5db36b87a646986d7de3621dfd17afda210e1dec7277de4b4d9d1fe60d8800d7

Analysis

user interaction
yes
max time kernel
87s
max time network
90s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DiscordSetup.exe
Size 116.4MB
Sample260718-2dnevset3r
SHA256 5db36b87a646986d7de3621dfd17afda210e1dec7277de4b4d9d1fe60d8800d7
MD5 90ff39a02e0130e1b20d3bbcf8a0e06f
SHA1 d7cecbdffd65280d64a0a92934d133d0a8e81869
SHA512 2e7e2398a92b31d2f88eb8d190e3a56663f6f253aaf4735b434ccbc7a5a4b616a9db7ce54a5a99926e183919ede638f5f401ebe28a1838b5b5336dd2c3ddbd70
SSDEEP 1572864:kFTQIdWBKeeaTHjBDELwfclircf/Cb06NEpdU4Pl+WNBZgmJDCmtJ6I9OozgjQ6w:kFTQIdUtHG+4kIZfz00OoJkxF42C
TLSH
T11E4833B2F921B3BBE113CEBE62F142F44E177D71A51E8D10B24AB7421731E578942D8A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Discord = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\Update.exe\" --processStart Discord.exe --process-start-args \"--start-inactive\""	reg.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	Update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	Discord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	Discord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	Update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	Discord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	Discord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	Discord.exe

Executes dropped EXE 18 IoCs

pid	Process
3560	Update.exe
880	Discord.exe
1748	Discord.exe
4544	Update.exe
1500	Discord.exe
2032	Discord.exe
948	Update.exe
1772	Discord.exe
2712	Discord.exe
1224	Discord.exe
1800	Discord.exe
2448	Discord.exe
4524	Update.exe
4588	Discord.exe
1212	Discord.exe
2260	Discord.exe
2152	Discord.exe
4836	Discord.exe

Loads dropped DLL 19 IoCs

pid	Process
1500	Discord.exe
1500	Discord.exe
1500	Discord.exe
1500	Discord.exe
1500	Discord.exe
1224	Discord.exe
1224	Discord.exe
1224	Discord.exe
1772	Discord.exe
1224	Discord.exe
1224	Discord.exe
2448	Discord.exe
2260	Discord.exe
2260	Discord.exe
2260	Discord.exe
2260	Discord.exe
2260	Discord.exe
4588	Discord.exe
4836	Discord.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DiscordSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Discord.exe

Modifies registry class 25 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9248\\Discord.exe\",-1"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord\URL Protocol	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord\shell\open\command	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord\ = "URL:Discord Protocol"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord\shell\open	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord\ = "URL:Discord Protocol"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9248\\Discord.exe\",-1"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord\shell\open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord\URL Protocol	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord\ = "URL:Discord Protocol"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9248\\Discord.exe\",-1"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord\URL Protocol	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord\shell	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9248\\Discord.exe\" --url -- \"%1\""	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord\DefaultIcon	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord\DefaultIcon	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9248\\Discord.exe\" --url -- \"%1\""	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Discord\DefaultIcon	reg.exe

Modifies registry key 1 TTPs 13 IoCs

Modify Registry

T1112

pid	Process
2432	reg.exe
2756	reg.exe
1992	reg.exe
4596	reg.exe
3288	reg.exe
856	reg.exe
308	reg.exe
2332	reg.exe
4988	reg.exe
4720	reg.exe
1824	reg.exe
408	reg.exe
4928	reg.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeShutdownPrivilege	880	Discord.exe
Token: SeCreatePagefilePrivilege	880	Discord.exe
Token: SeShutdownPrivilege	880	Discord.exe
Token: SeCreatePagefilePrivilege	880	Discord.exe
Token: SeShutdownPrivilege	1772	Discord.exe
Token: SeCreatePagefilePrivilege	1772	Discord.exe
Token: SeShutdownPrivilege	1772	Discord.exe
Token: SeCreatePagefilePrivilege	1772	Discord.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3560	Update.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 3560	3420	DiscordSetup.exe	84
PID 3560 wrote to memory of 880	3560	Update.exe	85
PID 880 wrote to memory of 1748	880	Discord.exe	86
PID 880 wrote to memory of 4544	880	Discord.exe	87
PID 880 wrote to memory of 1500	880	Discord.exe	88
PID 880 wrote to memory of 1500	880	Discord.exe	88
PID 880 wrote to memory of 2032	880	Discord.exe	89
PID 880 wrote to memory of 408	880	Discord.exe	90
PID 880 wrote to memory of 4596	880	Discord.exe	93
PID 880 wrote to memory of 3288	880	Discord.exe	96
PID 880 wrote to memory of 856	880	Discord.exe	98
PID 880 wrote to memory of 308	880	Discord.exe	100
PID 880 wrote to memory of 4928	880	Discord.exe	102
PID 948 wrote to memory of 1772	948	Update.exe	107
PID 1772 wrote to memory of 2712	1772	Discord.exe	108
PID 1772 wrote to memory of 1224	1772	Discord.exe	109
PID 1772 wrote to memory of 1224	1772	Discord.exe	109
PID 1772 wrote to memory of 1800	1772	Discord.exe	110
PID 1772 wrote to memory of 2332	1772	Discord.exe	111
PID 1772 wrote to memory of 2448	1772	Discord.exe	113
PID 1772 wrote to memory of 4988	1772	Discord.exe	114
PID 1772 wrote to memory of 2432	1772	Discord.exe	116
PID 4524 wrote to memory of 4588	4524	Update.exe	129
PID 4588 wrote to memory of 1212	4588	Discord.exe	131
PID 4588 wrote to memory of 2260	4588	Discord.exe	132
PID 4588 wrote to memory of 2260	4588	Discord.exe	132
PID 4588 wrote to memory of 2152	4588	Discord.exe	133
PID 4588 wrote to memory of 2756	4588	Discord.exe	134
PID 4588 wrote to memory of 4836	4588	Discord.exe	136
PID 4588 wrote to memory of 1992	4588	Discord.exe	137
PID 4588 wrote to memory of 4720	4588	Discord.exe	139
PID 4588 wrote to memory of 1824	4588	Discord.exe	141

C:\Users\Admin\AppData\Local\Temp\DiscordSetup.exe
"C:\Users\Admin\AppData\Local\Temp\DiscordSetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3560
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe" --squirrel-install 1.0.9248
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:880
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe
      C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9248 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=37.6.0 --initial-client-data=0x490,0x494,0x498,0x48c,0x49c,0x7ff7df11a074,0x7ff7df11a080,0x7ff7df11a090
      4⤵
      Executes dropped EXE
      PID:1748
  - - C:\Users\Admin\AppData\Local\Discord\Update.exe
      C:\Users\Admin\AppData\Local\Discord\Update.exe --createShortcut Discord.exe --setupIcon C:\Users\Admin\AppData\Local\Discord\app.ico
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4544
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1824,i,4593552219148662299,13682274192692592225,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1820 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1500
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=1824,i,4593552219148662299,13682274192692592225,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:3
      4⤵
      Executes dropped EXE
      PID:2032
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v Discord /f
      4⤵
      Modifies registry key
      PID:408
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "\"C:\Users\Admin\AppData\Local\Discord\Update.exe\" --processStart Discord.exe --process-start-args \"--start-inactive\"" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:4596
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:3288
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:856
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe\",-1" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:308
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe\" --url -- \"%1\"" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:4928

C:\Users\Admin\AppData\Local\Discord\Update.exe
"C:\Users\Admin\AppData\Local\Discord\Update.exe" --processStart Discord.exe --process-start-args "--start-inactive"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:948
- C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe
  "C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe" --start-inactive
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe
    C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9248 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=37.6.0 --initial-client-data=0x48c,0x490,0x494,0x488,0x498,0x7ff7df11a074,0x7ff7df11a080,0x7ff7df11a090
    3⤵
    - Executes dropped EXE
    PID:2712
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1832,i,15816906760148597959,7653067542457800939,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1828 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1224
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1832,i,15816906760148597959,7653067542457800939,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1984 /prefetch:3
    3⤵
    - Executes dropped EXE
    PID:1800
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:2332
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1784413123973023 --launch-time-ticks=617010941 --field-trial-handle=1832,i,15816906760148597959,7653067542457800939,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2800 --splash-media-format=webm /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2448
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:4988
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe\",-1" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:2432

C:\Users\Admin\AppData\Local\Discord\Update.exe
"C:\Users\Admin\AppData\Local\Discord\Update.exe" --processStart Discord.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe
  "C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe
    C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9248 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=37.6.0 --initial-client-data=0x494,0x498,0x49c,0x46c,0x4a0,0x7ff7df11a074,0x7ff7df11a080,0x7ff7df11a090
    3⤵
    - Executes dropped EXE
    PID:1212
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1788,i,11862303514003673158,2702731638855410101,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1776 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2260
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1788,i,11862303514003673158,2702731638855410101,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:3
    3⤵
    - Executes dropped EXE
    PID:2152
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:2756
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1788,i,11862303514003673158,2702731638855410101,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2812 --splash-media-format=webm /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4836
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:1992
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe\",-1" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:4720
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe\" --url -- \"%1\"" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:1824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SquirrelSetup.log

Path C:\Users\Admin\AppData\Local\Discord\SquirrelSetup.log
Size 2KB
SHA256 5c54ef03d15e0873913aad91024f4bb00efda31a17774485d84700879a0864d4
MD5 ea4477d2e17494776fd98e3c672d3e74
SHA1 edafc32f0be1b96d59f86e0e2091caac04b85951
SHA512 b1bd3a99c652097f4c2dbb56451b79b9d14d70a2db74010d733a420b5ee2f4a35568f3669105e7d470c4b1be031c2966d241fce5f417b90b9b7696d98e502e11
TLSH
T1305100431BA9C40E10C694978B6A774DC3E3E84273563A5893B44E1D3B8354DFA8ACCB
MD5 SHA1 SHA512 TLSH

Submit Download

app.ico

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\app.ico
Size 278KB
SHA256 dfcea1bea8a924252d507d0316d8cf38efc61cf1314e47dca3eb723f47d5fe43
MD5 084f9bc0136f779f82bea88b5c38a358
SHA1 64f210b7888e5474c3aabcb602d895d58929b451
SHA512 65bccb3e1d4849b61c68716831578300b20dcaf1cbc155512edbc6d73dccbaf6e5495d4f95d089ee496f8e080057b7097a628cc104fa8eaad8da866891d9e3eb
SSDEEP 192:uz/QWppKvrIXANuBox26FIeSyyEh9Y1kM12wngfi3TjOueN3/R/l:E/QWppKvrIXANuBc6gq3TjOuevl
TLSH
T1D25444E56118FF0ACA31CFBC08B186526C79BD17A923640777453BCD0A77ADB5232D92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\chrome_100_percent.pak
Size 163KB
SHA256 4474d496b4eb082073fb439133728eed72da35f4519505c1c246ef2b9552cf49
MD5 7bd1757ba953d8b304da1d6fb4fd7573
SHA1 4d5744d0ba3444405eeb7f43e74653f2ed3fd799
SHA512 12d7124511067f2cec4fc9f3a9022971867c540d9f01f6cc0b5dde834f106c065faf860bf7a421a836fceae9616221dfe97e8b1181f636576509cfb63f5bab5c
SSDEEP 3072:e4PisCv+/P9NebGz8LI1TwuLjQBHUP1L2o418Gb0+VRLf0ld0GY3cQ3ERVh2I:jYWFUbGz8LI1TnjQB05K18Gb0OV8ld0Q
TLSH
T120F3E1D7B7F0ED7DCA5B4AB797560071ECB30B2D0792124A5A8ED475252AB88D8C83C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\chrome_200_percent.pak
Size 252KB
SHA256 3e815b1223026c0bdfffcee62a58885e0ccd99d77f0b950778d109832e38e9cc
MD5 6a460ee2c4e796e53f9be9b050cca017
SHA1 52fb1eba7629f2896c6432969010f34f1903f8c2
SHA512 23ae8fdf5618582bd51b3690526efd135228f97649c6755e2d024b8048e214e4069f355fe4e7f09f82be45accccabf06dd6c065aecc6ed354de996f88a48ce03
SSDEEP 6144:rGQ+N6uSZQDQYakvyAkcjQB0ugx5GMRejnbdZnVE6Yoppx4:rQN6uS/fkvyAkcjK0a6edhVELoXx4
TLSH
T1FB44F1D773B8ED3DD9670AB3A21600F0FDB611290AB2525A569FDC393955EC888CD383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\d3dcompiler_47.dll
Size 4.5MB
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\icudtl.dat
Size 10.0MB
SHA256 5070de99fbd8a48378543511fb7a072f85bf36f94b4f4e1d420d54be1435d6f1
MD5 4171402e385f07007de57f45ff540e9a
SHA1 aab98edda310e6ddd3e4b71f95b6225c4defa7fc
SHA512 53e303895fa80944f7b0e0f64ab657b79bfe0d7c462b853ed06b556e42d78c639021c4c337743f18174614a1f74c805198ae868c52dfd8a2e270e4ce4a2880ff
SSDEEP 196608:rwPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2YDU:rswkpHiXUxY/iJ53IWhlVjEeI0U
TLSH
T1CEB63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libegl.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\libegl.dll
Size 503KB
SHA256 94f74802fd47b0e125e7375485e6a063b08bb70c702bd4dc5cd6938efb4319f4
MD5 43994b2c056c2a270fe57c6f23a84359
SHA1 4e0b70b84d650777d0a59e2209d656ad81b2b21e
SHA512 03974e3d5e3cb74f27698e62ee59598d831f0a4f5bbaeb4958cbde7ad79e54676c139bcd9c9afa6ac01e0685a0dd2d3297ff52372ae3cfd1a474d5e59bac0732
SSDEEP 6144:5rc4fsnH0sMclrRbnrJtHL1kbRQIPt7rccicQ+PDDIgxrkM8U:5rcUsDMEhnrP1vIPt7rccicQUD2U
TLSH
T17BB49E15B3D84669E06AC5348B534642DA76B8860B65FADF03E092793F3BFE45B3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\libglesv2.dll
Size 7.7MB
SHA256 569f80ffdf8d4ee24a6e50d507f22c9b5461aea8e606ef250d19e58c5f0e7f19
MD5 e2bbd4389cb8d32f72c4248e091147a9
SHA1 95ca04ac8a06538c0378b663efade14e2c08fc29
SHA512 cc3032cc7c583b2dab947892576facc4b0dfab603558a4c94435954c8d44c8541e67608fd6ebeaf78237896d3f82c6aa3c2c086c315ed7eb70257c642d75cfb7
SSDEEP 98304:MB+3PUNOzpVYHl9SqK0PHus8NWC9BZEXYAYt:ZfUgp0PHn8wCWvYt
TLSH
T152867B03F69680D9D04DE2B4875B9227FA34B8850324B6CF279457152F67FE0AB7EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\locales\en-US.pak
Size 494KB
SHA256 3c99e588acc5ead62c1bd695cc851ccedc9ec27fc1cfd7657b56bb91fb6bba73
MD5 f8dc05885c6df5dcc56fef7cd2132fc8
SHA1 56fafb4da53d7197d52de6e38e21f68f55f2e4b5
SHA512 1108939b4cc23c0a32224b389bef8949c905814762b311204294d75680dd05620270c71e732931270b611aeac5669c3bdb9e3aeff0646667cc63c56b6b15698c
SSDEEP 6144:16y1qHLXyRnuWm9KSMP9e+QRV3faY7vzalKn5ehj1yng3Z/wRwf:31qHLXyRnxSMvQRV5f5AjEwf
TLSH
T1CCB43C1FF7441269069352627F0995B2FF32D06CB39112563CBD802C33B6B6A83B76E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\resources.pak
Size 5.6MB
SHA256 cafd58e840d8b4aeaf6cc87b56e63dd5889b7ffebff7e0e959d45066bc85caad
MD5 8a8bf409e675a154a0bbf8172e563ab4
SHA1 36b1b4441c708c0ac55113923329f0048cd5f9ab
SHA512 53be87c1ab6234a7da0ff1935c1e166931f670ac6d273842b67a9fa3024199615db31ecd1e04fbec49849109cd5736ef501bffe97d9cd4fa7232377c5e94fe71
SSDEEP 98304:Y/RTgs94POX7P8kARvlaLIPzXH9MnsRrwrC/ICGaZZJjoMzL9+CfLRneSmD0Pk:sr94WX7EDlZbNMsRkrCAGoMFnxCGk
TLSH
T1F14633D177E61E6FE50893B8C1B88371CE2D882635152105608CB229FD35A6FAFD25BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\resources\app.asar
Size 3.4MB
SHA256 e9ecb18bf8d5cff4fe438cd909f518e7bd8777035f6252f3b441f14d544c7db6
MD5 485651ed330db9e854e2410d8ff8b95e
SHA1 e47edc8b0fb25b452fe90f00f44a8ef5859a3de3
SHA512 c526f02f0b83322cde404e26f8d5c917e069a807b17f636630fd77d6358e50a46bd3e60db73e39af8d9e1a3483bc51c53604a78c538104c397cb4076525f7d32
SSDEEP 98304:yvkysaTSKMeiDmFhGd4l1pJERJB0zEOnA7:ytq901pJERJB0zM
TLSH
T1B5F59EE5725269B34FEB22EDE932550276B9C006B054607AFAACCECE15C4409B3B773D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

build_info.json

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\resources\build_info.json
Size 175B
SHA256 ec492ae083528322c3ec8ef0d37c1bee885cb8a54054cd5346e2da0273df9e73
MD5 d54971bdde56e4185cb3bec2d8ff85d7
SHA1 5033ea13fe8a916a79112b8aa1b054ece3842607
SHA512 a7e90f1845faf28294b5ab54d280242cf8ebe9c117fbd1abc950a34a5b1651994ff1c8ecdac0bd930a090b300a6b9c730bf5c2a8983532ed922263a14b608439
TLSH
T122C012535704213703F0CBF5928590236108DE8F0277497E207F16089AA19651542E59
MD5 SHA1 SHA512 TLSH

Submit Download

updater.node

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\updater.node
Size 4.2MB
SHA256 0484f36ed4684f93e4a328b5d7af02c7b2c4d79732b1ed17ab4723070306e514
MD5 54b18acdecfe34c561430f66c282a365
SHA1 7dfef866814bf8f0531b80ceb38e46ae264cb58b
SHA512 7fcdceab48e60bd2149872d19e5fe85c95068180520170ee340fcd973854a5a36b830b7c24d13b19111b6e61e28bc31c3b49cf9d98ed722a4e74a3ab8766d8aa
SSDEEP 49152:TDxoWb1N5QtO3vCBhxZmmy4wQgOeD2x7QbQ86/nQBa6KpT+cQnaJcGAQPkYr729o:OWb1N5HONxo1XBaFN7HJkQ5H29RYY6
TLSH
T173165B03FA9546AAC06EC178835B9637E772B8890720B7EB17D44A313E53FA11E7D358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\v8_context_snapshot.bin
Size 683KB
SHA256 9537f5ad5847faf38a7030e0688b2b77d1582d196c034a9f2d5f19038f11b813
MD5 d635b18dbc2a7b288603216c0c5b3fa8
SHA1 a6210b0bcf439eef14854797cb1f161acbd1014f
SHA512 e825955307c0668676186245ac77245c6a5499c45eafb8c11f0f67d10b13718086eb50933e37f42221719e6dd98c080ad3e3a9b4f1aaf521ac6a9818a5df3370
SSDEEP 6144:qqGRvt+yUQj/sFq2Vdk1p2VXy1fawkWe9YITbg1HoSFrUb6keXjxQOLL:qxMk1pX1y/We/Tb8HozbeTTX
TLSH
T182E46156A75FDF27CACE187D5EE59F453DB5B08EAF0B422B311803BCA43A2640A9530D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\vk_swiftshader.dll
Size 5.3MB
SHA256 9f806a17ee22fe161ff63ee12199e56189ad083ac9352edea7f5ceea825fc436
MD5 824ede9b9522984979a7f9d0b9e0acc7
SHA1 9ee26f86eeddfb4b0adbae9d9e71b1ba97987f1d
SHA512 d2defcfed12acca2ffa419454a4231900806da08c836e4c48b20c65752bba4b516f6f1c6f79419316a66027ee87c4d66de7508fc86db76fd9c8391f5f1578a54
SSDEEP 49152:+Yyu/q9DxTIB1vQwSd5MBtnGfilWeEZZKmna8NnzMgGzqSQ71WJjZOzXBRXmFzAK:+Yyu/uPJSJwSWrlzsJ5
TLSH
T1DF463703F28A80D9F05DD579875F9622F672B8814B2276DF52A01F192E7BFE0A739701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\vulkan-1.dll
Size 910KB
SHA256 81b70a1a96fb3faf37868f0c0bb34cf92e3207630aa3de8e73fe09ac4e294923
MD5 180851c419d9580f780b8ce9ec515efe
SHA1 b65cc5c5e57d2cf7fae42f2ebd8f61e204a1c813
SHA512 bba763bfb73068a262b903d1ce11d68b3558cb37c07abcac13fb87821093c58c514924a8028dca95d42550d763408c48a21f497f1fad06c13b4061075506c8a9
SSDEEP 24576:8dFNgyp/0pJBjx2E/Wa6ml6Z5WRDYsHm6g3P0zAk71MW:GNgCcpJB3Oa6ml6Z5WRDYsHm6g3P0zA6
TLSH
T14F154A23A6948569D57AD034C9D28603C9B174822326B9CF02AC57087F6FFF47B7DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Update.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Update.exe.log
Size 1KB
SHA256 e96331392d474ca0fbc51036c7d55aa3a37aae6b074d50ebd106a277b0cb4097
MD5 6eb96c16eb677b6a8c1df381a0497a1a
SHA1 d4596baadc2d4bee89d57e1718ab30c0b7d563ec
SHA512 3d472d56ceb73a3df3f65eff6af088b3a81ab553153cbda925091500a6543cf83e84872f2bc81f218deddecd8f3c9868d784c2fe08ece95f915138becaecfb0b
TLSH
T1F0310F312271B0D88D133F53193C258563EF4358FA505F187519624FEA3A00B6F261F3
MD5 SHA1 SHA512 TLSH

Submit Download

RELEASES

Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
Size 81B
SHA256 3997332f8a2bff8f19b55302551169946b2675fa0717f5621ae877370fdd7be6
MD5 fb04a29f0d0c807b8215705aec4cd6da
SHA1 f9e38d2aa70550ce2a2f9dde5fd978d866434b26
SHA512 c08e20116be3d53538a9e9224ff1a1194290fea9fc2ada2a3c09533a215b3f3d39affed229246aa6044cdb235a8487ac31389ae7d00ffbefdd3218c4ea578cf6
TLSH
T17AA01237C054A09C8CE9D1851810519146030190921839A0984982150C690075294929
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 1.5MB
SHA256 42ca4b766b957346631c88eac22b6fc7450ec6ec61320cf06a1a23714f434c5d
MD5 24ed459a46b6e6981a2743cfeba844c0
SHA1 84dd7af1e9923fbd1a56a40b4f9a7d283f60b500
SHA512 8e4baf77543a3491a6dd6571a57e60f447370075d8de05e6232b4573a7c3f072f707a9af3aab02ad1f9ecb8f1eb64295fddada7272b00c0d330e7ad359e3120d
SSDEEP 24576:sBJkrlr7AiOlwOpJeYOdTNK9RgIM/aR9Gl7MRHE:sBJkAlwO/X9Glmk
TLSH
T1B5753911B7E88A2BE4AE57BAB071016547F3E5866376F78F6A4CA1781FD37804C02367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Discord.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Discord Inc\Discord.lnk
Size 2KB
SHA256 bf2ead94b4bf5058b21eb30358c3f5ca27330945a4792a1e4e365eae7718c5a7
MD5 5869f10f14e06fa4b285a8dcff06695b
SHA1 c4093ceb40c64bc9ce2908c9e1c92414411bd6ef
SHA512 4a13e1a291332500b6cdf684873b01ff7737b0791d4395c3fcda7a28407cc124b314e2785c26c1806855f648431848bd3abdc6d6cb04052b8fd494cd244b5f20
TLSH
T19F41CD02A6E79B10D3F6D9798AEB12128A75BC55FD619F0F000082881CB5F01DD68F5F
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\discord\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\discord\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 574f6e709fdcb7985a7dcf7d498c084fd0a368fd05fd8c590a3753a9ce9b0aab
MD5 488fb8b015484c8f9ebb721785044e24
SHA1 e279295a7614a47f4730d8b90d7c92b9cdabc1b2
SHA512 04edb1cf87e928bc11608384f376b9ffa9b82b88e79fd475f4828aff00474c4569263a7e636d7b4e6012c3f803f37011da7376c9b097ccae16595146fe20cc42
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\discord\Crashpad\settings.dat
Size 40B
SHA256 70a97213926e3bcc0e9bf3ccb4c0317d7d75ac1c066d3230c891448451a6f415
MD5 48f188e6fe6ebf28adc5ad7cacaf94cb
SHA1 a28dd9a0aaab51220299690fd7a9877a0e85ebb6
SHA512 7f8a4f4c9c4755c7ff919f68fb601b6718b88c22836e5f8dbbbea3570ecb37281de5d35cf3bc19adeac57dbe43d137b448e8173f5fe3265b8ef5e1c99ec6a286
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\discord\Local State
Size 434B
SHA256 76cb4fd1fa6ceee3686f629125ac32eedf4531ab869176b939485e6c047bf26b
MD5 b144ee02a94cc88c195c06d7a6f9fccc
SHA1 93bba17ceb2253f0a617917eed720cbdae8615c3
SHA512 3e05437eeda3760d9f52030321be784625add12785284801693b868d6130167601ff31b465677421587bf46c418fb6cc64f9f816a9c902945db5282baff0f442
TLSH
T19FE0813E6CD26A9BB30601A8026457100EF003CB9770AB607B9C4BEF12B2947CA24C72
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\discord\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Roaming\discord\Local Storage\leveldb\LOG
Size 245B
SHA256 5517d16ce0b47d5dd0af1b708753c57d45d090a490fcec8c002a057836606e4d
MD5 81f103d52621d441a350d826ee5a9100
SHA1 e6da7dc5282321cd8398ec1609123180b5b4700a
SHA512 a3c00f298078af798b0f3ab34cad46c64c57e09e8afdb0fd6e42b8720162a60e168f50df76242d0902144be70a8aa53673cc611d6478b92c7e42754811bc78f6
TLSH
T188D0957300D8C75D13448197D536B30CCF7061507A9C37CD4E81F64C309D448D5128C3
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\discord\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\discord\Preferences
Size 122B
SHA256 3489a9fcea842f7bd4152b6ac5a20d493dfba1fdadaec75b503c8e5ffa0d9042
MD5 c2211c33b4af50e74d888ca4d28f3fad
SHA1 804e6bad9e0d0deb2d4cd221803d362fe2c310fa
SHA512 83d929bb34348fa0552897b526eb97fe3568f5d00a04b2ed5d9e4446fe68f1ed38fc33c7eeefa02090cf15179fd3d9337b783ba0dbae2434ff745d60bfbd172e
TLSH
T104B02B03B4005033020A16A40007CF0A28AD00341D07F504D0E0F2A82429C4C084701B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\discord\Preferences
Size 93B
SHA256 529b6595a4727a6b2d6cc154ae51f426216c01fc7fda02de2460abfb3de118a4
MD5 322f01bb491180333c338526d93f115a
SHA1 554d5e43d5e46774b8f2a6b3682243a289927754
SHA512 69f8e980f44b1465cee8c0485598fa00be163db0fe88598e45ab2f817f9bea36a2b70dbb9d25d5214174ea9c198b9641bb3d5a86c18b1a4ea4493c00e2e95eb2
TLSH
T103B01253B810A0324B1B09E5000BC94F2CBE00340E475A0510D4F39D492DD4D088702B
MD5 SHA1 SHA512 TLSH

Submit Download

7_18_2026__11_28_54_PM_GMT_1-0-events.log

Path C:\Users\Admin\AppData\Roaming\discord\module_data\crashlogs\7_18_2026__11_28_54_PM_GMT_1-0-events.log
Size 416B
SHA256 6df9ef918d9fa90b52a6820191fbc6758736b55961e564352894cbbabaf46901
MD5 548b0dac17f25a784f6238160a1297dc
SHA1 754eebca3aa3a0f78696134f786ad3ba8838daeb
SHA512 37f5bb65310c0be07bafb03f09126e0922426778dafb71f5c19515a26e548982ff6d3cfdafca7bf68021ac0b6a8ddb9be456131c65477560d393bd00432274a4
TLSH
T146E068D30ECCEF3E0394D6E5A685C357C73800E61A2EA6F09286160C11AB4C26C4DC53
MD5 SHA1 SHA512 TLSH

Submit Download

scope_v3.json

Path C:\Users\Admin\AppData\Roaming\discord\sentry\scope_v3.json
Size 3KB
SHA256 f91a570a607f4ec9f97568cf4b2c89a10aee818a2d626db87d2f70c200fc3868
MD5 c2936b66bfec2f2d6a25a15ee22b0847
SHA1 f4aea3e22e22a92d6dd5e71745b07e677d883c26
SHA512 c7e393f0f22e980350de8b005e8bb1f6a4d1c6c220af35ec212e977649672885e4c7c5d0210d4872c2aa9a129d8b14f423253cc1696cfa6a1abaa398c4981c8d
TLSH
T1E88154622E2CED7A3BD5D6DD71623D0BD7F861C2518A9C8314D5DF0C868D8AD680D43B
MD5 SHA1 SHA512 TLSH

Submit Download

Discord.lnk

Path C:\Users\Admin\Desktop\Discord.lnk
Size 2KB
SHA256 4addc0802d0c0eadf017ee4509eef73b65e3249041121a3b74a80c1bab19831c
MD5 90d5959b5b5bc0a823a74f8520d088d2
SHA1 7c2eaa8933020c575723265e8f09a9d420910e02
SHA512 d45a471f8746903fef5f1c02e5eb667bf562dc0e723df4b36ddbbf4086c239810fc0c29f33519f432e6bfbc465e1842e5ba9bdc26dade684f886f3acedafee5a
TLSH
T1BF419D02A7E78B20D3F6D9799AEB22168E75B865EE119F5F000082481DB1F41DE68F5F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3560-9-0x0000000000B20000-0x0000000000CAA000-memory.dmp

Download

memory/3560-198-0x00000000082C0000-0x00000000082C8000-memory.dmp

Download

memory/3560-203-0x0000000005DC0000-0x0000000005DCE000-memory.dmp

Download

memory/3560-202-0x0000000008AD0000-0x0000000008B08000-memory.dmp

Download

memory/4544-237-0x00000000055A0000-0x00000000055C0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads