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe
                                                    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\resources\app.asar" --enable-sandbox --enable-blink-features=EnumerateDevices,AudioOutputDevices --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1786368017943995 --launch-time-ticks=775238684 --field-trial-handle=1756,i,17125679191703999132,15065224491570205581,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1760,i,11893734725187444997,11529170730243920894,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5292 --enable-node-leakage-in-renderers /prefetch:1
                                                    3⤵
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    PID:6224
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                1⤵
                                                • Enumerates system info in registry
                                                • Modifies data under HKEY_USERS
                                                • Modifies registry class
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of FindShellTrayWindow
                                                • Suspicious use of SendNotifyMessage
                                                • Suspicious use of WriteProcessMemory
                                                PID:2572
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7fffb98cc728,0x7fffb98cc734,0x7fffb98cc740
                                                  2⤵
                                                    PID:876
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1728,i,11894567159914934666,14519079490549712565,262144 --field-trial-handle=2116,i,17294965688018237540,9388985941367340837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2112 /prefetch:2
                                                    2⤵
                                                      PID:4548
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1932,i,5838226391792381201,16602654433947456349,524288 --field-trial-handle=2116,i,17294965688018237540,9388985941367340837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2180 /prefetch:3
                                                      2⤵
                                                      • Downloads MZ/PE file
                                                      • System Time Discovery
                                                      PID:4640
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2288,i,15055455181114451613,2458071821618279146,524288 --field-trial-handle=2116,i,17294965688018237540,9388985941367340837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2560 /prefetch:8
                                                      2⤵
                                                        PID:4840
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,1944103257794815375,10882063928171323505,2097152 --field-trial-handle=2116,i,17294965688018237540,9388985941367340837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3228 /prefetch:1
                                                        2⤵
                                                          PID:1952
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3256,i,624537463866013296,4031219719691550518,2097152 --field-trial-handle=2116,i,17294965688018237540,9388985941367340837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:1
                                                          2⤵
                                                            PID:4600
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3200,i,2261072356562005155,226621834885412014,2097152 --field-trial-handle=2116,i,17294965688018237540,9388985941367340837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4460 /prefetch:2
                                                            2⤵
                                                              PID:4868
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4644,i,14275777488202415807,2786204413491606343,2097152 --field-trial-handle=2116,i,17294965688018237540,9388985941367340837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4604 /prefetch:1
                                                              2⤵
                                                                PID:3568
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5564,i,18216660625970335021,588560838218917434,524288 --field-trial-handle=2116,i,17294965688018237540,9388985941367340837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5484 /prefetch:8
                                                                2⤵
                                                                  PID:4128
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5792,i,4977594916260398850,8656870581265857896,2097152 --field-trial-handle=2116,i,17294965688018237540,9388985941367340837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5640 /prefetch:1
                                                                  2⤵
                                                                    PID:5080
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3272,i,146049381837364212,17563634563458000588,2097152 --field-trial-handle=2116,i,17294965688018237540,9388985941367340837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5952 /prefetch:1
                                                                    2⤵
                                                                      PID:4912
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4644,i,9380058823929682823,10436337002046384569,524288 --field-trial-handle=2116,i,17294965688018237540,9388985941367340837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:8
                                                                      2⤵
                                                                        PID:3192
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4704,i,12996202562079275122,4661946999822679042,524288 --field-trial-handle=2116,i,17294965688018237540,9388985941367340837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4772 /prefetch:8
                                                                        2⤵
                                                                          PID:4672
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4780,i,9523824578183535521,3469418910564783676,524288 --field-trial-handle=2116,i,17294965688018237540,9388985941367340837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4496 /prefetch:8
                                                                          2⤵
                                                                            PID:2860
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=248,i,17181385293735297447,4691364471175354881,524288 --field-trial-handle=2116,i,17294965688018237540,9388985941367340837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4740 /prefetch:8
                                                                            2⤵
                                                                              PID:3952
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3952,i,8900445318684008506,11446349640080023334,524288 --field-trial-handle=2116,i,17294965688018237540,9388985941367340837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3404 /prefetch:8
                                                                              2⤵
                                                                                PID:2052
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5772,i,17975715750850043494,2979811344215601301,262144 --field-trial-handle=2116,i,17294965688018237540,9388985941367340837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6004 /prefetch:8
                                                                                2⤵
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                PID:4800
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1148,i,14650532831848303742,17489020799434818276,524288 --field-trial-handle=2116,i,17294965688018237540,9388985941367340837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3388 /prefetch:8
                                                                                2⤵
                                                                                  PID:2016
                                                                              • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                1⤵
                                                                                  PID:4912
                                                                                • C:\Windows\system32\svchost.exe
                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                  1⤵
                                                                                    PID:4444
                                                                                  • C:\Windows\System32\rundll32.exe
                                                                                    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                    1⤵
                                                                                      PID:3568
                                                                                    • C:\Users\Admin\Downloads\DiscordSetup.exe
                                                                                      "C:\Users\Admin\Downloads\DiscordSetup.exe"
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4384
                                                                                      • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
                                                                                        "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
                                                                                        2⤵
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                        PID:1420
                                                                                    • C:\Users\Admin\Downloads\DiscordSetup.exe
                                                                                      "C:\Users\Admin\Downloads\DiscordSetup.exe"
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4612
                                                                                      • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
                                                                                        "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
                                                                                        2⤵
                                                                                        • Checks computer location settings
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2368
                                                                                        • C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe
                                                                                          "C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe" --squirrel-install 1.0.9251
                                                                                          3⤵
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          • Checks processor information in registry
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:2900
                                                                                          • C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe
                                                                                            C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9251 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.7.1 --initial-client-data=0x500,0x504,0x508,0x4fc,0x50c,0x7ff7db215098,0x7ff7db2150a8,0x7ff7db2150b8
                                                                                            4⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:3352
                                                                                          • C:\Users\Admin\AppData\Local\Discord\Update.exe
                                                                                            C:\Users\Admin\AppData\Local\Discord\Update.exe --createShortcut Discord.exe --setupIcon C:\Users\Admin\AppData\Local\Discord\app.ico
                                                                                            4⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:4412
                                                                                          • C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe
                                                                                            "C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=1888,i,3350797223985381577,15273623837406360320,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1892,i,2384664321983909987,12710605539810427937,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1920 /prefetch:3
                                                                                            4⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:4220
                                                                                          • C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe
                                                                                            "C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1888,i,3350797223985381577,15273623837406360320,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1892,i,2384664321983909987,12710605539810427937,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1884 /prefetch:2
                                                                                            4⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            PID:3564
                                                                                          • C:\Windows\System32\reg.exe
                                                                                            C:\Windows\System32\reg.exe delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v Discord /f
                                                                                            4⤵
                                                                                            • Modifies registry key
                                                                                            PID:3288
                                                                                          • C:\Windows\System32\reg.exe
                                                                                            C:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "\"C:\Users\Admin\AppData\Local\Discord\Update.exe\" --processStart Discord.exe --process-start-args \"--start-inactive\"" /f
                                                                                            4⤵
                                                                                            • Adds Run key to start application
                                                                                            • Modifies registry key
                                                                                            PID:4364
                                                                                          • C:\Windows\System32\reg.exe
                                                                                            C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
                                                                                            4⤵
                                                                                            • Modifies registry class
                                                                                            • Modifies registry key
                                                                                            PID:4724
                                                                                          • C:\Windows\System32\reg.exe
                                                                                            C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
                                                                                            4⤵
                                                                                            • Modifies registry class
                                                                                            • Modifies registry key
                                                                                            PID:1964
                                                                                          • C:\Windows\System32\reg.exe
                                                                                            C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe\",-1" /f
                                                                                            4⤵
                                                                                            • Modifies registry class
                                                                                            • Modifies registry key
                                                                                            PID:956
                                                                                          • C:\Windows\System32\reg.exe
                                                                                            C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe\" --url -- \"%1\"" /f
                                                                                            4⤵
                                                                                            • Modifies registry class
                                                                                            • Modifies registry key
                                                                                            PID:4800
                                                                                        • C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe
                                                                                          "C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe" --squirrel-firstrun
                                                                                          3⤵
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          • Loads dropped DLL
                                                                                          • Checks processor information in registry
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:5156
                                                                                          • C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe
                                                                                            C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9251 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.7.1 --initial-client-data=0x500,0x504,0x508,0x4fc,0x50c,0x7ff7db215098,0x7ff7db2150a8,0x7ff7db2150b8
                                                                                            4⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:5284
                                                                                          • C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe
                                                                                            "C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1844,i,15323645573625645157,17050826415180560067,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1848,i,1100325828075215199,14055380402051545623,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1840 /prefetch:2
                                                                                            4⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            PID:4200
                                                                                          • C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe
                                                                                            "C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1844,i,15323645573625645157,17050826415180560067,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1848,i,1100325828075215199,14055380402051545623,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1876 /prefetch:3
                                                                                            4⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:888
                                                                                          • C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe
                                                                                            "C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1844,i,15323645573625645157,17050826415180560067,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1848,i,1100325828075215199,14055380402051545623,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2416 --splash-media-format=webm /prefetch:1
                                                                                            4⤵
                                                                                            • Checks computer location settings
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            PID:5652
                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                      1⤵
                                                                                        PID:3288
                                                                                      • C:\Users\Admin\AppData\Local\Discord\Update.exe
                                                                                        "C:\Users\Admin\AppData\Local\Discord\Update.exe" --processStart Discord.exe --process-start-args "--start-inactive"
                                                                                        1⤵
                                                                                        • Checks computer location settings
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1748
                                                                                        • C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe
                                                                                          "C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe" --start-inactive
                                                                                          2⤵
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          • Loads dropped DLL
                                                                                          • Checks processor information in registry
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1084
                                                                                          • C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe
                                                                                            C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9251 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.7.1 --initial-client-data=0x500,0x504,0x508,0x4fc,0x50c,0x7ff7db215098,0x7ff7db2150a8,0x7ff7db2150b8
                                                                                            3⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:1940
                                                                                          • C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe
                                                                                            "C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1864,i,7301171726674382258,7071178716967740607,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1868,i,17157815921243495508,2895848463810796962,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1928 /prefetch:3
                                                                                            3⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:4872
                                                                                          • C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe
                                                                                            "C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1864,i,7301171726674382258,7071178716967740607,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1868,i,17157815921243495508,2895848463810796962,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1860 /prefetch:2
                                                                                            3⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            PID:4108
                                                                                          • C:\Windows\System32\reg.exe
                                                                                            C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
                                                                                            3⤵
                                                                                            • Modifies registry class
                                                                                            • Modifies registry key
                                                                                            PID:1904
                                                                                          • C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe
                                                                                            "C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1864,i,7301171726674382258,7071178716967740607,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1868,i,17157815921243495508,2895848463810796962,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2868 --splash-media-format=webm /prefetch:1
                                                                                            3⤵
                                                                                            • Checks computer location settings
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            PID:4272
                                                                                          • C:\Windows\System32\reg.exe
                                                                                            C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
                                                                                            3⤵
                                                                                            • Modifies registry class
                                                                                            • Modifies registry key
                                                                                            PID:5476
                                                                                          • C:\Windows\System32\reg.exe
                                                                                            C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe\",-1" /f
                                                                                            3⤵
                                                                                            • Modifies registry class
                                                                                            • Modifies registry key
                                                                                            PID:5532
                                                                                          • C:\Windows\System32\reg.exe
                                                                                            C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe\" --url -- \"%1\"" /f
                                                                                            3⤵
                                                                                            • Modifies registry class
                                                                                            • Modifies registry key
                                                                                            PID:5572
                                                                                      • C:\Users\Admin\AppData\Local\Discord\Update.exe
                                                                                        "C:\Users\Admin\AppData\Local\Discord\Update.exe" --processStart Discord.exe
                                                                                        1⤵
                                                                                        • Checks computer location settings
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:5876
                                                                                        • C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe
                                                                                          "C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe"
                                                                                          2⤵
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          • Loads dropped DLL
                                                                                          • Checks processor information in registry
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:5932
                                                                                          • C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe
                                                                                            C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9251 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.7.1 --initial-client-data=0x514,0x518,0x51c,0x510,0x520,0x7ff7db215098,0x7ff7db2150a8,0x7ff7db2150b8
                                                                                            3⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:6016
                                                                                          • C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe
                                                                                            "C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1884,i,1029656077378627086,8948916128222356780,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1888,i,1120472941382113197,14486944756323851419,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1880 /prefetch:2
                                                                                            3⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            PID:6136
                                                                                          • C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe
                                                                                            "C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1884,i,1029656077378627086,8948916128222356780,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1888,i,1120472941382113197,14486944756323851419,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1904 /prefetch:3
                                                                                            3⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:3452
                                                                                          • C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe
                                                                                            "C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1884,i,1029656077378627086,8948916128222356780,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1888,i,1120472941382113197,14486944756323851419,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2580 --splash-media-format=webm /prefetch:1
                                                                                            3⤵
                                                                                            • Checks computer location settings
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            PID:1904
                                                                                      • C:\Windows\system32\AUDIODG.EXE
                                                                                        C:\Windows\system32\AUDIODG.EXE 0x504 0x374
                                                                                        1⤵
                                                                                          PID:5628
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                          1⤵
                                                                                            PID:1980

                                                                                          Network

                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                Reconnaissance

                                                                                                Resource Development

                                                                                                Initial Access

                                                                                                Execution

                                                                                                Command and Scripting Interpreter

                                                                                                1
                                                                                                T1059

                                                                                                Windows Command Shell

                                                                                                1
                                                                                                T1059.003

                                                                                                Persistence

                                                                                                Boot or Logon Autostart Execution

                                                                                                1
                                                                                                T1547

                                                                                                Registry Run Keys / Startup Folder

                                                                                                1
                                                                                                T1547.001

                                                                                                Privilege Escalation

                                                                                                Boot or Logon Autostart Execution

                                                                                                1
                                                                                                T1547

                                                                                                Registry Run Keys / Startup Folder

                                                                                                1
                                                                                                T1547.001

                                                                                                Defense Evasion

                                                                                                Modify Registry

                                                                                                2
                                                                                                T1112

                                                                                                Credential Access

                                                                                                Unsecured Credentials

                                                                                                2
                                                                                                T1552

                                                                                                Credentials In Files

                                                                                                2
                                                                                                T1552.001

                                                                                                Discovery

                                                                                                Browser Information Discovery

                                                                                                1
                                                                                                T1217

                                                                                                Peripheral Device Discovery

                                                                                                1
                                                                                                T1120

                                                                                                Query Registry

                                                                                                5
                                                                                                T1012

                                                                                                System Information Discovery

                                                                                                5
                                                                                                T1082

                                                                                                System Location Discovery

                                                                                                1
                                                                                                T1614

                                                                                                System Language Discovery

                                                                                                1
                                                                                                T1614.001

                                                                                                System Time Discovery

                                                                                                1
                                                                                                T1124

                                                                                                Lateral Movement

                                                                                                Collection

                                                                                                Data from Local System

                                                                                                2
                                                                                                T1005

                                                                                                Command and Control

                                                                                                Web Service

                                                                                                1
                                                                                                T1102

                                                                                                Exfiltration

                                                                                                Impact

                                                                                                Replay Monitor

                                                                                                Loading Replay Monitor...

                                                                                                Downloads

                                                                                                index.js
                                                                                                • Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\modules\discord_desktop_core-2\discord_desktop_core\index.js
                                                                                                • Size 42B
                                                                                                • SHA256 0540cc680cfe1b312787681270c9d8c910e8cc20da546f055949d7c4aa211032
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                package.json
                                                                                                • Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\modules\discord_spellcheck-1\discord_spellcheck\package.json
                                                                                                • Size 25B
                                                                                                • SHA256 4f35fd6a3f2046e09ecc02576752378eeb7cd7b48db490d3358111c27e808866
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                index.js
                                                                                                • Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\modules\discord_utils-1\discord_utils\index.js
                                                                                                • Size 4KB
                                                                                                • SHA256 de838460a97ff880647f577666ac04c8a95ae0a1bf4385e8977aad2523e9e4cb
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                bindings.js
                                                                                                • Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\modules\discord_utils-1\discord_utils\node_modules\bindings\bindings.js
                                                                                                • Size 5KB
                                                                                                • SHA256 8e32a0d37f20bd6f7d5bdbf99d041aa27be47cbbe5172ac13ebf7380a10b3bf6
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                index.js
                                                                                                • Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\modules\discord_utils-1\discord_utils\node_modules\file-uri-to-path\index.js
                                                                                                • Size 1KB
                                                                                                • SHA256 e62293e871bdd5a7449ff3c7956c9536ec1d2ea7369461de77322b5256bb93e7
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                notificationstate.node
                                                                                                • Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\modules\discord_utils-1\discord_utils\node_modules\windows-notification-state\build\Release\notificationstate.node
                                                                                                • Size 137KB
                                                                                                • SHA256 588a58b5f8e8fe53e6433f17fc8c46e469984eb6eb65a910c1ed362078055d99
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                index.js
                                                                                                • Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\modules\discord_utils-1\discord_utils\node_modules\windows-notification-state\lib\index.js
                                                                                                • Size 1KB
                                                                                                • SHA256 623891b3db3e4df2a41f78f4042ec3c9e6626cd0c6dc1650198647f5824f6e36
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                gpu_encoder_helper.exe
                                                                                                • Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe
                                                                                                • Size 889KB
                                                                                                • SHA256 c871149de8b2c43bc9d9072626766127d1b430199aa647a4a23f652cbeafab84
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                index.js
                                                                                                • Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9251\resources\app\index.js
                                                                                                • Size 85B
                                                                                                • SHA256 afaea3b85bfafd513c529ab093c9e6d18e68d28a97b424313a15e536b3bd7211
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                048dd0cde314270bf9d0493ee260d4320544af8bf13887bc16eeb5c2c8612fa8
                                                                                                • Path C:\Users\Admin\AppData\Local\Discord\download\048dd0cde314270bf9d0493ee260d4320544af8bf13887bc16eeb5c2c8612fa8
                                                                                                • Size 20KB
                                                                                                • SHA256 048dd0cde314270bf9d0493ee260d4320544af8bf13887bc16eeb5c2c8612fa8
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                14ce7187fec22bb18036c5ed241ad018627e83698c6d409002902e7da5c5be7b
                                                                                                • Path C:\Users\Admin\AppData\Local\Discord\download\14ce7187fec22bb18036c5ed241ad018627e83698c6d409002902e7da5c5be7b
                                                                                                • Size 409KB
                                                                                                • SHA256 14ce7187fec22bb18036c5ed241ad018627e83698c6d409002902e7da5c5be7b
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                22578f27a1774121bb3650d9175401c0eacf6dc7dec6ac5c8b2b83a8a9594c5f
                                                                                                • Path C:\Users\Admin\AppData\Local\Discord\download\22578f27a1774121bb3650d9175401c0eacf6dc7dec6ac5c8b2b83a8a9594c5f
                                                                                                • Size 514KB
                                                                                                • SHA256 22578f27a1774121bb3650d9175401c0eacf6dc7dec6ac5c8b2b83a8a9594c5f
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                2506352872360a89d28029b975298e125cab4f040b2777a5b6cf0da40471f19f
                                                                                                • Path C:\Users\Admin\AppData\Local\Discord\download\2506352872360a89d28029b975298e125cab4f040b2777a5b6cf0da40471f19f
                                                                                                • Size 313KB
                                                                                                • SHA256 2506352872360a89d28029b975298e125cab4f040b2777a5b6cf0da40471f19f
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                3f93a3b4a9c3405e50f7bb5a81e63507ffa256d2805fa8b04842c011c2c16569
                                                                                                • Path C:\Users\Admin\AppData\Local\Discord\download\3f93a3b4a9c3405e50f7bb5a81e63507ffa256d2805fa8b04842c011c2c16569
                                                                                                • Size 265KB
                                                                                                • SHA256 3f93a3b4a9c3405e50f7bb5a81e63507ffa256d2805fa8b04842c011c2c16569
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                47e08054488634b22de98593ba043d941989f4e1a10bfe9a8eabe689f65e58fe
                                                                                                • Path C:\Users\Admin\AppData\Local\Discord\download\47e08054488634b22de98593ba043d941989f4e1a10bfe9a8eabe689f65e58fe
                                                                                                • Size 222KB
                                                                                                • SHA256 47e08054488634b22de98593ba043d941989f4e1a10bfe9a8eabe689f65e58fe
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                625b4ca036c7f410ae33584c3b45dad6806f5b7ae82adf08d863edbd5d2564aa
                                                                                                • Path C:\Users\Admin\AppData\Local\Discord\download\625b4ca036c7f410ae33584c3b45dad6806f5b7ae82adf08d863edbd5d2564aa
                                                                                                • Size 8.8MB
                                                                                                • SHA256 625b4ca036c7f410ae33584c3b45dad6806f5b7ae82adf08d863edbd5d2564aa
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                6457bd728582e00640c29ef921786e8da4653dd51f169315eb7e68b563e43be4
                                                                                                • Path C:\Users\Admin\AppData\Local\Discord\download\6457bd728582e00640c29ef921786e8da4653dd51f169315eb7e68b563e43be4
                                                                                                • Size 27.1MB
                                                                                                • SHA256 6457bd728582e00640c29ef921786e8da4653dd51f169315eb7e68b563e43be4
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                a783ea01600c1cdb3bbcdcd6a61e8696af1d722b207d63c39bed12a8c870b859
                                                                                                • Path C:\Users\Admin\AppData\Local\Discord\download\a783ea01600c1cdb3bbcdcd6a61e8696af1d722b207d63c39bed12a8c870b859
                                                                                                • Size 1.6MB
                                                                                                • SHA256 a783ea01600c1cdb3bbcdcd6a61e8696af1d722b207d63c39bed12a8c870b859
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                bc8720ed03b5d85db7726147cf1bb42b14f793ed32298eb99426d6908ecab511
                                                                                                • Path C:\Users\Admin\AppData\Local\Discord\download\bc8720ed03b5d85db7726147cf1bb42b14f793ed32298eb99426d6908ecab511
                                                                                                • Size 1.6MB
                                                                                                • SHA256 bc8720ed03b5d85db7726147cf1bb42b14f793ed32298eb99426d6908ecab511
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                ce0e0617af0b4ddf5c96b8676f9f06c1ca2a4468697da936f99b1490b892aa12
                                                                                                • Path C:\Users\Admin\AppData\Local\Discord\download\ce0e0617af0b4ddf5c96b8676f9f06c1ca2a4468697da936f99b1490b892aa12
                                                                                                • Size 1.4MB
                                                                                                • SHA256 ce0e0617af0b4ddf5c96b8676f9f06c1ca2a4468697da936f99b1490b892aa12
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                ecda8c838640176f4023779a2e3b3cc17a578b03b92b21d341765f4eb1b84e3e
                                                                                                • Path C:\Users\Admin\AppData\Local\Discord\download\ecda8c838640176f4023779a2e3b3cc17a578b03b92b21d341765f4eb1b84e3e
                                                                                                • Size 29KB
                                                                                                • SHA256 ecda8c838640176f4023779a2e3b3cc17a578b03b92b21d341765f4eb1b84e3e
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                installer.db
                                                                                                • Path C:\Users\Admin\AppData\Local\Discord\installer.db
                                                                                                • Size 284KB
                                                                                                • SHA256 a29f914796678df539a31f7585473b006c223043f061a22e9f39a25929fa32cb
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                RELEASES
                                                                                                • Path C:\Users\Admin\AppData\Local\Discord\packages\RELEASES
                                                                                                • Size 73B
                                                                                                • SHA256 6ca9051613265d5cc140e8b174a5883567e8c4f04e3ecf0159e86e1bf3cae971
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                BookmarkMergedSurfaceOrdering
                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                • Size 6B
                                                                                                • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                BrowsingTopicsState
                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                • Size 414B
                                                                                                • SHA256 184d05bf5f6ca99386c2e7ceed0d41f4e9de3a37931e91d754431e11c3479803
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                f_000007
                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
                                                                                                • Size 331KB
                                                                                                • SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                the-real-index
                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                • Size 1KB
                                                                                                • SHA256 c8474d0e13c468241361f829423747e50dec8e6a2a74d1443576562ec9f1682f
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                Network Persistent State
                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                • Size 8KB
                                                                                                • SHA256 de7ccf95a7b9befc4ca0be810423451e817893533bc972387ff5fa4d4de77f9a
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                Network Persistent State
                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                • Size 9KB
                                                                                                • SHA256 a6afff1db84de809ddc0d2e51d1d6f54a33f2a71a3d2b924c8c3d50640a384ad
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                da3895bb-0547-4041-b289-d73229756081.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\da3895bb-0547-4041-b289-d73229756081.tmp
                                                                                                • Size 2B
                                                                                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                Preferences
                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                • Size 12KB
                                                                                                • SHA256 1a7f71f318620645274a6d4414f9e5f4d12d375e7c8dd807aaf6e12c68d3d199
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                Preferences
                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                • Size 13KB
                                                                                                • SHA256 339c059f7345bcf5c94a7ff1b6e508091b082a654554312d3738ff4a097e04f8
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                Preferences
                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                • Size 13KB
                                                                                                • SHA256 f50c6a68f76edef2c05c2afe29475056e9528350469a0a18305975a661b74c29
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                Preferences
                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                • Size 14KB
                                                                                                • SHA256 918ab403fe9494f11d4c56043b0e82dc55158de14ce4a6c01f066ed19b18c25b
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                Secure Preferences
                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                • Size 17KB
                                                                                                • SHA256 7f2c3bb0b002e4d7d49e8ebd780daefdc42e5000eb8a51c5ee9d65c53ca14658
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                the-real-index
                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                • Size 120B
                                                                                                • SHA256 c03ab6e7354f36db61387a3705cdbd5a9466631bd91aa21e8c4cc20fd680d527
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                the-real-index~RFe592495.TMP
                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe592495.TMP
                                                                                                • Size 96B
                                                                                                • SHA256 ef066f571feca5c780ba0b6c2e80c2c32a5d8989c91decdbc754b3218853dfa8
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                the-real-index
                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
                                                                                                • Size 96B
                                                                                                • SHA256 36756d59602e31e24da4dbb7e01e39e0bd5171bd22cd9e5947abbb81548f962c
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                Local State
                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                • Size 313KB
                                                                                                • SHA256 2c6dba12efb128d2b9c972903e7781268c23a562732f5033de0a0d8e747e723d
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                Local State
                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                • Size 115KB
                                                                                                • SHA256 ffe8051b69a3bcbc1706d256feabd6fda6d324f585572984eb980591887bc508
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                Local State
                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                • Size 235KB
                                                                                                • SHA256 3b4b13e594b7664100aaaa1950038f92e7b63b6894530c465fa69366dda2d698
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                Local State
                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                • Size 235KB
                                                                                                • SHA256 2d419e4491a98c00ed9f400d6763093c8cbda2ac0c933fafc7279a26c8a0a931
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                Local State
                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                • Size 236KB
                                                                                                • SHA256 efeb3410056e69f5c802af20b03ddafdb60498335c009efb426cfd3bf65802ec
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                Update.exe.log
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Update.exe.log
                                                                                                • Size 2KB
                                                                                                • SHA256 bd13a78aa4b2084742da4adf1f239308081ec9f6e47c8ffb070c4a2c0d39a569
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                settings.dat
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                • Size 280B
                                                                                                • SHA256 05210635590ecfe61f0ff004344f0d07b5a87e284e29db76f0bd61e97f43da5d
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                the-real-index
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                • Size 4KB
                                                                                                • SHA256 239d56b45e5a375686704a510a2a42ef33e43fe9cbfa6cc996e84e204e331b43
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                SiteList-Enterprise.json
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                • Size 2B
                                                                                                • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                Edge Profile.ico
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                • Size 70KB
                                                                                                • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                verified_contents.json
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4272_1701996429\CRX_INSTALL\_metadata\verified_contents.json
                                                                                                • Size 1KB
                                                                                                • SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                Preferences
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                • Size 10KB
                                                                                                • SHA256 fd72326f28d3a307316b3536980d10c32307b8ea72a0b983abe7e2731fcaa12c
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                Preferences
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                • Size 11KB
                                                                                                • SHA256 4b5b7fad848d28d3935851d4ff67fccb9d552409019b6c55f057edd3aadc06e3
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                Secure Preferences
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                • Size 32KB
                                                                                                • SHA256 0811c427edbd8326eb5a16174ca080f5a32d4a942d000f97f04a5b094868c589
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                sync_diagnostic.log
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                • Size 7KB
                                                                                                • SHA256 ecbe4a93081b033c91b0c47b0b1c7cebeb9514ca29eb156b9e1f3586f6054c77
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                Local State
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                • Size 19KB
                                                                                                • SHA256 e451f0aeb39898267faf3aeb02bd94eeb381ef0a4c850f708797c8538271c035
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                Local State
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                • Size 20KB
                                                                                                • SHA256 93e6d85181162e9b567a0f5a7d6af7584e9f43a3f6a229cbd70846e50c26c008
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                Local State
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                • Size 8KB
                                                                                                • SHA256 5f9b35aa56e6b54a77ff82c940a8fa2c680323ef64562f58a7ab362122240c99
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                Local State
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                • Size 8KB
                                                                                                • SHA256 c3982bf57a93e83e11ef507d0b22cfd9537fbc8cd67221974197f6a2f9343c94
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                a604d010-2b6b-4fcd-aa9c-d20cf6aed990.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a604d010-2b6b-4fcd-aa9c-d20cf6aed990.tmp
                                                                                                • Size 13B
                                                                                                • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                • Size 2KB
                                                                                                • SHA256 36f2b2c7396c1d7c21a8348427ca4376ee4a0a1e894cdc9a197fe5bb26a514f8
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                RELEASES
                                                                                                • Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
                                                                                                • Size 81B
                                                                                                • SHA256 42e7ba01c09c566b19b1e947603d83d300cd42d8b0a5d2031fb70c58b71f6b64
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                SquirrelSetup.log
                                                                                                • Path C:\Users\Admin\AppData\Local\SquirrelTemp\SquirrelSetup.log
                                                                                                • Size 10KB
                                                                                                • SHA256 d50fe0087a69e20cd933c630e9b6307ab2f073b8d83172e8abd68065235de7d8
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                Update.exe
                                                                                                • Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
                                                                                                • Size 1.5MB
                                                                                                • SHA256 36cfb0939a8afad9147d1c4feb2c3e1ef27a0121a9ffa79f5fe7095e0d8b79e6
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                SquirrelSetup.log
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\SquirrelSetup.log
                                                                                                • Size 67B
                                                                                                • SHA256 9d21a1ecc5c75108e77e1da43a323fd496bd88a1a3926f140a8d039216754db7
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                ad941a06-d467-43de-bbca-c0241990096a.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ad941a06-d467-43de-bbca-c0241990096a.tmp
                                                                                                • Size 10KB
                                                                                                • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                c327e559-f570-4e89-8432-d62933602910.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\c327e559-f570-4e89-8432-d62933602910.tmp
                                                                                                • Size 1B
                                                                                                • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                content_new.js
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4272_1742745002\CRX_INSTALL\content_new.js
                                                                                                • Size 10KB
                                                                                                • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                manifest.json
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4272_1742745002\CRX_INSTALL\manifest.json
                                                                                                • Size 962B
                                                                                                • SHA256 5694c91f7d165c6f25daf0825c18b373b0a81ea122c89da60438cd487455fd6a
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                d8668c51-2f36-40aa-ab56-e40c632a3926.tmp
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4272_85386531\d8668c51-2f36-40aa-ab56-e40c632a3926.tmp
                                                                                                • Size 153KB
                                                                                                • SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                app.ico
                                                                                                • Path C:\Users\Admin\AppData\Local\tmpu5h2ry13.jle\app-1.0.9251\lib\net45\app.ico
                                                                                                • Size 278KB
                                                                                                • SHA256 dfcea1bea8a924252d507d0316d8cf38efc61cf1314e47dca3eb723f47d5fe43
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                chrome_100_percent.pak
                                                                                                • Path C:\Users\Admin\AppData\Local\tmpu5h2ry13.jle\app-1.0.9251\lib\net45\chrome_100_percent.pak
                                                                                                • Size 117KB
                                                                                                • SHA256 15a5bcb49a5c02d6a4e736e8dfa11dabb0bac0589641a4e25f0c06472ccaae6d
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                chrome_200_percent.pak
                                                                                                • Path C:\Users\Admin\AppData\Local\tmpu5h2ry13.jle\app-1.0.9251\lib\net45\chrome_200_percent.pak
                                                                                                • Size 192KB
                                                                                                • SHA256 b7acfb068fa681f4ecb8f782bd4e3926590076c61fd0de3de4a12dde227cf52b
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                d3dcompiler_47.dll
                                                                                                • Path C:\Users\Admin\AppData\Local\tmpu5h2ry13.jle\app-1.0.9251\lib\net45\d3dcompiler_47.dll
                                                                                                • Size 4.5MB
                                                                                                • SHA256 320565434e5d8a77e13980e9c0e641daa08d12693ac0d77df9ccf2b25d9e526c
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                discord_wer.dll
                                                                                                • Path C:\Users\Admin\AppData\Local\tmpu5h2ry13.jle\app-1.0.9251\lib\net45\discord_wer.dll
                                                                                                • Size 441KB
                                                                                                • SHA256 ec574e192cf617c39e6586f9ffffe66eacee62a036ba2ab19ed6f7cdac59be26
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                dxcompiler.dll
                                                                                                • Path C:\Users\Admin\AppData\Local\tmpu5h2ry13.jle\app-1.0.9251\lib\net45\dxcompiler.dll
                                                                                                • Size 24.5MB
                                                                                                • SHA256 950ce27c486e27231dcfe33cd0bdd6c50b2ad44cfda148750a2c216ab8415254
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                dxil.dll
                                                                                                • Path C:\Users\Admin\AppData\Local\tmpu5h2ry13.jle\app-1.0.9251\lib\net45\dxil.dll
                                                                                                • Size 1.4MB
                                                                                                • SHA256 39dbd950f39f75f5c37bcd224c524accba76686adaa372b8287facfc46892b1c
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                ffmpeg.dll
                                                                                                • Path C:\Users\Admin\AppData\Local\tmpu5h2ry13.jle\app-1.0.9251\lib\net45\ffmpeg.dll
                                                                                                • Size 2.3MB
                                                                                                • SHA256 6315abd92e40fd003fe8700fdf278afbe6d84f6213b1ae494c272b56042f25ed
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                icudtl.dat
                                                                                                • Path C:\Users\Admin\AppData\Local\tmpu5h2ry13.jle\app-1.0.9251\lib\net45\icudtl.dat
                                                                                                • Size 10.4MB
                                                                                                • SHA256 bd8c145abdf3f8383276ce01dfa4ae48709bef9fef1c0711eb7c3fab4f6eb7c2
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                installer.db
                                                                                                • Path C:\Users\Admin\AppData\Local\tmpu5h2ry13.jle\app-1.0.9251\lib\net45\installer.db
                                                                                                • Size 20KB
                                                                                                • SHA256 138fadb8b1dda3dd2a851d804aa098801d64b726d6b2569fa76f402baf7f7b74
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                libEGL.dll
                                                                                                • Path C:\Users\Admin\AppData\Local\tmpu5h2ry13.jle\app-1.0.9251\lib\net45\libEGL.dll
                                                                                                • Size 479KB
                                                                                                • SHA256 80f1f19fe524c348c19138f306c6097bc82af06de7088a6a307ed100cc989c6c
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                libGLESv2.dll
                                                                                                • Path C:\Users\Admin\AppData\Local\tmpu5h2ry13.jle\app-1.0.9251\lib\net45\libGLESv2.dll
                                                                                                • Size 7.6MB
                                                                                                • SHA256 1cd30770cb11093124ce67ccd0d0ec02920ed9b3977bd9d0a70c22762daa0865
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                resources.pak
                                                                                                • Path C:\Users\Admin\AppData\Local\tmpu5h2ry13.jle\app-1.0.9251\lib\net45\resources.pak
                                                                                                • Size 6.3MB
                                                                                                • SHA256 c0061855e2714674043841c3db83ddffb764890c2e6c03894a4a537f126af701
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                app.asar
                                                                                                • Path C:\Users\Admin\AppData\Local\tmpu5h2ry13.jle\app-1.0.9251\lib\net45\resources\app.asar
                                                                                                • Size 3.4MB
                                                                                                • SHA256 54597281785487cf2d01f4eeeb704563876de7beea64bf28658608e92db52f4b
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                manifest.json
                                                                                                • Path C:\Users\Admin\AppData\Local\tmpu5h2ry13.jle\app-1.0.9251\lib\net45\resources\bootstrap\manifest.json
                                                                                                • Size 185B
                                                                                                • SHA256 21f22ccca7543eaac5080918cd1ea485e7368db350139f03a9fe2f08b832f0fc
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                build_info.json
                                                                                                • Path C:\Users\Admin\AppData\Local\tmpu5h2ry13.jle\app-1.0.9251\lib\net45\resources\build_info.json
                                                                                                • Size 175B
                                                                                                • SHA256 c01b560328d3381b292d2606084e00ac5a364d8267b4fc4fce6c31845e2a6004
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                snapshot_blob.bin
                                                                                                • Path C:\Users\Admin\AppData\Local\tmpu5h2ry13.jle\app-1.0.9251\lib\net45\snapshot_blob.bin
                                                                                                • Size 338KB
                                                                                                • SHA256 2fafa820c9fb666733b6cc0539e5d9215ff76e27e46f3cb42202269f0c964fc9
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                updater.node
                                                                                                • Path C:\Users\Admin\AppData\Local\tmpu5h2ry13.jle\app-1.0.9251\lib\net45\updater.node
                                                                                                • Size 4.2MB
                                                                                                • SHA256 a7195ce1b5eea2aa862bbc7e02c784e5b2e5dd7434257330d363e43b8bd1aa34
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                v8_context_snapshot.bin
                                                                                                • Path C:\Users\Admin\AppData\Local\tmpu5h2ry13.jle\app-1.0.9251\lib\net45\v8_context_snapshot.bin
                                                                                                • Size 704KB
                                                                                                • SHA256 47efa82a5cbdce5a4810e9e62e9dc04c52cbce5c7afeb38bb2b331f4243fa9d9
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                vk_swiftshader.dll
                                                                                                • Path C:\Users\Admin\AppData\Local\tmpu5h2ry13.jle\app-1.0.9251\lib\net45\vk_swiftshader.dll
                                                                                                • Size 5.3MB
                                                                                                • SHA256 19179c8228f82988a0cea2f80d461a442732c1aec3da847f6d342dd9dfb33a80
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                vk_swiftshader_icd.json
                                                                                                • Path C:\Users\Admin\AppData\Local\tmpu5h2ry13.jle\app-1.0.9251\lib\net45\vk_swiftshader_icd.json
                                                                                                • Size 106B
                                                                                                • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                vulkan-1.dll
                                                                                                • Path C:\Users\Admin\AppData\Local\tmpu5h2ry13.jle\app-1.0.9251\lib\net45\vulkan-1.dll
                                                                                                • Size 916KB
                                                                                                • SHA256 07466cab5ef437013763ed75297b1bc4e9def08f60290b990d1d4ff740d03029
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                af.pak
                                                                                                • Path C:\Users\Admin\AppData\Local\tmpu5h2ry13.jle\app-1.0.9251\locales\af.pak
                                                                                                • Size 598KB
                                                                                                • SHA256 2100568b2b41459d6daba7396f7a35bbaa136b03a99431044bf7a760d171db90
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                am.pak
                                                                                                • Path C:\Users\Admin\AppData\Local\tmpu5h2ry13.jle\app-1.0.9251\locales\am.pak
                                                                                                • Size 971KB
                                                                                                • SHA256 1ae3470ab6793b83c859294d53c20cec5386faeb4e99cd64ffa087083e5e345e
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                ar.pak
                                                                                                • Path C:\Users\Admin\AppData\Local\tmpu5h2ry13.jle\app-1.0.9251\locales\ar.pak
                                                                                                • Size 1.0MB
                                                                                                • SHA256 90d76d29dc5c3796d6cfdac68ef40590c69df83d1397bfb38a2b2ab31034e50c
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                bg.pak
                                                                                                • Path C:\Users\Admin\AppData\Local\tmpu5h2ry13.jle\app-1.0.9251\locales\bg.pak
                                                                                                • Size 1.1MB
                                                                                                • SHA256 bd1fc43acf0582553fea6abd84ae6ff8882eaa0c7eb3ffd5806664bbee5dc9bb
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                bn.pak
                                                                                                • Path C:\Users\Admin\AppData\Local\tmpu5h2ry13.jle\app-1.0.9251\locales\bn.pak
                                                                                                • Size 1.4MB
                                                                                                • SHA256 9cefc0b1308bdc95266b150536168ab8b1b8eab75169a833f483f10e032db97b
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                ca.pak
                                                                                                • Path C:\Users\Admin\AppData\Local\tmpu5h2ry13.jle\app-1.0.9251\locales\ca.pak
                                                                                                • Size 674KB
                                                                                                • SHA256 425d9ff88e8b33159810c3f5b2ceb280cb4a8ced94c3cfd594f7882e6a6047ad
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                cs.pak
                                                                                                • Path C:\Users\Admin\AppData\Local\tmpu5h2ry13.jle\app-1.0.9251\locales\cs.pak
                                                                                                • Size 699KB
                                                                                                • SHA256 517d1dde23b69fddb454d6afada8642720c28ed7af93333dd2809b8d8f2000d4
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                da.pak
                                                                                                • Path C:\Users\Admin\AppData\Local\tmpu5h2ry13.jle\app-1.0.9251\locales\da.pak
                                                                                                • Size 628KB
                                                                                                • SHA256 cd72b0653c171a3bd5d4faf79d829729cff90eca087f8a38284b353616d3e704
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                de.pak
                                                                                                • Path C:\Users\Admin\AppData\Local\tmpu5h2ry13.jle\app-1.0.9251\locales\de.pak
                                                                                                • Size 675KB
                                                                                                • SHA256 2e1be9735dfd847bc49573d8d2a42d353b14e615da0f7f705f432709d45265aa
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                el.pak
                                                                                                • Path C:\Users\Admin\AppData\Local\tmpu5h2ry13.jle\app-1.0.9251\locales\el.pak
                                                                                                • Size 1.2MB
                                                                                                • SHA256 28c12c567b5060d12124e60bd803c77cd75c0de7a48ce1992d623617e9ccca59
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                en-GB.pak
                                                                                                • Path C:\Users\Admin\AppData\Local\tmpu5h2ry13.jle\app-1.0.9251\locales\en-GB.pak
                                                                                                • Size 544KB
                                                                                                • SHA256 95133d35b5661cbdd8b15395c00512e66315d18d66f8b110c79f8361434b57ce
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                en-US.pak
                                                                                                • Path C:\Users\Admin\AppData\Local\tmpu5h2ry13.jle\app-1.0.9251\locales\en-US.pak
                                                                                                • Size 550KB
                                                                                                • SHA256 a46e37e61c7cdedf5d407f2be6440a895decb42f408ebc4f0cd0575026214ec6
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                default.dic
                                                                                                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                                                                • Size 2B
                                                                                                • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                507a6b4a-0ee5-48d1-91ee-a0ea534f4515.tmp
                                                                                                • Path C:\Users\Admin\AppData\Roaming\discord\507a6b4a-0ee5-48d1-91ee-a0ea534f4515.tmp
                                                                                                • Size 57B
                                                                                                • SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                settings.dat
                                                                                                • Path C:\Users\Admin\AppData\Roaming\discord\Crashpad\settings.dat
                                                                                                • Size 40B
                                                                                                • SHA256 80048e48262ca4c1b6699450ccb79327ba6f9d928f51139b5696a542b4625b28
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                data_0
                                                                                                • Path C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_0
                                                                                                • Size 8KB
                                                                                                • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                data_1
                                                                                                • Path C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_1
                                                                                                • Size 264KB
                                                                                                • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                data_2
                                                                                                • Path C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_2
                                                                                                • Size 8KB
                                                                                                • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                data_3
                                                                                                • Path C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_3
                                                                                                • Size 8KB
                                                                                                • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                Submit Download

                                                                                                1799ab59-e37d-4956-910b-bc8bc8109ad3.tmp
                                                                                                • Path C:\Users\Admin\AppData\Roaming\discord\Network\1799ab59-e37d-4956-910b-bc8bc8109ad3.tmp
                                                                                                • Size 111B
                                                                                                • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                Network Persistent State
                                                                                                • Path C:\Users\Admin\AppData\Roaming\discord\Network\Network Persistent State
                                                                                                • Size 111B
                                                                                                • SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                Preferences
                                                                                                • Path C:\Users\Admin\AppData\Roaming\discord\Preferences
                                                                                                • Size 132B
                                                                                                • SHA256 261c70111e9366970ced9f94b088071f0470e9427570fba5f8dd9711bcd92a35
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                623c2206-502c-4bb0-a0e6-9593bfe92abf.tmp
                                                                                                • Path C:\Users\Admin\AppData\Roaming\discord\Service Worker\CacheStorage\63fc7e4cfcc88165b53fe27bdbf48bdde7611b44\623c2206-502c-4bb0-a0e6-9593bfe92abf.tmp
                                                                                                • Size 144B
                                                                                                • SHA256 79a139f84c78bff7c2e0019e2d6c9cebcede342a7be5822758c6ee65334d4357
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                index
                                                                                                • Path C:\Users\Admin\AppData\Roaming\discord\Service Worker\CacheStorage\63fc7e4cfcc88165b53fe27bdbf48bdde7611b44\66c3666c-0632-477e-98a5-1025dc872990\index
                                                                                                • Size 24B
                                                                                                • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                index.txt
                                                                                                • Path C:\Users\Admin\AppData\Roaming\discord\Service Worker\CacheStorage\63fc7e4cfcc88165b53fe27bdbf48bdde7611b44\index.txt
                                                                                                • Size 239B
                                                                                                • SHA256 8c49b5225a4a794897037c8b45d8680a56a0583d1abc9d76c7305fa02eaf5702
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                index.txt
                                                                                                • Path C:\Users\Admin\AppData\Roaming\discord\Service Worker\CacheStorage\63fc7e4cfcc88165b53fe27bdbf48bdde7611b44\index.txt
                                                                                                • Size 232B
                                                                                                • SHA256 8658077d346e8ec05c94db1c8b4ead46ebae5f94c5083ce11fcb8cffe24681af
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                CURRENT
                                                                                                • Path C:\Users\Admin\AppData\Roaming\discord\Session Storage\CURRENT
                                                                                                • Size 16B
                                                                                                • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                MANIFEST-000001
                                                                                                • Path C:\Users\Admin\AppData\Roaming\discord\Session Storage\MANIFEST-000001
                                                                                                • Size 41B
                                                                                                • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                • MD5 SHA1 SHA512
                                                                                                Submit Download

                                                                                                91013dcd-943e-4b64-982b-5f910f8e52c6.tmp
                                                                                                • Path C:\Users\Admin\AppData\Roaming\discord\WebStorage\2\CacheStorage\91013dcd-943e-4b64-982b-5f910f8e52c6.tmp
                                                                                                • Size 181B
                                                                                                • SHA256 2f03ed587618ce9cf67cedcb7abcdfd7bc13c968f7668294f6f9290c4dcc8624
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                index.txt
                                                                                                • Path C:\Users\Admin\AppData\Roaming\discord\WebStorage\2\CacheStorage\index.txt
                                                                                                • Size 94B
                                                                                                • SHA256 b5a29b01dfd847ffaed8c7f9e86677b788fd37d654826aa10f885680b9447147
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                badge-1.ico
                                                                                                • Path C:\Users\Admin\AppData\Roaming\discord\badge-1.ico
                                                                                                • Size 14KB
                                                                                                • SHA256 1f6c4a0a0e6c90725380dcb27a1472909873503092eab410dccb85e6dcd41293
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                badge-10.ico
                                                                                                • Path C:\Users\Admin\AppData\Roaming\discord\badge-10.ico
                                                                                                • Size 14KB
                                                                                                • SHA256 3c989af3c64ee00549e4e68af77007950adaf0643e3977c2c416b47cc91b9e8f
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                badge-11.ico
                                                                                                • Path C:\Users\Admin\AppData\Roaming\discord\badge-11.ico
                                                                                                • Size 14KB
                                                                                                • SHA256 5cd1f81d7d649443850e7a4cd2c3bdeb59bd31e817c9212fca8e598321011b50
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                badge-2.ico
                                                                                                • Path C:\Users\Admin\AppData\Roaming\discord\badge-2.ico
                                                                                                • Size 14KB
                                                                                                • SHA256 d27521a919f99f29df8be287be40bdf8518f7b67f39e1a6fb8d7b79ed82a6967
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                badge-3.ico
                                                                                                • Path C:\Users\Admin\AppData\Roaming\discord\badge-3.ico
                                                                                                • Size 14KB
                                                                                                • SHA256 0b52183dc267b16e074b939c613f1c1c33f0d738b154f9f88df6d5e5b066f77f
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                badge-4.ico
                                                                                                • Path C:\Users\Admin\AppData\Roaming\discord\badge-4.ico
                                                                                                • Size 14KB
                                                                                                • SHA256 986a77597a6ed3fd8ff3e5e875e3b5ac73d5d7ccc314492e62bea93bc4aca91f
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                badge-5.ico
                                                                                                • Path C:\Users\Admin\AppData\Roaming\discord\badge-5.ico
                                                                                                • Size 14KB
                                                                                                • SHA256 632db5e6e8bf39e430655d501d8ea7d26ed9fc9192c69c826fad981ef3ff22de
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                badge-6.ico
                                                                                                • Path C:\Users\Admin\AppData\Roaming\discord\badge-6.ico
                                                                                                • Size 14KB
                                                                                                • SHA256 b9fe54e27bd048bc6c612b6017cda7470a2a269284448f540c2d5e435c36ce87
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                badge-7.ico
                                                                                                • Path C:\Users\Admin\AppData\Roaming\discord\badge-7.ico
                                                                                                • Size 14KB
                                                                                                • SHA256 66375334835b18ad999d5d0eefeb15aebe39806ebf60fa9e38d262db2ae471a5
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                badge-8.ico
                                                                                                • Path C:\Users\Admin\AppData\Roaming\discord\badge-8.ico
                                                                                                • Size 14KB
                                                                                                • SHA256 1a47aa754dd20f32444ddbcd1a86ea26aefdad385f2ecd7823a4ff1cdb2e26f1
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                badge-9.ico
                                                                                                • Path C:\Users\Admin\AppData\Roaming\discord\badge-9.ico
                                                                                                • Size 14KB
                                                                                                • SHA256 684bacda4755f7c0f1ff704a83ac0fb0312b0e485e78b167d0339f81a0ed472e
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                renderer_js.log
                                                                                                • Path C:\Users\Admin\AppData\Roaming\discord\logs\renderer_js.log
                                                                                                • Size 1KB
                                                                                                • SHA256 81120311049bc1867e2ac3df9280d52d571c54dc0da629f60cd9e0fa4991aa85
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                renderer_js.log
                                                                                                • Path C:\Users\Admin\AppData\Roaming\discord\logs\renderer_js.log
                                                                                                • Size 5KB
                                                                                                • SHA256 ec8acfa0dd4ac9a6db2cce16e72c834a9c345fb9405d05cc11d09657aedb4c1d
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                memory/1420-435-0x00000000088B0000-0x00000000088E8000-memory.dmp
                                                                                                Download

                                                                                                memory/1420-434-0x0000000008030000-0x0000000008038000-memory.dmp
                                                                                                Download

                                                                                                memory/1420-409-0x0000000000A00000-0x0000000000B8A000-memory.dmp
                                                                                                Download

                                                                                                memory/1420-436-0x0000000008880000-0x000000000888E000-memory.dmp
                                                                                                Download

                                                                                                memory/2368-1117-0x000000000A600000-0x000000000A692000-memory.dmp
                                                                                                Download

                                                                                                memory/4412-855-0x0000000004E70000-0x0000000004E90000-memory.dmp
                                                                                                Download

                                                                                                memory/4500-0-0x00000000000E0000-0x0000000000700000-memory.dmp
                                                                                                Download

                                                                                                memory/4500-4-0x000000001B510000-0x000000001B520000-memory.dmp
                                                                                                Download

                                                                                                memory/4500-3-0x000000001B510000-0x000000001B520000-memory.dmp
                                                                                                Download

                                                                                                memory/4500-2-0x000000001B510000-0x000000001B520000-memory.dmp
                                                                                                Download

                                                                                                memory/4500-1-0x000000001B510000-0x000000001B520000-memory.dmp
                                                                                                Download

                                                                                                memory/6224-4042-0x00007FFFDA5D0000-0x00007FFFDA5D1000-memory.dmp
                                                                                                Download

                                                                                                memory/6224-4043-0x000001A8A76E0000-0x000001A8A76E1000-memory.dmp
                                                                                                Download

                                                                                                memory/6224-4094-0x000001A8A7660000-0x000001A8A768B000-memory.dmp
                                                                                                Download