hxxps://discord[.]com/

Analysis

user interaction
yes
max time kernel
126s
max time network
134s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/10/2026, 19:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://discord.com/
Sample261023-ybf18ade29

Score

8^/10

defense_evasion discovery persistence spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
96	2724	msedge.exe

Executes dropped EXE 19 IoCs

pid	Process
2544	DiscordSetup.exe
3920	Update.exe
1232	Discord.exe
1276	Discord.exe
4292	Update.exe
3056	Discord.exe
5044	Discord.exe
5832	Discord.exe
5852	Discord.exe
5940	Discord.exe
6060	Discord.exe
6068	Discord.exe
1356	Discord.exe
3848	Discord.exe
4336	Discord.exe
5036	Discord.exe
5792	Discord.exe
5788	Discord.exe
5324	Discord.exe

Loads dropped DLL 22 IoCs

pid	Process
3056	Discord.exe
3056	Discord.exe
3056	Discord.exe
3056	Discord.exe
3056	Discord.exe
3056	Discord.exe
5852	Discord.exe
6060	Discord.exe
6060	Discord.exe
6060	Discord.exe
6060	Discord.exe
6060	Discord.exe
6060	Discord.exe
1356	Discord.exe
5792	Discord.exe
5792	Discord.exe
5792	Discord.exe
5792	Discord.exe
5792	Discord.exe
5792	Discord.exe
4336	Discord.exe
5324	Discord.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000\Software\Microsoft\Windows\CurrentVersion\Run\Discord = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\Discord.exe\" --processStart Discord.exe --process-start-args \"--start-inactive\""	reg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	discord.com
10	discord.com
11	discord.com
15	discord.com
20	discord.com
68	discord.com

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\DiscordSetup.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Discord.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Discord.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Discord.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Discord.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Discord.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Discord.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Discord.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Discord.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Discord.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Discord.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Discord.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Discord.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DiscordSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2724	msedge.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Discord.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 20 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Discord\ = "URL:Discord Protocol"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Discord\shell\open	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Discord\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9265\\Discord.exe\",-1"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Discord\shell\open\command	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Discord\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9265\\Discord.exe\" --url -- \"%1\""	reg.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1494457106-2582563566-1599095290-1000\{DF5FE76A-13CC-4E45-811B-03580ABF384B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Discord	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Discord\shell\open\command	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Discord\ = "URL:Discord Protocol"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Discord	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Discord\URL Protocol	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Discord	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Discord\URL Protocol	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Discord\DefaultIcon	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Discord\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9265\\Discord.exe\",-1"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Discord	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Discord\shell	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Discord\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9265\\Discord.exe\" --url -- \"%1\""	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Discord	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Discord\DefaultIcon	reg.exe

Modifies registry key 1 TTPs 10 IoCs

Modify Registry

T1112

pid	Process
5492	reg.exe
4868	reg.exe
5616	reg.exe
5692	reg.exe
5404	reg.exe
5540	reg.exe
5580	reg.exe
5620	reg.exe
5664	reg.exe
5620	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\DiscordSetup.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2560	msedge.exe
2560	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1232	Discord.exe
Token: SeCreatePagefilePrivilege	1232	Discord.exe
Token: SeShutdownPrivilege	1232	Discord.exe
Token: SeCreatePagefilePrivilege	1232	Discord.exe
Token: SeShutdownPrivilege	1232	Discord.exe
Token: SeCreatePagefilePrivilege	1232	Discord.exe
Token: SeShutdownPrivilege	5852	Discord.exe
Token: SeCreatePagefilePrivilege	5852	Discord.exe
Token: SeShutdownPrivilege	5852	Discord.exe
Token: SeCreatePagefilePrivilege	5852	Discord.exe
Token: SeShutdownPrivilege	5852	Discord.exe
Token: SeCreatePagefilePrivilege	5852	Discord.exe
Token: SeShutdownPrivilege	5852	Discord.exe
Token: SeCreatePagefilePrivilege	5852	Discord.exe
Token: SeShutdownPrivilege	5852	Discord.exe
Token: SeCreatePagefilePrivilege	5852	Discord.exe
Token: SeShutdownPrivilege	5852	Discord.exe
Token: SeCreatePagefilePrivilege	5852	Discord.exe
Token: SeShutdownPrivilege	4336	Discord.exe
Token: SeCreatePagefilePrivilege	4336	Discord.exe
Token: SeShutdownPrivilege	4336	Discord.exe
Token: SeCreatePagefilePrivilege	4336	Discord.exe
Token: SeShutdownPrivilege	4336	Discord.exe
Token: SeCreatePagefilePrivilege	4336	Discord.exe
Token: SeShutdownPrivilege	4336	Discord.exe
Token: SeCreatePagefilePrivilege	4336	Discord.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
3920	Update.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 988 wrote to memory of 4088	988	msedge.exe	82
PID 988 wrote to memory of 2724	988	msedge.exe	83
PID 988 wrote to memory of 4368	988	msedge.exe	85
PID 988 wrote to memory of 4368	988	msedge.exe	85
PID 988 wrote to memory of 1200	988	msedge.exe	84
PID 988 wrote to memory of 1200	988	msedge.exe	84
PID 988 wrote to memory of 1200	988	msedge.exe	84
PID 988 wrote to memory of 2464	988	msedge.exe	86
PID 988 wrote to memory of 2464	988	msedge.exe	86
PID 988 wrote to memory of 2464	988	msedge.exe	86
PID 988 wrote to memory of 3260	988	msedge.exe	87
PID 988 wrote to memory of 3260	988	msedge.exe	87
PID 988 wrote to memory of 3260	988	msedge.exe	87
PID 988 wrote to memory of 2184	988	msedge.exe	89
PID 988 wrote to memory of 1704	988	msedge.exe	90
PID 988 wrote to memory of 2184	988	msedge.exe	89
PID 988 wrote to memory of 2184	988	msedge.exe	89
PID 988 wrote to memory of 1900	988	msedge.exe	91
PID 988 wrote to memory of 4684	988	msedge.exe	92
PID 988 wrote to memory of 1704	988	msedge.exe	90
PID 988 wrote to memory of 1704	988	msedge.exe	90
PID 988 wrote to memory of 1900	988	msedge.exe	91
PID 988 wrote to memory of 1900	988	msedge.exe	91
PID 988 wrote to memory of 4684	988	msedge.exe	92
PID 988 wrote to memory of 4684	988	msedge.exe	92
PID 988 wrote to memory of 3116	988	msedge.exe	95
PID 988 wrote to memory of 3116	988	msedge.exe	95
PID 988 wrote to memory of 4040	988	msedge.exe	96
PID 988 wrote to memory of 4120	988	msedge.exe	97
PID 988 wrote to memory of 4040	988	msedge.exe	96
PID 988 wrote to memory of 4120	988	msedge.exe	97
PID 988 wrote to memory of 2896	988	msedge.exe	99
PID 988 wrote to memory of 3908	988	msedge.exe	100
PID 3908 wrote to memory of 4264	3908	msedge.exe	101
PID 988 wrote to memory of 1836	988	msedge.exe	103
PID 988 wrote to memory of 4852	988	msedge.exe	104
PID 988 wrote to memory of 1836	988	msedge.exe	103
PID 988 wrote to memory of 4852	988	msedge.exe	104
PID 988 wrote to memory of 4852	988	msedge.exe	104
PID 988 wrote to memory of 4964	988	msedge.exe	107
PID 988 wrote to memory of 2292	988	msedge.exe	108
PID 988 wrote to memory of 1824	988	msedge.exe	109
PID 988 wrote to memory of 2432	988	msedge.exe	110
PID 988 wrote to memory of 5064	988	msedge.exe	111
PID 988 wrote to memory of 5064	988	msedge.exe	111
PID 988 wrote to memory of 2544	988	msedge.exe	113
PID 2544 wrote to memory of 3920	2544	DiscordSetup.exe	114
PID 3920 wrote to memory of 1232	3920	Update.exe	115
PID 1232 wrote to memory of 1276	1232	Discord.exe	116
PID 1232 wrote to memory of 4292	1232	Discord.exe	117
PID 1232 wrote to memory of 3056	1232	Discord.exe	118
PID 1232 wrote to memory of 5044	1232	Discord.exe	119
PID 1232 wrote to memory of 5404	1232	Discord.exe	121
PID 1232 wrote to memory of 5492	1232	Discord.exe	123
PID 1232 wrote to memory of 5540	1232	Discord.exe	125
PID 1232 wrote to memory of 5580	1232	Discord.exe	143
PID 1232 wrote to memory of 5620	1232	Discord.exe	144
PID 1232 wrote to memory of 5664	1232	Discord.exe	131
PID 5832 wrote to memory of 5852	5832	Discord.exe	135
PID 5852 wrote to memory of 5940	5852	Discord.exe	136
PID 5852 wrote to memory of 6060	5852	Discord.exe	137
PID 5852 wrote to memory of 6068	5852	Discord.exe	138
PID 5852 wrote to memory of 1356	5852	Discord.exe	139
PID 5852 wrote to memory of 4868	5852	Discord.exe	140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://discord.com/
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x214,0x2f0,0x7ffd44ffc188,0x7ffd44ffc194,0x7ffd44ffc1a0
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1640,i,17774867840974555069,17351479575763945913,524288 --field-trial-handle=2012,i,673584491222503243,7639675752565106968,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,12376660647763776999,9802820768004880713,262144 --field-trial-handle=2012,i,673584491222503243,7639675752565106968,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,11930278717874266570,8135415690416788625,524288 --field-trial-handle=2012,i,673584491222503243,7639675752565106968,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:13
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,12779524451946535391,12710409900264344504,2097152 --field-trial-handle=2012,i,673584491222503243,7639675752565106968,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,6245508637287335667,5709618377445440823,2097152 --field-trial-handle=2012,i,673584491222503243,7639675752565106968,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4140,i,15543394616702389075,7467694360994697518,2097152 --field-trial-handle=2012,i,673584491222503243,7639675752565106968,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:9
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,7967697047177515549,14762505204991273688,2097152 --field-trial-handle=2012,i,673584491222503243,7639675752565106968,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4212,i,12740888986221483558,12282038183187995073,2097152 --field-trial-handle=2012,i,673584491222503243,7639675752565106968,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:9
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4196,i,5416940440083599105,16186851261461026708,2097152 --field-trial-handle=2012,i,673584491222503243,7639675752565106968,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,14415624862724981159,17761148064241978857,524288 --field-trial-handle=2012,i,673584491222503243,7639675752565106968,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:12
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,7808886666702196719,498085308980332018,524288 --field-trial-handle=2012,i,673584491222503243,7639675752565106968,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,10208846188973970817,17835433134746480704,524288 --field-trial-handle=2012,i,673584491222503243,7639675752565106968,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,10457745224613351835,6890482347687033823,524288 --field-trial-handle=2012,i,673584491222503243,7639675752565106968,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,10457745224613351835,6890482347687033823,524288 --field-trial-handle=2012,i,673584491222503243,7639675752565106968,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,17756447791351944190,12793685550719857700,524288 --field-trial-handle=2012,i,673584491222503243,7639675752565106968,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,14882094147489215891,6002724303538768210,524288 --field-trial-handle=2012,i,673584491222503243,7639675752565106968,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6672,i,16831883553828687661,4479449509741350803,2097152 --field-trial-handle=2012,i,673584491222503243,7639675752565106968,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4760,i,4956989214292341303,8265253675500512505,524288 --field-trial-handle=2012,i,673584491222503243,7639675752565106968,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,4467434554548051015,8557591036450430458,524288 --field-trial-handle=2012,i,673584491222503243,7639675752565106968,262144 --variations-seed-version --mojo-platform-channel-handle=7368 /prefetch:14
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4760,i,11738801646916819485,1223368543199555819,524288 --field-trial-handle=2012,i,673584491222503243,7639675752565106968,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7360,i,10274971710164367065,6103980980699531812,524288 --field-trial-handle=2012,i,673584491222503243,7639675752565106968,262144 --variations-seed-version --mojo-platform-channel-handle=7332 /prefetch:14
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,10860089957129102701,8050329604857675831,524288 --field-trial-handle=2012,i,673584491222503243,7639675752565106968,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
  2⤵
  PID:5064
- C:\Users\Admin\Downloads\DiscordSetup.exe
  "C:\Users\Admin\Downloads\DiscordSetup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
    "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3920
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\Discord.exe" --squirrel-install 1.0.9265
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      Checks processor information in registry
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1232
    - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\Discord.exe
        
        C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9265 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.11.15 --initial-client-data=0x4cc,0x4d0,0x4d4,0x4c8,0x4d8,0x7ff7cfc7ac58,0x7ff7cfc7ac68,0x7ff7cfc7ac78
        5⤵
        Executes dropped EXE
        
        PID:1276
    - - C:\Users\Admin\AppData\Local\Discord\Update.exe
        
        C:\Users\Admin\AppData\Local\Discord\Update.exe --createShortcut Discord.exe --setupIcon C:\Users\Admin\AppData\Local\Discord\app.ico
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\Discord.exe
        
        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1748,i,5295047803113367321,5260139934048854252,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1752,i,3144207706862859227,13617166384889963055,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1744 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3056
    - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\Discord.exe
        
        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=1748,i,5295047803113367321,5260139934048854252,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1752,i,3144207706862859227,13617166384889963055,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1912 /prefetch:11
        5⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        
        PID:5044
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v Discord /f
        5⤵
        Modifies registry key
        
        PID:5404
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "\"C:\Users\Admin\AppData\Local\Discord\Discord.exe\" --processStart Discord.exe --process-start-args \"--start-inactive\"" /f
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:5492
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
        5⤵
        Modifies registry class
        Modifies registry key
        
        PID:5540
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
        5⤵
        Modifies registry class
        Modifies registry key
        
        PID:5580
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\Discord.exe\",-1" /f
        5⤵
        Modifies registry class
        Modifies registry key
        
        PID:5620
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\Discord.exe\" --url -- \"%1\"" /f
        5⤵
        Modifies registry class
        Modifies registry key
        
        PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7496,i,3347820452911803243,16738312799220749534,262144 --field-trial-handle=2012,i,673584491222503243,7639675752565106968,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2560

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2312

C:\Windows\system32\WerFault.exe
"C:\Windows\system32\WerFault.exe" -k -lc WATCHDOG WATCHDOG-20261023-2037.dmp
1⤵
PID:2084

C:\Users\Admin\AppData\Local\Discord\Discord.exe
"C:\Users\Admin\AppData\Local\Discord\Discord.exe" --processStart Discord.exe --process-start-args "--start-inactive"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5832
- C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\Discord.exe
  "C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\Discord.exe" --start-inactive
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5852
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\Discord.exe
    C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9265 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.11.15 --initial-client-data=0x4c4,0x4c8,0x4cc,0x4bc,0x4d0,0x7ff7cfc7ac58,0x7ff7cfc7ac68,0x7ff7cfc7ac78
    3⤵
    - Executes dropped EXE
    PID:5940
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1832,i,11758898896850028777,2265352953473903428,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1840,i,15616784971316173881,9076769522361931843,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1828 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:6060
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1832,i,11758898896850028777,2265352953473903428,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1840,i,15616784971316173881,9076769522361931843,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1892 /prefetch:11
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    PID:6068
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1832,i,11758898896850028777,2265352953473903428,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1840,i,15616784971316173881,9076769522361931843,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2580 --splash-media-format=webm /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1356
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:4868
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:5616
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5580
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\Discord.exe\",-1" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:5620
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\Discord.exe\" --url -- \"%1\"" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:5692

C:\Users\Admin\AppData\Local\Discord\Discord.exe
"C:\Users\Admin\AppData\Local\Discord\Discord.exe" --processStart Discord.exe
1⤵
- Executes dropped EXE
PID:3848
- C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\Discord.exe
  "C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\Discord.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:4336
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\Discord.exe
    C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9265 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.11.15 --initial-client-data=0x4dc,0x4e0,0x4e4,0x4d8,0x4e8,0x7ff7cfc7ac58,0x7ff7cfc7ac68,0x7ff7cfc7ac78
    3⤵
    - Executes dropped EXE
    PID:5036
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1800,i,3044219261420023567,16949830788880702669,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1824,i,3087041203329627158,11398164536947858893,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1796 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5792
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1800,i,3044219261420023567,16949830788880702669,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1824,i,3087041203329627158,11398164536947858893,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1772 /prefetch:11
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    PID:5788
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1792783686810236 --launch-time-ticks=640430738 --field-trial-handle=1800,i,3044219261420023567,16949830788880702669,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1824,i,3087041203329627158,11398164536947858893,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2516 --splash-media-format=webm /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

app.ico

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\app.ico
Size 278KB
SHA256 dfcea1bea8a924252d507d0316d8cf38efc61cf1314e47dca3eb723f47d5fe43
MD5 084f9bc0136f779f82bea88b5c38a358
SHA1 64f210b7888e5474c3aabcb602d895d58929b451
SHA512 65bccb3e1d4849b61c68716831578300b20dcaf1cbc155512edbc6d73dccbaf6e5495d4f95d089ee496f8e080057b7097a628cc104fa8eaad8da866891d9e3eb
SSDEEP 192:uz/QWppKvrIXANuBox26FIeSyyEh9Y1kM12wngfi3TjOueN3/R/l:E/QWppKvrIXANuBc6gq3TjOuevl
TLSH
T1D25444E56118FF0ACA31CFBC08B186526C79BD17A923640777453BCD0A77ADB5232D92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\chrome_100_percent.pak
Size 117KB
SHA256 15a5bcb49a5c02d6a4e736e8dfa11dabb0bac0589641a4e25f0c06472ccaae6d
MD5 750913d55e87def9108e55728ba67d00
SHA1 a5944bc170d1f6c3223195c043134566471dae1d
SHA512 f5663ae3c775e2ec12dda6255afea99291673b8586048b131ca657a10be88cca61e298bb56797bcc34723fc8bf0a3dd966ad8b9f0e77747f963d8dada4f25edf
SSDEEP 3072:7lj4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:7lcYWFUbGz8LI1TdjQBQCrC
TLSH
T1E9C3D0E773B0AD7DDA464BB743560070FCB31B2907C2160E4B9AE479652AB88D9C93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\chrome_200_percent.pak
Size 192KB
SHA256 b7acfb068fa681f4ecb8f782bd4e3926590076c61fd0de3de4a12dde227cf52b
MD5 d476c19d21b3c2861f08c1c82fffddcb
SHA1 6f61aab7b6fba4fed5a7c222bdb96aee11f23bd9
SHA512 36acefce9f4e6837609f801bb340380f8e3e0de3f01872ef1e9bfd769f61ec2804191b91cfd01d90fb874cc9f4e685de7f2d03c21cd7e0bc6c7d8907f41dc12a
SSDEEP 3072:y6FJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:y6IGQ+N6uSZQDQYakvyAk9jQBQNd4
TLSH
T1DE1401D323B4AD3DDA530BB3926600B0FD7A20291AB3511E569FED397925F8889C9343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\d3dcompiler_47.dll
Size 4.5MB
SHA256 7b06a9669b48608ab576659f4f5ee4ec94c82e5b3109fa7290f5fbab84d544ec
MD5 6583aab336f41f4ca1ff9ec25f2978e1
SHA1 d4d4acea1bcf4a51b5f364e15f76f0952d62018c
SHA512 24e570a68baef0800c9bfdd45536b70c30358c6cc1e453e41895ecac23ca9ead5ce127788fe6500aa0480a29cc09b8bfde2218ee5b28c53c41f835ac860bb6c9
SSDEEP 49152:oMaW1H1ZcPsk9HOJLjJP73tSjPM2gjgpaIhR46LUbOWHHJdsCIdkTYoHjnTVylMf:rcPsguxj34bw+vD3Gmt3Ankw
TLSH
T18B269E56B7E850E9C1BBD138C687861BE7B1B80513305BDF02908769AF73BD16A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

discord_wer.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\discord_wer.dll
Size 440KB
SHA256 2671f9e1ecfb9e3785fefe2558d5101a7248bd6cae3d29219f4ca31b92c9033f
MD5 7d35ac7d2a817d2b16224c18b5cb375a
SHA1 1d1f1ff7f2ee499403886b5a7fe72a12f1d83105
SHA512 69788cd3bc60fd6e43f890366ba85f477ca597dea3e264974ff5584ecfd427c3d0af252ba86066f4eb7db38215a037d548514c4bb943975f652185160cabb43a
SSDEEP 6144:wKCNxSULPMiROmI+K/CiF6sqqvOBvDraVtWb8kr9IMkGssBe:wKCSULPxliF6sqqvOB7raWb8WiMk8g
TLSH
T1ACA49E14F7E448B8E077D1388A638647EF7278960B51E6DF03A492692F37BE41A3D325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\dxcompiler.dll
Size 24.5MB
SHA256 e5da8922bc7896fa37a6231dfac36a07e91924a09b97deae51434ea72ae347ce
MD5 33f152988b077a3051556b2a61195fb3
SHA1 12b0d37fd6d19eee0c10f547f94efa8f6d733f01
SHA512 3f86e674996a26e13339003e48722be86c7b8e31c428ccc958ff778dd185b51a40c7cd50df2569f85c07a8f6a561486743d1880e1fb53699f9798a172fcecfe2
SSDEEP 393216:+EGiV1HsevmZ4wTNe5er829JGa14/Ov0XTL4:Z5mHd7YlXP4
TLSH
T1F7473A122646D49DC059C8B9C7678B26CA6C30E73FA7B9DBC0F451252B79EBC1B39234
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\dxil.dll
Size 1.4MB
SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
MD5 c9a7241ce83437d54a82522aa0b54575
SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
TLSH
T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\ffmpeg.dll
Size 2.3MB
SHA256 06b1fc183f13ec2f1e9ab3bc50bc9d52c81c0b5dba576cb394e677e61e133d21
MD5 2e6e66726c87955ce8060ab3f06f3dd8
SHA1 5e40ef07ceca1c9b98d1800e63eb3e02a99615ea
SHA512 5235f8b3fce91cd6418c6fb1ef780cbf415a147846521bfd135754320899921a711d7127e96c07124469614a43e23110eecbc54a90c4c1924c425f4e89611877
SSDEEP 24576:93nO+U8M0n3/LWwrmKJ8/nZOj5ncNBgb5JCx4E4G6D5VMuKL9sENdM041LF4euiR:KwrmE8w9cNW5JCx4W61yuUgLF4lM4s
TLSH
T1D7B5AE06F6D685EAC02AC134879B9613F33174464B607AEF23A007293F66FE05E7E765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\icudtl.dat
Size 10.4MB
SHA256 67c332a252ae56e300213753784e4256b201a6bd5156db9eb87a6afda20215f2
MD5 1196a1913f893863f8e7f129e69d56aa
SHA1 664370d6d58c62fdea1d91e95027570ad529dad0
SHA512 995464abab0913704db7cdd12441ee098555ca0c15e06e12e770e3f1303958b3fd812e112494c6fcdf4bf10b4b12bfcc25dc3429cc0130382f04af318269307a
SSDEEP 98304:g/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjnd0p89T:g/cBhORok2HiXUxO/RJk3IWhlYntjdPT
TLSH
T1E4B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.db

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\installer.db
Size 20KB
SHA256 fe9dab8c80812c0118935d38c11060690bba44410331301578b40545275950d9
MD5 71bd971cd538b157a8b7520c6d582d38
SHA1 707b552acbccb7bdd92daf4c95f9e0cf90dc377f
SHA512 88523df648c697f76fef3f3ee7b2eecb0ce00d5f350f135d7b3e448eb14c02f14891834771c1a5e24a535234ae00722a558d10447fec124164e79bb0c557a27e
SSDEEP 192:U+BLr4t667m010Sw9no2pt7dfd5Wo1QDRlRs:U+Bh5oq7dSVl
TLSH
T1159234BD21A515B3C3BA94FD6B4038764D3D930E1BBA8AC412F993E057E3B7C0D61629
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\libEGL.dll
Size 479KB
SHA256 fb44f67ee43f02597387013e5f3c39595b2b861efe17e24149400ec4e7ed8f08
MD5 2c145d407317a53dc3239d48562b7d6a
SHA1 a53ecade3de730f54d8dc2f3b31352f4e0636a7b
SHA512 2f5f91f479a2844cd9c665c1ec894fd0caa65892ae84e33aa42424cf42e1976c8010de8dcea7aafbcec9f1eb9fb00c891d3b8a727ca2b6773eb38e97e962b22a
SSDEEP 6144:Nn4LE8oVyVRsEN1FWgKpOAZxqm4IcnBcV1TKxfsbA7ZNRZC7h+2:SEd6RdWvbxqm4IcBk1OfsbivRZy
TLSH
T141A48C05B7E449B8E07AC138CA538647EB7178460B61F6DF03A0D2792F77BE45A7A321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\libGLESv2.dll
Size 7.7MB
SHA256 fe2ecc31ecf1846b3c99e1a0f097c7734d9a47fa2f29a76ec1b4a2d113a5aa55
MD5 8741d145e39fc045c19acd8337f943c7
SHA1 5fdb0ad70c2dd713db3786087f87c3d08a0fd36b
SHA512 0dd2c96dbe2e1eb130b3a2f106fcad198d7fe591af30466107dcdbea38ff11596ee81afd1ad12d3da641762c6943ced88ef944f4a20a63034c7cd11b22a949e5
SSDEEP 49152:vOdTN3jDrsB+BZNFIIClqQOegjlGJ66at3mBObj7wavx6kiDAFa3VzZTeT4j4xWc:vKpjvZCCllsQs/jZ63BmN85ZERSP
TLSH
T1BA866C03F69681D9C05DE2788757A223FB34B8450724F6CF2AA457152F6ABF0AB3D724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\locales\en-US.pak
Size 550KB
SHA256 a46e37e61c7cdedf5d407f2be6440a895decb42f408ebc4f0cd0575026214ec6
MD5 5ae2ae804d645924629018eb3ca804a1
SHA1 d61cdc8f5ce36bee2e1dc2db68ff941e01dfd931
SHA512 492a7fb03429912ef0901c5c0471dd4d849155e9bfbfca7a6ea703b67fbdd5f31939c0ed1174a0eaecb37428295062060c08d74b56f7b77bda448023b94efd15
SSDEEP 6144:nryUXUBrjTlnRxjhrjJHfBLOFcGfIzUMP99QKJUfaYQrpqwvGjnngsZ/8twj:nryPZRDJHfBVAMTQKJVcjWwj
TLSH
T1F5C44C1FF744122A05A352A27F0995A2FF32D06CB35112563CBD812C33B6B6693B76F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\resources.pak
Size 6.3MB
SHA256 7b8b64faa17efd335087ec63e58d89407416ea6c1a6e43dac65128f6667a2f42
MD5 872deeead69be5f868979b6b05e154a7
SHA1 df6b39bbeff786566fc5e00db2223434b0729902
SHA512 fe1bb318bcaf296d373402a332b6493e2da29521527c79bf95bd4f9afaa2f638105ad7e832e085def8eb0f1f07de0d278d7c9f4dbca97c1514c0f39244b0e742
SSDEEP 196608:rEBRHPfIXoDvuTjTMkriACmZnC3gEL34tVrW:gTvrPkrDntEoVrW
TLSH
T11C6633D276D2A80FCD9063BE45448F3A529CAF2565D1B1D308DD6158EDACB2C0BC4A7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\resources\app.asar
Size 3.5MB
SHA256 0025c02c7241045a12464309604ec4d5b8ec7ed2ce43cce05d5dacb8f253f672
MD5 6f8e89ee046329435f3bdac4c0b39010
SHA1 33aca27a6f11140820ddd4a173c132ac4d887e17
SHA512 512851b4417566ec257f08be854af053f3782fafb85349b91b8003412d571ffde133ee73ab562fc1631da3b59880174d58ba1594a73207c9264e96c41d1196a6
SSDEEP 98304:5Wky6hTiT6lO4mzh/a4izAkN2dx6sEOnA7:5vpwwzAkN2dx6sM
TLSH
T1FEF59EE5725269734FEB22EDE932554276B9C006B044607AFAACCECE15C8409B3B773D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

build_info.json

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\resources\build_info.json
Size 175B
SHA256 5f2edfbc1c8d476d42df1ca32df98d551e40c0947181d26d1a5d65bb2d4d8e2e
MD5 7191ec5e900acafb3b52ca1772f430cf
SHA1 607ff274ce5052366ecbab0c95717ce9d4a58161
SHA512 abed8f8f67e5c039f2723d1ad1403bafcf23d6a89e38a1d9950379cee82b069111a0ac8a66b94b42a16d3c60c1b1d9e4c86a614a72ccc2f3e9669970cce59fc9
TLSH
T155C0806791441B3711F09FFBC25090A2B305EE8F01754D3D307F414D5361D745542F05
MD5 SHA1 SHA512 TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\snapshot_blob.bin
Size 338KB
SHA256 f4944af4edad684f09da3ae7573dd3dfb85ba317092b4b3390c088c4b0d3da78
MD5 5d400fbfddc4f1e602e67c74b388b13f
SHA1 efd5263a8286045cf3f21ae8c5ff2294cd99a6fa
SHA512 8fbcb8abc5ffc7dc6dc0c157d9381c6305a3d657d384aab90e786a1e9db5d6511a930c806bd9474587ae34b68c90be7b13bef6a3743b5edb18064d1d8a000555
SSDEEP 3072:2POiXK+Ot+xbRt2FURJPGKKPipcCN7qSN4Od1sTChzDKBwdCqg1:2P5Xgt+HlqKKlu7pN4udhv3gT
TLSH
T11074E012F749CA26C8B639745EE58B943E24B2CD9D89AF173060437DB4796640E2F38F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.node

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\updater.node
Size 4.3MB
SHA256 8b641bc5a4826eb9c78dd30328379ffa4c416f596ef7378acc62bbf5d2cc1e8e
MD5 11b1d5afb2a47e3f75f510b6afc5932b
SHA1 c18c4da21baffa09bf94c59e957a304f28a79799
SHA512 d01a930c57d8f2646a0e65e6e9d5c524788cdd02ddae66d0ae3b8d46c50f3e4392c208d342ea557b38d693936717e3c59bd3a46cc9e14b034bff12505efe0099
SSDEEP 49152:34KCsG72nl4l0N2538jxFyzppcI0U2FnBvZlejl3GmmkouaJdkGE4rHqURfV9thd:xs72e3wx8wKqxdDSUxV92yUhxe
TLSH
T190266C03FA9545A9C06EC178875B9237E7B2B8890B24B7DB17D44A213F53FA05B3D398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater_launcher.exe

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\updater_launcher.exe
Size 626KB
SHA256 e3abb88e41c270f05e617e4d1d6666c18d10fd3e0b4895e200d716f1604999bd
MD5 01b6f361be5ea4ebd69e7e1f402e7cbe
SHA1 7fff94f77136ede498f8439192129261fed0c7b6
SHA512 2b58d966b3fa7ad7eeeae25dfbbb0341fac09410ae374dbbd105fc1f39471b863cd6646ca5a98f800ed392535344e70764b6cd4e261cff41b8658e20cdb9c8d5
SSDEEP 6144:2vjEfVVKNNV6PxpmJcUTZrb3ug2zWoSYQXdChNxF+cc8h3WWWWWW5PWWWWWWWWWk:21qycUt7lN9yNxFbhE4l
TLSH
T1F5D46D51BA49BFE9D066CD3C817585639D327C870B21ACEF12D432682F76AE71E39E10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\v8_context_snapshot.bin
Size 704KB
SHA256 8370f0e919f5fda4315e3d5106b3423a2abf441ab730c05570eb43fadd7e2152
MD5 f3e34adb9e28b7ca8f07e28715d29b99
SHA1 e88622d56796ca93c2c51fda0a60d020f4e4f4ef
SHA512 40e6acaf6efe608c3bbc63102a5a0685045613702cda2ea2078be7e6a9eb041ff02258c2212b1afe3b95728bb7f94832fcace187fea114b6bdd31d579f112fd1
SSDEEP 6144:fRrQKX5Xst+HlXawuu7pN4udhvM2Ndgp2BsaXgHkmybvAdEpjyHZdhU4iPWlan:CW5XhucLjvM2NdOeH4dEUlURWYn
TLSH
T17AE48666FB06CE26C8657A7D8DD74B063A30B2DD9EC6EB077021937CB8786544D2E20D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\vk_swiftshader.dll
Size 5.3MB
SHA256 a723b0cbef36c4b080f4d7c87cdf57571fce5bec4f0dfc6c61ed3d53aedc2ee6
MD5 f24036a7c3b37c8a63bc9e6683bc7a45
SHA1 9711c6291718d49f9506218f4edbe0c30dc78dce
SHA512 1ece9e672981845f517b6563a56648352378f102b1de8dd2ba88821f5a08d122172974e124779dc2c76f4a13fa5e78635e2f72a73bc500341b508e02b27d5752
SSDEEP 49152:Qhlq+TFmCYOnuxJqV7NfLkRF+Ex7lofozm9YZsTvvCugPdp/NH8Tj+dI9I61BKD7:QhlqfEJhSph4BaMST
TLSH
T18E464903F29681D9C06DD6B9875FA623F631F8840B22B6DF56A00F192E65FE06B3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9265\vulkan-1.dll
Size 916KB
SHA256 e273090793865ffa02ffe88bfa0bd5063310685f9fc65c8e3e4ccdca4064268b
MD5 3200917057fd4fd3cb444d76dcf8be3c
SHA1 ee6f579fb612fdb00235b13cf0c6527d55a48b53
SHA512 7a5027b90a89f7dea5897c0324c5f211d8319693514d3c820c99c96eab7bcd622786b89da5555c9e241cb3baacd13f9c2dad9946908e78f22ca77923b1818125
SSDEEP 24576:GOsdvoHVC79FqYBw8nEHnTA6Z5WzcxDYsHkDE6g3P0zAk76oOH8j6wEVJ:xsdvoHQ7/n+nTA6Z5WzcxDYsHkDE6g3l
TLSH
T1D9157D22DA648A79DA76C074D8D68A03C9F074811322B9CF177817147F6AFF52B3DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

11a9cd97-cd83-46d6-9794-f1f0803be278.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\11a9cd97-cd83-46d6-9794-f1f0803be278.tmp
Size 105KB
SHA256 7fbf8b23a13854c0c33f9b9cc9b82042dfb881d0f9995938391cf2da54cfb3de
MD5 f027022507ec94f32265883243245251
SHA1 a21e2e3703475c52ae4b2881bbdf87320a7a1aa4
SHA512 b618f5fec905802eac699560ca9b2bc85f4fdd04e41ff5ea96bbc8db8724a369489826c4b1839db0a0fe4023e73b7e95ac2ee4efdd1fc7f55c8c5ffcbd19d4cc
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7r:fwUQC5VwBIiElEd2K57P7r
TLSH
T1E0B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1f6c4b137cf090c223f598118775b10d154be67456bf38a42ba1bb747522307
MD5 208cd2028de536f1eebd85494d0f5255
SHA1 9d2d0041979da71db635ceefa3fa6317dd57e198
SHA512 c40982abd1b1451db2e704b05ef6ee872d40348c91bfe1108ca9713f9faf2315fe291999266c5847de730d134c5fa291e71f02b8b42a23a33fd6d932fac0da4a
TLSH
T14BD02B80EBDC4670E033383743A28213314DA0904402244584D203CE2E0230200198B8
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2919d80dfd6d85559fba9643d47674e2117f9df47486cab2b277d4be08d7f573
MD5 df4820d8a4af5e2a30e051bc6b17890b
SHA1 71c71e6c4861a6746045802c49b9b40e854305aa
SHA512 1e68daef0c4ac9151d4231114e5afe348c06a3f326e718c027aadf385c9d9583a707dd81bd0085d2728242904ef42d27b43b0be21ee08803b068b3878dad5e55
TLSH
T1E1D02B80EBDC4A70E433383743A18213314DA0904402654684D203CE1E0334200198B8
MD5 SHA1 SHA512 TLSH

Submit Download

6edb8861-3c8d-4cd5-9aa6-ea8c96081e48.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6edb8861-3c8d-4cd5-9aa6-ea8c96081e48.tmp
Size 11KB
SHA256 7ceb9d1bc193d9ed60bdc9172153af619721d2be1ff29a261d4d9581ba6819d6
MD5 e956114cfab82adde1b46f3ad3df7e91
SHA1 66d6897b90aef0f634ce979bbc8382d860c801d5
SHA512 e9d3c6025cb0b8995093f0782962dfc6f7a038098202589ff5326d300d413242129b7ad05fa5e7b56480db9c1ea06bb956f0b9d5678e2941cd5d727dfc36781c
SSDEEP 192:sxZ9RPBz/fLs1I+fIdpxw/W6+WNzS4XY0gJ3qSaLIg5SJ:sxZ93z/fLsW32/bNX5+aDo
TLSH
T1A232C915BD78693B8CC7D209BA59BF53E6F95032A1E11E48E6FC861C05E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

728d95d2-df32-4b38-bddd-5c00ce027edd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\728d95d2-df32-4b38-bddd-5c00ce027edd.tmp
Size 10KB
SHA256 696b94ef9b6f0a12a6a973286e7e37b2ff0c520bba6b54c642d302096fd43c9e
MD5 6afa634ab2e5ba6fe8811ed5c1e59ca0
SHA1 e81283bcbcd6be60f59e2828cd8f7c76fd53704c
SHA512 d6df1644a5c66b8f8e5371cf68c15ae50f0e12445ba7ca9f1197f31ca3db5263f49b62689fe7898d4795898172a287a8583eed206e739bac70fc057271661062
SSDEEP 192:sxZ9RPbz/fLsmI+fIdpnw/W6+WNzUt/Y0gcA7SaLIgrJ:sxZ91z/fLsf3w/bE/5/aD9
TLSH
T13F22A8126E78A93B8CC7D209BA19BF53E6F95032A1E51E58F6FC851C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a328ca2-9b99-4162-bcc8-1897deedb7fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7a328ca2-9b99-4162-bcc8-1897deedb7fc.tmp
Size 10KB
SHA256 93a2e18a37bd96f3197c97a583a2059636d00ae0c7a9f9c19abfe691a5d28f1e
MD5 8cc8534cd84c8b6dc9c1e5340e203724
SHA1 7dcd7294feb9e4007687ab37733fec1a106dc5c0
SHA512 5bae9cc87375c779e2c81eb8956753814e415a7237d33b0ec51c662ef1d43a989317348bcf68d891fdfea1bc4083ce6562c88957cf53d5e687417ee8bbe2cef7
SSDEEP 192:sxZ9RPOz/fLs1I+fIdpnw/W6+WNzS4XY0gXi7SaLIg5SJ:sxZ94z/fLsW3w/bNX5+aDo
TLSH
T14A32C9157E78693B8CC7E209BA59BF53E6F95032A1E11E58E6FC861C04E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8acc51ce-50cc-4ecc-b4cf-f9eafa2da930.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8acc51ce-50cc-4ecc-b4cf-f9eafa2da930.tmp
Size 28KB
SHA256 ffcbd4b144a03aaeab160e4a3c2240c583ab019c9bccf4b14629e64a788e54b5
MD5 ed812dca9cb554f8ac774769468770b9
SHA1 1a06b908a098423f01fe4fd1f578efd358aef19c
SHA512 097a4588cad41238dcfb095976cde5ddded2c74bcf627f7d39f6b87238ef0a1ef2a7dbc29666be6e3f9db73888de2e12980efe38ad51dec2e6b647d681063d33
SSDEEP 768:BVnh588N24sWRmUUQCI8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3CrLl/Ii09qyroek:BVnh588N24sWRmUUQCIu1jaKCrLpI79G
TLSH
T112D21A3B344CCB7E4FC01E9DDD566F966EA802C766688D4047FA984C02C77EE912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a4
Size 1024KB
SHA256 4245c183102fcb2366114bb48ebe295ee39740c474e29e538d46df3239159dc0
MD5 d2a8a110a037948a42e310b2988f4476
SHA1 e4c0d8ce478a84da4aeedcd9ef2d4697af7bd30a
SHA512 35311db1d352dd2d094e648493c4d058bbbc0d10ca1b5f3c3217752ed50eb22332918d74807163e0b0cf185ccf8a75dcb443dbc23ded0a63bd188c9976622ae6
SSDEEP 24576:QeDHpDsgvIiiQ7zc4DrpKgkJ40EvTqsshe:PDJggvIiiQ7Xxzk14j
TLSH
T13525E0488EE21542F74DE6BED494F824EAA339A3C8C1C24379DF49A50F706694E4F1B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 828d512c907cbd3ea7e24de320cb56f90edd42f4d86b156f1c8fe74d23ae49f3
MD5 f4e4f91b90de7d659f839fc8ff593412
SHA1 432fb7d53ab62ae720846d54c754451df36ca8df
SHA512 a3ea479df77fcc0f6dcee7029cb887f4aed9b32608ece85b4459df59e5edcd5567419f2fac91a28dfb6964ac7a29e916a70c00a1cc2d81b46b6bf7e72f03ebce
TLSH
T15A813FA0B2D0052DFF9D85FDC2D504A7B73448DC7A8B6F7A08E2E5F858763502D0688C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 079aa2982006d0d0513d9e9401e59095eaad87f26f7869436258f809018416f6
MD5 77967166f5bb10b79f0e42ac44b6757e
SHA1 b7a3dc9975b6529606a108c21ab0a0798d02ab27
SHA512 e682a14e4264bc9aad9322d49719f127ffee56f480fae19db34d21c812fe087d3d81ad0e99f08ff016a7fc90efea832f7f86b039f0c11e402eaa10a55fa8b649
TLSH
T10561E7A0E6C14569FFAE95FDD0E801A73A3848D03B8F5FBE08E5C9F9587A3501D4684C
MD5 SHA1 SHA512 TLSH

Submit Download

a777dad9-4c4f-4e55-9b6d-a07a3f1bcd98.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\a777dad9-4c4f-4e55-9b6d-a07a3f1bcd98.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

4fe4abd5-395f-43ab-92ec-d175e420b952.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4fe4abd5-395f-43ab-92ec-d175e420b952.tmp
Size 4KB
SHA256 85a559838f78536fc57d033e42b787d81044db983ebd42386b9e0fd359629390
MD5 82191002500de79c9116d55d55d503f4
SHA1 ec6968a8f100c4d8a8b19732f5826550a675d8b3
SHA512 640bf4f8796019aaf97c0fa914343cb8203ef90ec125687c2842ef7ab4c6e7147c7c9feb5489dd206a5ed304484691f96c70ddcfd41da1b28c874c6b8057fe59
SSDEEP 96:D6OuSu4uSu9wuoukzbuVueyud5uzJubIueuuNue4u+L83ulwQ:DpxtzUwf/HWryU5kSIru4r4Xg3GT
TLSH
T1F59178B3C7E8872DC91556F4AA147E1ECE2D096843183C3AC8E59F5B97E25B1F180A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

770a8d86-a47e-4b30-b042-35ff14a7c379.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\770a8d86-a47e-4b30-b042-35ff14a7c379.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

af845aab-873b-4ea2-84e0-c801adca1e37.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\af845aab-873b-4ea2-84e0-c801adca1e37.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 84ea4375f5c4d2eaad98160cc40d21fefe90ac03d58a1e8eb35380ad680c3b1e
MD5 129d515a7d77a4f004bce1a6e5bd318a
SHA1 e82e4edfb8f6eef1661b621aad5b43ee707acdc5
SHA512 760a94c9cde5a1a2888d1a021a7b57ba056c0035809c3b14793abd33f5eaa301735a4da73abdbc085ebcbe9f66dfb0b4af3a184faa13d7e960fe6581bbef0899
SSDEEP 48:KQLItKUEIryVfIhKkY8Ly9hIBKaUs3SH2yYwA2qwV9ITy2KITAM28amFdcSnyD:KQL6KUEWWfKKkYSGhSKaUFFKK2YSg
TLSH
T1D4B1E14431BA425038BE690C45BE875B02517273325CEB6B3FBC81768E6BE096DFD6C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aa2930f3-b2b4-48e2-a260-962f367de085.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aa2930f3-b2b4-48e2-a260-962f367de085.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

b5ca53ab-4820-48af-b225-c5ca2d888001.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b5ca53ab-4820-48af-b225-c5ca2d888001.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d780038e-5722-4daf-ad08-e8b4ce903097.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d780038e-5722-4daf-ad08-e8b4ce903097.tmp
Size 10KB
SHA256 34ae9e03b33def1c073e71b26e51e9489f9474d87c270c1e0683ea379e2d8963
MD5 f9fcf91382faeaeff3b441517623ab0c
SHA1 d0157b46a8fe7040fca70e331ecf36693ee50285
SHA512 aafa398ff70d774799d90da4d1e21030d7503068e2ff227ce6ce2976de203dbb82920fce28d59cc493d3a26965a99b2b93c462c5acb5dc6258a3a3d3031752f0
SSDEEP 192:sxZ9RPOz/fLsSI+fIdpnw/W6+WNzUt/Y0gcA7SaLIg5gJ:sxZ94z/fLsz3w/bE/5/aDa
TLSH
T15422B8117E78A93B8CC7D209BA19BF53E6F95032A1E51E58E6FC861C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

429720b0-6da7-47a4-ac4d-cb17deab264a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\429720b0-6da7-47a4-ac4d-cb17deab264a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

a08ae5a9-b99d-44a6-943a-ab5f3662cb9b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a08ae5a9-b99d-44a6-943a-ab5f3662cb9b.tmp
Size 26KB
SHA256 52b43178865f55eec8b2651983c21627c8dcec515508675eba60e015e2d5fe73
MD5 e1aa8fbb03dd4ccab50b0f356ed3535d
SHA1 6655f263b5746a9515e2ddb4b6476fb23ebc708b
SHA512 34249b396a655aaeffbcf9451d5dc5a4c404c8004d7959f44a52bd5691df58a17f1f634bccab3880a9fc0414a206845512eac91e144422371b7e28a4d03e7ac1
SSDEEP 384:GiFgQkUSvy8Nv8TUNTUlIlPt4IVEqeo9HG9GuaVbMZRP2IsMtU2IIlR:tFIyuwglSIWqBGATBMXP55U2LL
TLSH
T139C208F648DB9836CAAE9B43A77D2D038E7CC157B5946A50B3885A1CCC8A1BFD307911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b78ddada-9278-4b5e-964d-1faec05f743a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b78ddada-9278-4b5e-964d-1faec05f743a.tmp
Size 8KB
SHA256 b9f0e76e787d7a8b04c186aabe0d4944c45f5f04539b7ac1074cd9de9ab249f4
MD5 699fb86cca08deb1c3e091a10a0e8124
SHA1 5149eae5cb3d08d8629a912c4a0c69645305c9ec
SHA512 0843095ba8b21b8e595032f73176befedb6e593da2047073543802037d6953825fe841ca1153c0a483f012e1c85098d84d7d0215946c96e369652f0a115ad925
SSDEEP 192:DGN46KsE7uxQmiUyqU8gxuaVIoSu9pvU6:DGN46LEqPNDgxuaVbNZU6
TLSH
T1D202D739AC7C6CB79FF3AD46B58676279FA4112BE6943F84D6E81A0C40D724C1307526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d5c49385-b7ce-4627-a155-45ea116b3b19.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d5c49385-b7ce-4627-a155-45ea116b3b19.tmp
Size 26KB
SHA256 ac1ed7a241c0f54f453ff2fab6f7f4ef5822153c9118bd27268ff6c9754d6522
MD5 3ae7ac861e43919a4c4dd4140e81ca1a
SHA1 f7293dd8b490f4ec28d228ba6df71d8f48b8e66a
SHA512 bff718abb546ea3409d541964f977bd5468f32ee00ee65f74dfb66846921a27528d7fa0023bc1adc6a002c28a0d75fc17e8f4122bc14557eeebb41645ffb9456
SSDEEP 384:GiFzQkUSvy8Nv8TUNTUlIlDt4IVEqeEHG9GuaVbMZxP2IsMtU2IIlR:tFdyuwg1SIWqTGATBMTP55U2LL
TLSH
T112C208F648EB5836CAAE9B43A77D2D038E7CC157B5946A50B3885A1CCC8A1BFD307911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d6966a0e-56be-42e7-a0e9-09c57a11443e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d6966a0e-56be-42e7-a0e9-09c57a11443e.tmp
Size 8KB
SHA256 dadb819aa8ea22dc92ed7f6f971354725d284f6ce34d558064311e980bd304d6
MD5 daf639e5ccecf4b2f2770ddd50762fb7
SHA1 eacdd34e1ed2cd011f14e36844728898a4103b2b
SHA512 3c645f62688007a2e9017f82603a8ab80563f56cd1f7ce0308d8cbb9be8ca88ff94fd035a3091febf7bb9289563aee77ca57b99dd2ab6973cbad15d8b225a859
SSDEEP 192:zGNg6KsE7u2QmiUyf88xuaVIoMZT62yq/U6:zGNg6LEqSX8xuaVbMZRPU6
TLSH
T1AC120B76AC7C6C775EE3A851B58735179EA5821BEB847B80D5EC1A0C01EF29C130B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de58f83e-5241-4632-ab4f-3379ebb365a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\de58f83e-5241-4632-ab4f-3379ebb365a9.tmp
Size 18KB
SHA256 fd711664b88153ad627f61eb7cb894bfee8c17ba9a8bbbc897c02afbd1478a92
MD5 404d397e78592c8b7f0a40339b8eee6b
SHA1 2ba8379f9c75ae13e32c37091a57b74bb1e49641
SHA512 fd7ff04475b9e90facc9631b7fe7628a2392eeba113f759989757d7a978d8dc9a5065ec104097c70e86e960fc5538e4c2441883ad8a9168914025a4e3fe1f24a
SSDEEP 384:cQkUSv08NVDt4IVEqeuHG9GuaVbMZeP2IsMtU2IIlR:c0cSIWqdGATBM0P55U2LL
TLSH
T1C9827C369CB86C778EF3A451F68A36079E74811BEAC42F94E5DCAB1C05CF29C134B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ea69b3f0-399d-42ff-9009-fc0b108781de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ea69b3f0-399d-42ff-9009-fc0b108781de.tmp
Size 18KB
SHA256 a565e2dd4627f219b4cdff1eea2eac11812d277a9b12de2d408b51cfa30ad319
MD5 ec77270df964edb2af8a8e7204b1f8a5
SHA1 501ceb576caa82371347f6e4991527deed978277
SHA512 c296ea28e9ac4516471a3ba7cd7597a0d2606c3a51386a9f379acec8655496ee18f3267bb0c6b11d313c4140c4fc5647fe2b2e14b70116b3ff39a3b441e4e950
SSDEEP 384:UQkUSv08NVOt4IVEqeuHG9GuaVbMZeP2IsMtU2IIlR:E0zSIWqdGATBM0P55U2LL
TLSH
T1AB826C369CB86C778EF3A451F68A36079E74811BEAC42F94E5DCAB1C05CF29C134B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2690e37e-0919-4711-8528-ae0d5681496e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2690e37e-0919-4711-8528-ae0d5681496e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f118f80c-3c2c-42b9-8b8f-708d9f898bc5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f118f80c-3c2c-42b9-8b8f-708d9f898bc5.tmp
Size 26KB
SHA256 c3f0610c4415124114c11c6d82d4f1a83d0ebd86a72915304f4fd50012a20acc
MD5 84a28126a4019fd7909c6bea0913a347
SHA1 ba40109a4404c19309a8ef3873e077ee82037b74
SHA512 e6886e814286cfa271bf215f5fe0b0c8e12b6ec8fe2732284b016f228b03596026ece202d09a62574368159a0c40705cb5200846f3a52e8119fc6018e329b309
SSDEEP 384:GiFHQkUSvq8Nc8TUNTUlIlPt4IVEqepHG9GuaVbMZzP2IsMtU2IIlR:tFZqHwglSIWq8GATBMpP55U2LL
TLSH
T13BC208F248DB9836CAAE9B43A77D2D038E7CC157B5946A50B3885A1CCC8A1BFD307911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f83f1420-669e-4beb-9751-6506936fb8d3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f83f1420-669e-4beb-9751-6506936fb8d3.tmp
Size 26KB
SHA256 2a0a35f53438697b0c37cd2c50cb7507299dc7e5d71af82a4a120b2b786abbb8
MD5 d86ccf45e28a7b43a1ea5053486f322a
SHA1 a40cbc0c94dab1743c272f670b188fe9da00b3f0
SHA512 0355b32dfa2587e60a59ba79c2f92af4bdf461bf39a91a417cf174a085f1a0d3c82411378127ec8816f88a7b5043c6918099a8b242cf2e7e3541ccf0b985d145
SSDEEP 384:GiFMQkUSvd8Nc8TUNTUlIlPt4IVEqeo9HG9GuaVbMZRP2IsMtU2IIlR:tFMdHwglSIWqBGATBMXP55U2LL
TLSH
T19CC208F648DB9836CEAE9B43A77D2D038E7CC157B5946A50B3885A1CCC8A1BFD307911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RELEASES

Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
Size 81B
SHA256 a5cd20d3a56fed4326944059d9c45634ab61d600dd760d0fa977b41a482593ec
MD5 805a2a9b8806551faa1d09259ea0b0d9
SHA1 499a2dbf6cb38860599c7ca990e1124e7825a62d
SHA512 8533d5527c1d3bd99e5d3cda9f2a6ce3dc13e317ffa52614c32000256dd89d3f7e2c30498d99635994ede110f6fdd0af96655fc1e8950fb20318eb486b38ace9
TLSH
T10FA0123EC040694CDC83224A1C1746316110501001450650488E6E091C2E450460CF05
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 1.5MB
SHA256 f231f67c3f5deda7a3457939aa121a673dc6b12c782efe0d378f0641808c2ef9
MD5 5e63c01b989c7d0cfe47e41abc5b2438
SHA1 4d9949e32e7974450d9c4ebcb4941f5eb5c57497
SHA512 307acc9b529aa9399ed9f5580d4791628b8a37330cb61f164d7bcdd5caa32abe408841b527ed313cd2d0992ca3698ebd536b2bff552380e1d1f064fc881bfae8
SSDEEP 24576:UBJkrlr7AiOlwOpJeYOdTNK9RgIM/aR9Gl7MRHh:UBJkAlwO/X9GlmB
TLSH
T1B5753911B7E88A2BE4AE57BAB071016547F3E5866376F78F6A4CA1781FD37804C02367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\discord\Code Cache\wasm\index-dir\temp-index
Size 48B
SHA256 6e15b394ca40309b677f9371198c46eb42671e63295b1363052ad08c04ea35c2
MD5 625aa6660cbe2fa965539b8ad621bc4b
SHA1 76b02666e2522ac4e1885389b264fc9af96865b2
SHA512 27d168aa7c1ebc7cc5013b9cef26e9ee2f2e6f732fe78bbefc9012b251b493e7ec30d0aa62edc1dbc2c0d4d2869f82918f94eaa7b5dd1353e267e456f04718ec
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\discord\Crashpad\settings.dat
Size 40B
SHA256 5c6c11962cf4425f2a8c155b20349a4483e0a25eb6efee7cc12a8cd5dac837ed
MD5 35a98cc195f6b0512ce62c763eb268bd
SHA1 5a8446e53d9082a4128e5ad36978c202d2f24a77
SHA512 53f4d386aabb00de2d678b4a5e1decab2b8041bbbb9318a405fba9675484d2bb2e77dd6af212d9efca003559835ebdfa9b7a4d6bec4298b075087cd963e0a23a
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\discord\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\discord\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a8be2340-e6dc-4edb-a31a-59ba83eecd92.tmp

Path C:\Users\Admin\AppData\Roaming\discord\a8be2340-e6dc-4edb-a31a-59ba83eecd92.tmp
Size 57B
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a
TLSH
T101900297652634755E1F1D65400B889B5CF905704E0B5E0641D032969A2A45D088705F
MD5 SHA1 SHA512 TLSH

Submit Download

DiscordSetup.exe.crdownload

Path C:\Users\Admin\Downloads\DiscordSetup.exe.crdownload
Size 143KB
SHA256 c0da25725ae3b8e5c19ebf4cf16d74333ab4164cf613448ba11a01a3afd88973
MD5 5044fc77e0ad0ac7ba85500433a068e1
SHA1 f60d69835075687346a3b261a395c55db7588e12
SHA512 bb7eea9ba0b6811292dec55fc4b4abe0d20e29d14ddaba3a9b456b3705572380fdb0c4adcbcddc4e93e974038579386bef3559e6387e0395f16b0ae23460b831
SSDEEP 3072:81aqyrpFG/5nbd1Cv9l622fwlc9LKTt/RHRV6:IYDG/5o9kfPu5ZRM
TLSH
T12CE3AF31A9809172C99324350668DBBADBBDE6710725A1CFC7A81A75FF301C0A73B75B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiscordSetup.exe.crdownload

Path C:\Users\Admin\Downloads\DiscordSetup.exe.crdownload
Size 139.0MB
SHA256 eda6c85b1b6e56507eb5a4cfb38310c20903b7893c435f6fbd869406bda663ab
MD5 58701b86bec848c19385ee9f27432cb8
SHA1 15625cc6c186f48477efbdec3275fc6f05688760
SHA512 77cbf6b342be94e2b0ee3bb8435eba0664db2f800083e18a46d56dbce17dad06b867a3aa73277097fec4ed288520f7cf2b08ed342f8b2e11dadf7542b16870aa
SSDEEP 3145728:sC0JiSsxSyVDveFWYMUmsoWIChU+392nCM7S1r9Zg:sC0JiLxSAcrvmsoW0+UnfCr9Zg
TLSH
T1236833A1A900FB58C322DD3F4676FE75AF31ACB526B1914207AD734C2AB28D72174E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiscordSetup.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\DiscordSetup.exe:Zone.Identifier
Size 155B
SHA256 2dce1f2e233dd627ee7f1a28f12b1a335a87e3d239d02a8468624ed409c3d137
MD5 ee2e628820318622d907f04014c9ab2f
SHA1 f34d25fd90e43b80a0324eb061753ca7c0cb2426
SHA512 848758cd66622b2527f2e6ea2de682f61877894c2a95571afcf3fddb0250d1c6c59cb569044fc01a33117217c72ce9ea7f6c1984a55179a0268db52254fa6272
TLSH
T118C02B9349025471074C91EC07AEF21CB60F91D85C5F0BE0DC02007EED8B2A2DBE4C43
MD5 SHA1 SHA512 TLSH

Submit Download

bd5a2d51-6540-4ba2-b24d-8562dbb50a14.tmp

Path C:\Users\Admin\Downloads\bd5a2d51-6540-4ba2-b24d-8562dbb50a14.tmp
Size 15KB
SHA256 0be8061c6ee51deef40c1dfd3ddeb00a3e88ba906d81cb2aa27310f18c3bf80d
MD5 f32bbe7f1700aafb055c33eed3fae383
SHA1 aeff46602b65641af6b0ea3b4d6f5a57e88b2362
SHA512 ee07e1c3fbacebfe05ace21bc26dc23e3a34cf3cf08a987083de39126806ade6280a8b3fef13756405810d5b142001c136a193d82773acb72e787c8fe29e2594
SSDEEP 384:qv/EwkU9LKbEtDk4t1sbdLoqyXOi80vKNnQyP8e5/ATYZluC:6mLq1sbdLzqSNQyEe9Tlz
TLSH
T1C2626D66CB009266FE1792306ADAAB3A66FCFB79138B50C7C744191DE9301D9F326347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3920-615-0x0000000008B00000-0x0000000008B38000-memory.dmp

Download

memory/3920-600-0x0000000008260000-0x0000000008268000-memory.dmp

Download

memory/3920-616-0x0000000008AD0000-0x0000000008ADE000-memory.dmp

Download

memory/3920-555-0x0000000000C40000-0x0000000000DCA000-memory.dmp

Download

memory/4292-817-0x0000000004C40000-0x0000000004C60000-memory.dmp

Download