Analysis
- user interaction
yes - max time kernel
684s - max time network
683s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
25/05/2026, 00:58
General
- Target Nightcord-Installer.exe
- Size 1.9MB
- Sample260525-bbm37sdv61
- SHA256 17cfbf9b8a50450c1ba6696c95ea3a563a863dc2c7abf8609c325cf90bf49d92
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 3 IoCs
- Executes dropped EXE 58 IoCs
- Loads dropped DLL 64 IoCs
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Adds Run key to start application 2 TTPs 4 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Drops file in System32 directory 49 IoCs
- Drops file in Windows directory 64 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 3 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 22 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 3 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 44 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 12 IoCs
- Modifies data under HKEY_USERS 14 IoCs
- Modifies registry class 64 IoCs
- Modifies registry key 1 TTPs 24 IoCs
- NTFS ADS 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nightcord-Installer.exe"C:\Users\Admin\AppData\Local\Temp\Nightcord-Installer.exe"1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Nightcord-Installer.exe --webview-exe-version=2.0.0+40506a896edc79c0f2a4b3dc2fc57ed9c5bb9673 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\NightcordInstaller_WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=2280.2828.70304223803443717332⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\NightcordInstaller_WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\NightcordInstaller_WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x178,0x7ffd06d9b078,0x7ffd06d9b084,0x7ffd06d9b0903⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\NightcordInstaller_WebView2\EBWebView" --webview-exe-name=Nightcord-Installer.exe --webview-exe-version=2.0.0+40506a896edc79c0f2a4b3dc2fc57ed9c5bb9673 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1660,i,8742405273914196607,12149470664530432175,262144 --variations-seed-version --mojo-platform-channel-handle=1688 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\NightcordInstaller_WebView2\EBWebView" --webview-exe-name=Nightcord-Installer.exe --webview-exe-version=2.0.0+40506a896edc79c0f2a4b3dc2fc57ed9c5bb9673 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1996,i,8742405273914196607,12149470664530432175,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:113⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\NightcordInstaller_WebView2\EBWebView" --webview-exe-name=Nightcord-Installer.exe --webview-exe-version=2.0.0+40506a896edc79c0f2a4b3dc2fc57ed9c5bb9673 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2268,i,8742405273914196607,12149470664530432175,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\NightcordInstaller_WebView2\EBWebView" --webview-exe-name=Nightcord-Installer.exe --webview-exe-version=2.0.0+40506a896edc79c0f2a4b3dc2fc57ed9c5bb9673 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3552,i,8742405273914196607,12149470664530432175,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\NightcordInstaller_WebView2\EBWebView" --webview-exe-name=Nightcord-Installer.exe --webview-exe-version=2.0.0+40506a896edc79c0f2a4b3dc2fc57ed9c5bb9673 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3640,i,8742405273914196607,12149470664530432175,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\NightcordInstaller_WebView2\EBWebView" --webview-exe-name=Nightcord-Installer.exe --webview-exe-version=2.0.0+40506a896edc79c0f2a4b3dc2fc57ed9c5bb9673 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4436,i,8742405273914196607,12149470664530432175,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\NightcordInstaller_WebView2\EBWebView" --webview-exe-name=Nightcord-Installer.exe --webview-exe-version=2.0.0+40506a896edc79c0f2a4b3dc2fc57ed9c5bb9673 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4604,i,8742405273914196607,12149470664530432175,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:103⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\NightcordInstaller_WebView2\EBWebView" --webview-exe-name=Nightcord-Installer.exe --webview-exe-version=2.0.0+40506a896edc79c0f2a4b3dc2fc57ed9c5bb9673 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3796,i,8742405273914196607,12149470664530432175,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\NightcordInstaller_WebView2\EBWebView" --webview-exe-name=Nightcord-Installer.exe --webview-exe-version=2.0.0+40506a896edc79c0f2a4b3dc2fc57ed9c5bb9673 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3792,i,8742405273914196607,12149470664530432175,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\NightcordInstaller_WebView2\EBWebView" --webview-exe-name=Nightcord-Installer.exe --webview-exe-version=2.0.0+40506a896edc79c0f2a4b3dc2fc57ed9c5bb9673 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4340,i,8742405273914196607,12149470664530432175,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\NightcordInstaller_WebView2\EBWebView" --webview-exe-name=Nightcord-Installer.exe --webview-exe-version=2.0.0+40506a896edc79c0f2a4b3dc2fc57ed9c5bb9673 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4576,i,8742405273914196607,12149470664530432175,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\NightcordInstaller_WebView2\EBWebView" --webview-exe-name=Nightcord-Installer.exe --webview-exe-version=2.0.0+40506a896edc79c0f2a4b3dc2fc57ed9c5bb9673 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4540,i,8742405273914196607,12149470664530432175,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\NightcordInstaller_WebView2\EBWebView" --webview-exe-name=Nightcord-Installer.exe --webview-exe-version=2.0.0+40506a896edc79c0f2a4b3dc2fc57ed9c5bb9673 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4524,i,8742405273914196607,12149470664530432175,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\NightcordInstaller_WebView2\EBWebView" --webview-exe-name=Nightcord-Installer.exe --webview-exe-version=2.0.0+40506a896edc79c0f2a4b3dc2fc57ed9c5bb9673 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4672,i,8742405273914196607,12149470664530432175,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\NightcordInstaller_WebView2\EBWebView" --webview-exe-name=Nightcord-Installer.exe --webview-exe-version=2.0.0+40506a896edc79c0f2a4b3dc2fc57ed9c5bb9673 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3624,i,8742405273914196607,12149470664530432175,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\NightcordInstaller_WebView2\EBWebView" --webview-exe-name=Nightcord-Installer.exe --webview-exe-version=2.0.0+40506a896edc79c0f2a4b3dc2fc57ed9c5bb9673 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4664,i,8742405273914196607,12149470664530432175,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\NightcordInstaller_WebView2\EBWebView" --webview-exe-name=Nightcord-Installer.exe --webview-exe-version=2.0.0+40506a896edc79c0f2a4b3dc2fc57ed9c5bb9673 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4928,i,8742405273914196607,12149470664530432175,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:143⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd046ac728,0x7ffd046ac734,0x7ffd046ac7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,6000964013528440174,8571667282103585522,262144 --field-trial-handle=1868,i,13510832031215337704,9204199395918693648,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1852 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2236,i,13233534565191381966,15611750830386480720,524288 --field-trial-handle=1868,i,13510832031215337704,9204199395918693648,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2240 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,17702639749597040063,1182995993601665833,524288 --field-trial-handle=1868,i,13510832031215337704,9204199395918693648,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2536 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,16315585890737435871,18182865702857461811,2097152 --field-trial-handle=1868,i,13510832031215337704,9204199395918693648,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3440 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,2038048719154099574,13186076315670676307,2097152 --field-trial-handle=1868,i,13510832031215337704,9204199395918693648,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3480 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4300,i,17065944499430955059,2999344805678306733,2097152 --field-trial-handle=1868,i,13510832031215337704,9204199395918693648,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4276 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4700,i,14729943501510791027,10941512855901198299,2097152 --field-trial-handle=1868,i,13510832031215337704,9204199395918693648,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4732 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5492,i,16723448480779726477,891312367081925220,524288 --field-trial-handle=1868,i,13510832031215337704,9204199395918693648,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5528 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5524,i,16492158939638078231,16719153567503257574,2097152 --field-trial-handle=1868,i,13510832031215337704,9204199395918693648,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5568 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5996,i,12548985992245642435,12512103590224233013,2097152 --field-trial-handle=1868,i,13510832031215337704,9204199395918693648,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5968 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3652,i,1338540616345610006,5473215138395303961,524288 --field-trial-handle=1868,i,13510832031215337704,9204199395918693648,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3608 /prefetch:122⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6376,i,12164691941714770058,16035090319422533298,524288 --field-trial-handle=1868,i,13510832031215337704,9204199395918693648,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6388 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6380,i,3842424125755474718,45008098338869452,524288 --field-trial-handle=1868,i,13510832031215337704,9204199395918693648,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6428 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6384,i,7278324265280347288,17776717629175900578,524288 --field-trial-handle=1868,i,13510832031215337704,9204199395918693648,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6468 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4300,i,6886578511607248708,3001735390083252143,524288 --field-trial-handle=1868,i,13510832031215337704,9204199395918693648,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6468 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Users\Admin\Downloads\DiscordSetup.exe"C:\Users\Admin\Downloads\DiscordSetup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe"C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9238\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9238\Discord.exe" --squirrel-install 1.0.92384⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9238\Discord.exeC:\Users\Admin\AppData\Local\Discord\app-1.0.9238\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9238 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=37.6.0 --initial-client-data=0x508,0x50c,0x510,0x500,0x514,0x7ff74e35c074,0x7ff74e35c080,0x7ff74e35c0905⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Discord\Update.exeC:\Users\Admin\AppData\Local\Discord\Update.exe --createShortcut Discord.exe --setupIcon C:\Users\Admin\AppData\Local\Discord\app.ico5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9238\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9238\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=2412,i,6499365007655202146,9875869498582657814,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:115⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9238\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9238\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2412,i,6499365007655202146,9875869498582657814,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:25⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v Discord /f5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "\"C:\Users\Admin\AppData\Local\Discord\Update.exe\" --processStart Discord.exe" /f5⤵
- Adds Run key to start application
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f5⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f5⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9238\Discord.exe\",-1" /f5⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9238\Discord.exe\" --url -- \"%1\"" /f5⤵
- Modifies registry key
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7136,i,9901105590736190473,15341490696390248345,524288 --field-trial-handle=1868,i,13510832031215337704,9204199395918693648,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6468 /prefetch:142⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6752,i,7505641178801423297,5348305621949643518,262144 --field-trial-handle=1868,i,13510832031215337704,9204199395918693648,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6704 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Users\Admin\AppData\Local\Discord\Update.exe"C:\Users\Admin\AppData\Local\Discord\Update.exe" --processStart Discord.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9238\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9238\Discord.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9238\Discord.exeC:\Users\Admin\AppData\Local\Discord\app-1.0.9238\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9238 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=37.6.0 --initial-client-data=0x514,0x510,0x518,0x4ec,0x51c,0x7ff74e35c074,0x7ff74e35c080,0x7ff74e35c0903⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9238\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9238\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1908,i,10363027149878633781,8005333709324227822,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9238\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9238\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1908,i,10363027149878633781,8005333709324227822,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:113⤵
- Executes dropped EXE
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f3⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9238\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9238\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9238\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1779670205704004 --launch-time-ticks=640610847 --field-trial-handle=1908,i,10363027149878633781,8005333709324227822,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f3⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9238\Discord.exe\",-1" /f3⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9238\Discord.exe\" --url -- \"%1\"" /f3⤵
- Modifies registry class
- Modifies registry key
-
-
-
C:\Users\Admin\AppData\Local\Discord\Update.exe"C:\Users\Admin\AppData\Local\Discord\Update.exe" --processStart Discord.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9238\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9238\Discord.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9238\Discord.exeC:\Users\Admin\AppData\Local\Discord\app-1.0.9238\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9238 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=37.6.0 --initial-client-data=0x50c,0x510,0x514,0x504,0x518,0x7ff74e35c074,0x7ff74e35c080,0x7ff74e35c0903⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9238\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9238\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1896,i,6471593975293172419,12220271387344294020,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1892 /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9238\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9238\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1896,i,6471593975293172419,12220271387344294020,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:113⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9238\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9238\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9238\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1779670205704380 --launch-time-ticks=700576777 --field-trial-handle=1896,i,6471593975293172419,12220271387344294020,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\DiscordSetup.exe"C:\Users\Admin\Downloads\DiscordSetup.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe"C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffd046ac728,0x7ffd046ac734,0x7ffd046ac7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1792,i,8585885714523379596,7290886160203633818,524288 --field-trial-handle=2008,i,5684429141335596682,13383109008547329187,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=2036 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1560,i,4001306952634470294,2564682637818883563,262144 --field-trial-handle=2008,i,5684429141335596682,13383109008547329187,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=2004 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,17042011973215913643,1078453502271333957,524288 --field-trial-handle=2008,i,5684429141335596682,13383109008547329187,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=2328 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3096,i,2258471798262664543,14248592891869382240,2097152 --field-trial-handle=2008,i,5684429141335596682,13383109008547329187,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=3252 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3100,i,11114225177468450401,16990265139798011853,2097152 --field-trial-handle=2008,i,5684429141335596682,13383109008547329187,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=3272 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4416,i,17015586847632554152,14596663630554266265,2097152 --field-trial-handle=2008,i,5684429141335596682,13383109008547329187,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=4556 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5292,i,14639399680467368182,7933411191238069731,524288 --field-trial-handle=2008,i,5684429141335596682,13383109008547329187,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=5296 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5580,i,16603115319342507991,122114145722005924,2097152 --field-trial-handle=2008,i,5684429141335596682,13383109008547329187,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=5592 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5324,i,16191321555291337412,4104920488580591781,2097152 --field-trial-handle=2008,i,5684429141335596682,13383109008547329187,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=3288 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3560,i,17830573820139697985,10171403691264227403,2097152 --field-trial-handle=2008,i,5684429141335596682,13383109008547329187,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=3520 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3476,i,7917158375243050968,16200114787877820349,2097152 --field-trial-handle=2008,i,5684429141335596682,13383109008547329187,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=5836 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=3504,i,16031068445448083638,16960784318374405062,524288 --field-trial-handle=2008,i,5684429141335596682,13383109008547329187,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=3580 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,15844156029885146430,7151056824386704108,524288 --field-trial-handle=2008,i,5684429141335596682,13383109008547329187,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=5948 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Users\Admin\Downloads\VC_redist.x86.exe"C:\Users\Admin\Downloads\VC_redist.x86.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{4C001F72-D4F0-4C8E-9302-BC890A5DF9D0}\.cr\VC_redist.x86.exe"C:\Windows\Temp\{4C001F72-D4F0-4C8E-9302-BC890A5DF9D0}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Users\Admin\Downloads\VC_redist.x86.exe" -burn.filehandle.attached=724 -burn.filehandle.self=7283⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\Windows\Temp\{8494D425-7415-49DA-85A4-F4328A126014}\.be\VC_redist.x86.exe"C:\Windows\Temp\{8494D425-7415-49DA-85A4-F4328A126014}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{993B0B09-5DDE-49FA-953D-D5C1FB99EAE5} {3C427BD6-C63B-4EA2-8A63-F0AD137D1D7A} 20764⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={73fd1972-7030-4d2d-9ede-dd38a78c1d52} -burn.filehandle.self=1192 -burn.embedded BurnPipe.{FBCAAEA4-721E-4F53-875C-A519CB2B5692} {19F96B6E-3EA7-417F-9A53-10798B3BB83A} 24565⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=544 -burn.filehandle.self=560 -uninstall -quiet -burn.related.upgrade -burn.ancestors={73fd1972-7030-4d2d-9ede-dd38a78c1d52} -burn.filehandle.self=1192 -burn.embedded BurnPipe.{FBCAAEA4-721E-4F53-875C-A519CB2B5692} {19F96B6E-3EA7-417F-9A53-10798B3BB83A} 24566⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{E22B2F90-3825-44ED-85A8-F3192E3FBF7F} {29BCFACA-E395-44DE-A182-E99DED1F7932} 45087⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3580,i,15699495544198178116,3900020834417049699,524288 --field-trial-handle=2008,i,5684429141335596682,13383109008547329187,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=6052 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6120,i,15571172846303999523,451263325022529364,524288 --field-trial-handle=2008,i,5684429141335596682,13383109008547329187,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=6096 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5992,i,13698529646827550443,868776904646206473,524288 --field-trial-handle=2008,i,5684429141335596682,13383109008547329187,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=6552 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\Package Cache\{73fd1972-7030-4d2d-9ede-dd38a78c1d52}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{73fd1972-7030-4d2d-9ede-dd38a78c1d52}\VC_redist.x86.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{73fd1972-7030-4d2d-9ede-dd38a78c1d52}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{73fd1972-7030-4d2d-9ede-dd38a78c1d52}\VC_redist.x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260525020230.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{73fd1972-7030-4d2d-9ede-dd38a78c1d52}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{73fd1972-7030-4d2d-9ede-dd38a78c1d52}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{73fd1972-7030-4d2d-9ede-dd38a78c1d52}\VC_redist.x86.exe" -burn.filehandle.attached=568 -burn.filehandle.self=584 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260525020230.log"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\Downloads\DiscordSetup.exe"C:\Users\Admin\Downloads\DiscordSetup.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe"C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd046ac728,0x7ffd046ac734,0x7ffd046ac7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1780,i,482410174957925847,10369696639104556705,524288 --field-trial-handle=2024,i,7848901055399101173,2879086719079007920,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=2056 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1568,i,11303509928604520195,6750928083930973219,262144 --field-trial-handle=2024,i,7848901055399101173,2879086719079007920,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=2020 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,14254010037126659613,10833608960769334983,524288 --field-trial-handle=2024,i,7848901055399101173,2879086719079007920,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=2312 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,8525027300748563168,4770428523357685725,2097152 --field-trial-handle=2024,i,7848901055399101173,2879086719079007920,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=3220 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,16190616067712916274,7979255183690073510,2097152 --field-trial-handle=2024,i,7848901055399101173,2879086719079007920,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=3284 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4560,i,3906466158125513467,3831322003879128216,2097152 --field-trial-handle=2024,i,7848901055399101173,2879086719079007920,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=4548 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5340,i,17655317364140442821,5340020912305827196,524288 --field-trial-handle=2024,i,7848901055399101173,2879086719079007920,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=5344 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5612,i,14796370280886579354,9569649510162060595,2097152 --field-trial-handle=2024,i,7848901055399101173,2879086719079007920,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=5588 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5648,i,11812138956724630006,17834369641372621657,2097152 --field-trial-handle=2024,i,7848901055399101173,2879086719079007920,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=4672 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3484,i,14383091169170187697,14180739143632483358,2097152 --field-trial-handle=2024,i,7848901055399101173,2879086719079007920,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=5656 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5796,i,9240111950591570462,6377554809921165858,524288 --field-trial-handle=2024,i,7848901055399101173,2879086719079007920,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=5768 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3916,i,12342585606548338980,15403889675757270287,2097152 --field-trial-handle=2024,i,7848901055399101173,2879086719079007920,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=5904 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5556,i,41680613221589740,14055516262188963096,2097152 --field-trial-handle=2024,i,7848901055399101173,2879086719079007920,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=3192 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5652,i,5081979054972831529,8703263416122115659,524288 --field-trial-handle=2024,i,7848901055399101173,2879086719079007920,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=3392 /prefetch:122⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3284,i,10527838758552821512,11093915090164253923,2097152 --field-trial-handle=2024,i,7848901055399101173,2879086719079007920,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=3436 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5876,i,13273292037248087581,4753170469068921800,524288 --field-trial-handle=2024,i,7848901055399101173,2879086719079007920,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=5880 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=6248,i,13577068761178468571,34195069325472769,524288 --field-trial-handle=2024,i,7848901055399101173,2879086719079007920,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=6264 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=6204,i,907105781822703720,14321073816949012662,524288 --field-trial-handle=2024,i,7848901055399101173,2879086719079007920,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=6184 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6468,i,12415350681711433224,12542507788409503174,524288 --field-trial-handle=2024,i,7848901055399101173,2879086719079007920,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=6244 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6192,i,16380495665458745333,9884361680398264409,524288 --field-trial-handle=2024,i,7848901055399101173,2879086719079007920,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=6368 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6392,i,14146873891606920637,3411570383700027755,524288 --field-trial-handle=2024,i,7848901055399101173,2879086719079007920,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=6424 /prefetch:142⤵
-
-
C:\Users\Admin\Downloads\DiscordCanarySetup.exe"C:\Users\Admin\Downloads\DiscordCanarySetup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe"C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe"C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe" --squirrel-install 1.0.9654⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exeC:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discordcanary /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discordcanary\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.965 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=37.6.0 --initial-client-data=0x514,0x518,0x51c,0x50c,0x520,0x7ff734a6c074,0x7ff734a6c080,0x7ff734a6c0905⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\DiscordCanary\Update.exeC:\Users\Admin\AppData\Local\DiscordCanary\Update.exe --createShortcut DiscordCanary.exe --setupIcon C:\Users\Admin\AppData\Local\DiscordCanary\app.ico5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe"C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discordcanary" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2512,i,8398521258704254094,17842915560283294194,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:25⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe"C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discordcanary" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=2512,i,8398521258704254094,17842915560283294194,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:115⤵
- Executes dropped EXE
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v DiscordCanary /f5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v DiscordCanary /d "\"C:\Users\Admin\AppData\Local\DiscordCanary\Update.exe\" --processStart DiscordCanary.exe" /f5⤵
- Adds Run key to start application
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f5⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f5⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe\",-1" /f5⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe\" --url -- \"%1\"" /f5⤵
- Modifies registry class
- Modifies registry key
-
-
-
C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe"C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe" --squirrel-firstrun4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exeC:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discordcanary /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discordcanary\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.965 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=37.6.0 --initial-client-data=0x504,0x508,0x50c,0x4fc,0x510,0x7ff734a6c074,0x7ff734a6c080,0x7ff734a6c0905⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe"C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discordcanary" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1904,i,2120081850285072165,13603586656796791726,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1900 /prefetch:25⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe"C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discordcanary" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1904,i,2120081850285072165,13603586656796791726,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:115⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe"C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discordcanary" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.DiscordCanary.DiscordCanary --app-path="C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1779670205704005 --launch-time-ticks=882761194 --field-trial-handle=1904,i,2120081850285072165,13603586656796791726,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:15⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe"C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discordcanary" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.DiscordCanary.DiscordCanary --app-path="C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\resources\app.asar" --no-sandbox --no-zygote --enable-blink-features=EnumerateDevices,AudioOutputDevices --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1779670205704005 --launch-time-ticks=891855326 --field-trial-handle=1904,i,2120081850285072165,13603586656796791726,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3956 --enable-node-leakage-in-renderers /prefetch:15⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe"C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discordcanary" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.DiscordCanary.DiscordCanary --app-path="C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\resources\app.asar" --no-sandbox --no-zygote --enable-blink-features=EnumerateDevices,AudioOutputDevices --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1779670205704005 --launch-time-ticks=892151206 --field-trial-handle=1904,i,2120081850285072165,13603586656796791726,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3988 --enable-node-leakage-in-renderers /prefetch:15⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\modules\discord_voice-3\discord_voice\gpu_encoder_helper.exe"\\?\C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\modules\discord_voice-3\discord_voice\gpu_encoder_helper.exe" nvidia6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\modules\discord_voice-3\discord_voice\gpu_encoder_helper.exe"\\?\C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\modules\discord_voice-3\discord_voice\gpu_encoder_helper.exe" amd6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\modules\discord_voice-3\discord_voice\gpu_encoder_helper.exe"\\?\C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\modules\discord_voice-3\discord_voice\gpu_encoder_helper.exe" intel6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\modules\discord_voice-3\discord_voice\gpu_encoder_helper.exe"\\?\C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\modules\discord_voice-3\discord_voice\gpu_encoder_helper.exe" windows-media-foundation6⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe"C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discordcanary" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1904,i,2120081850285072165,13603586656796791726,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:145⤵
- Executes dropped EXE
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe"C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\discordcanary" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1904,i,2120081850285072165,13603586656796791726,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4040 /prefetch:125⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe"C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discordcanary" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.DiscordCanary.DiscordCanary --app-path="C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\resources\app.asar" --enable-sandbox --enable-blink-features=EnumerateDevices,AudioOutputDevices --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1779670205704005 --launch-time-ticks=953236694 --field-trial-handle=1904,i,2120081850285072165,13603586656796791726,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2840 --enable-node-leakage-in-renderers /prefetch:15⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe"C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discordcanary" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.DiscordCanary.DiscordCanary --app-path="C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\resources\app.asar" --enable-sandbox --enable-blink-features=EnumerateDevices,AudioOutputDevices --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --time-ticks-at-unix-epoch=-1779670205704005 --launch-time-ticks=963572555 --field-trial-handle=1904,i,2120081850285072165,13603586656796791726,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3308 --enable-node-leakage-in-renderers /prefetch:15⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v DiscordCanary5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v DiscordCanary5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v DiscordCanary /f5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v DiscordCanary /d "\"C:\Users\Admin\AppData\Local\DiscordCanary\Update.exe\" --processStart DiscordCanary.exe" /f5⤵
- Adds Run key to start application
- Modifies registry key
-
-
C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe"C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\discordcanary" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1904,i,2120081850285072165,13603586656796791726,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:105⤵
- Executes dropped EXE
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5988,i,2855247789519467031,4506039194023362261,262144 --field-trial-handle=2024,i,7848901055399101173,2879086719079007920,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=3236 /prefetch:102⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5988,i,15367353552463260190,3575586764994822468,2097152 --field-trial-handle=2024,i,7848901055399101173,2879086719079007920,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=6392 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=7128,i,14570413664416879353,13520711059115819294,2097152 --field-trial-handle=2024,i,7848901055399101173,2879086719079007920,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=7148 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6180,i,18002286177579213198,17401650907584607474,2097152 --field-trial-handle=2024,i,7848901055399101173,2879086719079007920,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=6960 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3904,i,1650885310448123534,6873837384450123299,524288 --field-trial-handle=2024,i,7848901055399101173,2879086719079007920,262144 --variations-seed-version=20260524-030033.420000-production --mojo-platform-channel-handle=5860 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\DiscordCanary\Update.exe"C:\Users\Admin\AppData\Local\DiscordCanary\Update.exe" --processStart DiscordCanary.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe"C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exeC:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discordcanary /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discordcanary\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.965 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=37.6.0 --initial-client-data=0x504,0x508,0x50c,0x4fc,0x510,0x7ff734a6c074,0x7ff734a6c080,0x7ff734a6c0903⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe"C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discordcanary" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1860,i,17665761457300975957,17119691379275939676,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1884 /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe"C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discordcanary" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1860,i,17665761457300975957,17119691379275939676,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:113⤵
- Executes dropped EXE
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f3⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe"C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discordcanary" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.DiscordCanary.DiscordCanary --app-path="C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1860,i,17665761457300975957,17119691379275939676,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f3⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe\",-1" /f3⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.965\DiscordCanary.exe\" --url -- \"%1\"" /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004E41⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\Nightcord-Installer.exe"C:\Users\Admin\AppData\Local\Temp\Nightcord-Installer.exe"1⤵
- Checks whether UAC is enabled
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Nightcord-Installer.exe --webview-exe-version=2.0.0+40506a896edc79c0f2a4b3dc2fc57ed9c5bb9673 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\NightcordInstaller_WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=2360.6560.44700423712200654312⤵
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\NightcordInstaller_WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\NightcordInstaller_WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x174,0x7ffd06d9b078,0x7ffd06d9b084,0x7ffd06d9b0903⤵
-
-
-
C:\Windows\system32\WerFault.exe"C:\Windows\system32\WerFault.exe" -k -lc WATCHDOG WATCHDOG-20260525-0207.dmp1⤵
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
e5c056b.rbs
e5c0570.rbs
e5c057d.rbs
e5c058c.rbs
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
installer.db
snapshot_blob.bin
dispatch.log
package.json
gpu_encoder_helper.exe
app.ico
08df25e13be4cb28b4be35d11f8517690b13c77fb443df1739210eddbb8e808b
1c1428a885bc2f89165f2963f296c12b1c48ae7f06fa109359bc6e46d9759755
2956c74d5f7ba84b1586152d5bce8ffb1dafb888ea7eac16decd3eb7bda9ae68
320967d30849bf7c2e406f696a198571c7c8eaee4be2b3fc85e5c07b2e5c9ae6
3bd9c0772eff0c838c5acae87fa0ae6fc5484535bede8d9b82da5016da635afc
4f3de22c6bcc593aba75ed21d59a29c003ad73bc57b0b9d9ff6909a04dd4262b
6e2fb7fb025cf87d26eb9bbde31f75640b5b67e34fff75dbe856078e61ffc1f5
74876631e4d970b6487196b2591d7e0292ddabc11e81585e70448f916f23c9d2
74ac90cf33285aeebf15775db3de8f7bd80a10de0436f9d37b18a02ec8693868
7bc50c27a4cf28b1a513238188c5b39ae2df70ee81579449b6532f5b6cf9ae22
7cfc3165d3a438c28a2d64546b6b73c3b053aeef2b8c7abe3e6b5e4015fa7c6d
99e13a18ff1d3d0d9d080fc928f2032d5047ad10ee90d082e6e53f0ff1ffb847
9c5a00013b9d3bf593dec0f7a62d35bd5f2f71fe766a67f2b6d8dc2d3227761b
c9cd31337897992f7d24f745f64ca23a93068e95f3570a0746987eebc6398652
ca344ea0346f84b2844ac9aa2f0a85f673445e8d64ce6a8b0130cf4cdf560e3f
fdd4b7ea3b71a12898f8fcd5763fbc5019858db838717c9dfd97e57f8266bfa6
installer.db
installer.db
installer.db
installer.db
RELEASES
RELEASES
SquirrelSetup.log
app.ico
chrome_100_percent.pak
chrome_200_percent.pak
d3dcompiler_47.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
en-US.pak
resources.pak
app.asar
build_info.json
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
341590f4-f839-43a1-a1cf-8b3c55b0fa58.tmp
81d7f23d-39cb-4d77-ab44-dbe76487e68e.tmp
settings.dat
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_00007b
f_00007e
f_00007f
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
index.txt
index.txt
index.txt~RFe5ad071.TMP
the-real-index
the-real-index~RFe59671d.TMP
the-real-index
the-real-index
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Update.exe.log
VoiceMessageTypes.js
LICENSE
emnapi.d.ts
libav-6.5.7.1-webcodecs-avf-with-decoders.thr.js
LICENSE
package.json
LICENSE
LICENSE
types.js
index.d.mts
license
LICENSE
index.js.flow
index.js.flow
index.js.flow
index.js.flow
index.js.flow
index.js.flow
index.js.flow
package.json
index.js.flow
package.json
index.js.flow
index.js.flow
index.js.flow
index.js.flow
index.js.flow
index.js.flow
index.js.flow
index.js.flow
index.js.flow
index.js.flow
index.js.flow
index.js.flow
index.js.flow
index.js.flow
index.js.flow
index.js.flow
index.js.flow
index.js.flow
index.js.flow
index.js.flow
index.js
index.js
index.js
index.js
index.js.flow
index.js.flow
types.js
index.js.flow
index.js.flow
index.js.flow
index.js.flow
index.js.flow
index.js.flow
index.js.flow
index.js.flow
index.js.flow
index.js.flow
index.js.flow
index.js.flow
index.js.flow
index.js.flow
index.js.flow
index.js.flow
index.js.flow
index.js
index.js
index.js
index.js
index.js.flow
index.js.flow
types.js
index.js.flow
index.js.flow
index.js.flow
base.js
emoji.js
voice.js
attachment.js
boolean.js
channel.js
integer.js
mentionable.js
number.js
role.js
string.js
subcommand.js
subcommandGroup.js
user.js
contextMenu.js
internals.js
autocomplete.js
messageComponents.js
modalSubmit.js
ping.js
index.mjs
auditLog.js
emoji.js
gateway.js
guild.js
invite.js
oauth2.js
voice.js
webhook.js
guildScheduledEvent.js
index.mjs
interactions.js
stageInstance.js
sticker.js
template.js
index.d.ts
react.d.ts
Apache-License-2.0.txt
LICENSE.md
property.js
valueOf.js
license
LICENSE
license
LICENSE
index.d.ts
LICENSE
binary.js
event.js
log.js
network.d.ts
network.js
number.d.ts
number.js
promise.d.ts
promise.js
type.d.ts
type.js
rtp.d.ts
rtp.js
binary.d.ts
event.d.ts
index.d.ts
index.js
log.d.ts
transport.d.ts
transport.js
av1.js
base.d.ts
base.js
h264.d.ts
h264.js
index.d.ts
index.js
opus.js
vp8.d.ts
vp8.js
vp9.d.ts
vp9.js
helper.js
fullIntraRequest.js
pictureLossIndication.js
remb.js
twcc.js
headerExtension.js
encoder.d.ts
encoder.js
handler.d.ts
handler.js
packet.js
rtp.js
rtx.d.ts
rtx.js
const.js
context.js
srtcp.js
session.d.ts
session.js
srtcp.js
srtp.js
util.d.ts
util.js
binary.d.ts
event.d.ts
log.d.ts
common.d.ts
common.js
LICENSE
LICENSE.txt
Busy.ani
Install - Copy.inf
Working.ani
selfie_segmentation.tflite
selfie_segmentation_landscape.tflite
audio_effects_helper.exe
discord_voice.node
discord_voice.offsets.json
gpu_encoder_helper.exe
index.js
manifest.json
mediapipe.dll
package.json
RELEASES
Update.exe
WebView2Loader.dll
42684d7f-0a2d-433b-b41a-5466827437e0.tmp
protocols.json
crl-set
settings.dat
settings.dat
throttle_store.dat
data_0
data_1
data_2
data_3
MANIFEST-000001
Network Persistent State
Network Persistent State~RFe59719c.TMP
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity~RFe5fdc30.TMP
Preferences
Preferences
Preferences~RFe58f5a6.TMP
CURRENT
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State~RFe585687.TMP
crs.pb
ct_config.pb
kp_pinslist.pb
Ruleset Data
Filtering Rules
LICENSE
Advertising
Analytics
CompatExceptions
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Other
Social
TransparentAdvertisers
Advertising
Analytics
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Other
Social
manifest.fingerprint
keys.json
default.dic
7c1cae2e-3c27-46e5-a3be-a2f677391d4e.tmp
index
f_000015
f_000016
temp-index
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
index
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Preferences
Preferences
the-real-index
the-real-index~RFe5fed95.TMP
the-real-index
the-real-index~RFe601561.TMP
index.txt
index.txt
index.txt
index.txt~RFe5e1f7c.TMP
badge-1.ico
badge-10.ico
badge-11.ico
badge-2.ico
badge-3.ico
badge-4.ico
badge-5.ico
badge-6.ico
badge-7.ico
badge-8.ico
badge-9.ico
renderer_js.log
settings.json
DiscordSetup.exe:Zone.Identifier
e5c0577.msi
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
hyph-as.hyb
hyph-hi.hyb
hyph-nb.hyb
manifest.json
manifest.json
Staging
manifest.json
manifest.fingerprint
manifest.json
manifest.json
license.rtf
thm.wxl
thm.xml
wixstdba.dll
logo.png
VC_redist.x86.exe
memory/720-3542-0x000001E4626F0000-0x000001E4626F1000-memory.dmp
memory/720-3543-0x000001E4626F0000-0x000001E4626F1000-memory.dmp
memory/720-3550-0x000001E4626F0000-0x000001E4626F1000-memory.dmp
memory/720-3549-0x000001E4626F0000-0x000001E4626F1000-memory.dmp
memory/720-3548-0x000001E4626F0000-0x000001E4626F1000-memory.dmp
memory/720-3547-0x000001E4626F0000-0x000001E4626F1000-memory.dmp
memory/720-3551-0x000001E4626F0000-0x000001E4626F1000-memory.dmp
memory/720-3552-0x000001E4626F0000-0x000001E4626F1000-memory.dmp
memory/720-3541-0x000001E4626F0000-0x000001E4626F1000-memory.dmp
memory/992-27-0x00007FFD26E00000-0x00007FFD26E01000-memory.dmp
memory/1356-148-0x00007FFD26E00000-0x00007FFD26E01000-memory.dmp
memory/2276-3680-0x0000000006780000-0x0000000006812000-memory.dmp
memory/4508-2700-0x00000000003E0000-0x0000000000457000-memory.dmp
memory/4936-2701-0x00000000003E0000-0x0000000000457000-memory.dmp
memory/5576-1073-0x0000000008750000-0x000000000875E000-memory.dmp
memory/5576-875-0x0000000000F80000-0x000000000110A000-memory.dmp
memory/5576-1068-0x00000000086E0000-0x00000000086E8000-memory.dmp
memory/5576-1072-0x0000000008770000-0x00000000087A8000-memory.dmp
memory/5636-1111-0x0000000005250000-0x0000000005270000-memory.dmp
memory/5720-1158-0x0000016504FC0000-0x0000016504FC1000-memory.dmp
memory/5720-1130-0x0000016504FC0000-0x0000016504FC1000-memory.dmp
memory/5720-1131-0x0000016504FC0000-0x0000016504FC1000-memory.dmp
memory/5720-1132-0x0000016504FC0000-0x0000016504FC1000-memory.dmp
memory/5720-1159-0x0000016504FC0000-0x0000016504FC1000-memory.dmp
memory/5720-1155-0x0000016504FC0000-0x0000016504FC1000-memory.dmp
memory/5720-1154-0x0000016504FC0000-0x0000016504FC1000-memory.dmp
memory/5720-1157-0x0000016504FC0000-0x0000016504FC1000-memory.dmp
memory/5720-1153-0x0000016504FC0000-0x0000016504FC1000-memory.dmp
memory/5720-1156-0x0000016504FC0000-0x0000016504FC1000-memory.dmp
memory/6236-2698-0x00000000003E0000-0x0000000000457000-memory.dmp
memory/6916-6712-0x0000020737C30000-0x0000020737C32000-memory.dmp
memory/6916-6374-0x00000207381D0000-0x00000207381D2000-memory.dmp
memory/6916-6707-0x0000020737C30000-0x0000020737C32000-memory.dmp
memory/6916-6708-0x0000020737C30000-0x0000020737C32000-memory.dmp
memory/6916-6709-0x0000020737C30000-0x0000020737C32000-memory.dmp
memory/6916-6710-0x0000020737C30000-0x0000020737C32000-memory.dmp
memory/6916-6711-0x0000020737C30000-0x0000020737C32000-memory.dmp
memory/6916-6705-0x0000020737C30000-0x0000020737C32000-memory.dmp
memory/6916-6713-0x0000020737C30000-0x0000020737C32000-memory.dmp
memory/6916-6714-0x0000020737C30000-0x0000020737C32000-memory.dmp
memory/6916-6715-0x0000020737C30000-0x0000020737C32000-memory.dmp
memory/6916-6716-0x0000020737C30000-0x0000020737C32000-memory.dmp
memory/6916-6693-0x0000020737C30000-0x0000020737C32000-memory.dmp
memory/6916-6694-0x0000020737C30000-0x0000020737C32000-memory.dmp
memory/6916-6695-0x0000020737C30000-0x0000020737C32000-memory.dmp
memory/6916-6296-0x0000020738500000-0x0000020738502000-memory.dmp
memory/6916-6295-0x0000020736E90000-0x0000020736E91000-memory.dmp
memory/6916-6704-0x0000020737C30000-0x0000020737C32000-memory.dmp
memory/6916-6301-0x0000020736E90000-0x0000020736E95000-memory.dmp
memory/6916-6703-0x0000020737C30000-0x0000020737C32000-memory.dmp
memory/6916-6298-0x0000020738510000-0x0000020738512000-memory.dmp
memory/6916-6300-0x000002073E110000-0x000002073E113000-memory.dmp
memory/6916-6706-0x0000020737C30000-0x0000020737C32000-memory.dmp
memory/6916-6376-0x00000207381E0000-0x00000207381E3000-memory.dmp
memory/6916-6377-0x00000207381C0000-0x00000207381C5000-memory.dmp
memory/7648-6352-0x00000182E2D30000-0x00000182E2D31000-memory.dmp
memory/7648-6392-0x00000182E2CB0000-0x00000182E2CD9000-memory.dmp
memory/7940-6323-0x00000243B2470000-0x00000243B2499000-memory.dmp
memory/7940-6277-0x00000243B24A0000-0x00000243B24A1000-memory.dmp
memory/7940-6276-0x00007FFD268B0000-0x00007FFD268B1000-memory.dmp