5db36b87a646986d7de3621dfd17afda210e1dec7277de4b4d9d1fe60d8800d7

Analysis

max time kernel
901s
max time network
480s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DiscordSetup.exe
Size 116.4MB
Sample260718-2dnevset3r
SHA256 5db36b87a646986d7de3621dfd17afda210e1dec7277de4b4d9d1fe60d8800d7
MD5 90ff39a02e0130e1b20d3bbcf8a0e06f
SHA1 d7cecbdffd65280d64a0a92934d133d0a8e81869
SHA512 2e7e2398a92b31d2f88eb8d190e3a56663f6f253aaf4735b434ccbc7a5a4b616a9db7ce54a5a99926e183919ede638f5f401ebe28a1838b5b5336dd2c3ddbd70
SSDEEP 1572864:kFTQIdWBKeeaTHjBDELwfclircf/Cb06NEpdU4Pl+WNBZgmJDCmtJ6I9OozgjQ6w:kFTQIdUtHG+4kIZfz00OoJkxF42C
TLSH
T11E4833B2F921B3BBE113CEBE62F142F44E177D71A51E8D10B24AB7421731E578942D8A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Discord = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\Update.exe\" --processStart Discord.exe --process-start-args \"--start-inactive\""	reg.exe

Executes dropped EXE 12 IoCs

pid	Process
3352	Update.exe
4420	Discord.exe
3572	Discord.exe
4076	Update.exe
6020	Discord.exe
5304	Discord.exe
2812	Update.exe
3076	Discord.exe
5672	Discord.exe
2880	Discord.exe
4220	Discord.exe
5544	Discord.exe

Loads dropped DLL 12 IoCs

pid	Process
5304	Discord.exe
5304	Discord.exe
5304	Discord.exe
5304	Discord.exe
5304	Discord.exe
2880	Discord.exe
2880	Discord.exe
2880	Discord.exe
2880	Discord.exe
2880	Discord.exe
3076	Discord.exe
5544	Discord.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DiscordSetup.exe

Checks processor information in registry 2 TTPs 48 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Discord.exe

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Discord	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Discord\URL Protocol	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Discord\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9248\\Discord.exe\",-1"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Discord\shell\open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Discord	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Discord\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9248\\Discord.exe\" --url -- \"%1\""	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Discord	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Discord\URL Protocol	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Discord\shell	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Discord\shell\open	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Discord	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Discord\DefaultIcon	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Discord\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9248\\Discord.exe\",-1"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Discord	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Discord\ = "URL:Discord Protocol"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Discord\DefaultIcon	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Discord\ = "URL:Discord Protocol"	reg.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
3268	reg.exe
2388	reg.exe
1304	reg.exe
4500	reg.exe
2372	reg.exe
5272	reg.exe
864	reg.exe
1100	reg.exe
3912	reg.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4420	Discord.exe
Token: SeCreatePagefilePrivilege	4420	Discord.exe
Token: SeShutdownPrivilege	4420	Discord.exe
Token: SeCreatePagefilePrivilege	4420	Discord.exe
Token: SeShutdownPrivilege	3076	Discord.exe
Token: SeCreatePagefilePrivilege	3076	Discord.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3352	Update.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 3352	3448	DiscordSetup.exe	89
PID 3352 wrote to memory of 4420	3352	Update.exe	90
PID 4420 wrote to memory of 3572	4420	Discord.exe	91
PID 4420 wrote to memory of 4076	4420	Discord.exe	92
PID 4420 wrote to memory of 5304	4420	Discord.exe	93
PID 4420 wrote to memory of 5304	4420	Discord.exe	93
PID 4420 wrote to memory of 6020	4420	Discord.exe	94
PID 4420 wrote to memory of 1304	4420	Discord.exe	95
PID 4420 wrote to memory of 1100	4420	Discord.exe	97
PID 4420 wrote to memory of 4500	4420	Discord.exe	99
PID 4420 wrote to memory of 2372	4420	Discord.exe	101
PID 4420 wrote to memory of 3912	4420	Discord.exe	103
PID 4420 wrote to memory of 5272	4420	Discord.exe	105
PID 2812 wrote to memory of 3076	2812	Update.exe	110
PID 3076 wrote to memory of 5672	3076	Discord.exe	111
PID 3076 wrote to memory of 2880	3076	Discord.exe	112
PID 3076 wrote to memory of 2880	3076	Discord.exe	112
PID 3076 wrote to memory of 4220	3076	Discord.exe	113
PID 3076 wrote to memory of 2388	3076	Discord.exe	114
PID 3076 wrote to memory of 5544	3076	Discord.exe	115
PID 3076 wrote to memory of 3268	3076	Discord.exe	117
PID 3076 wrote to memory of 864	3076	Discord.exe	119

C:\Users\Admin\AppData\Local\Temp\DiscordSetup.exe
"C:\Users\Admin\AppData\Local\Temp\DiscordSetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe" --squirrel-install 1.0.9248
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4420
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe
      C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9248 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=37.6.0 --initial-client-data=0x498,0x49c,0x4a0,0x464,0x4a4,0x7ff799bfa074,0x7ff799bfa080,0x7ff799bfa090
      4⤵
      Executes dropped EXE
      PID:3572
  - - C:\Users\Admin\AppData\Local\Discord\Update.exe
      C:\Users\Admin\AppData\Local\Discord\Update.exe --createShortcut Discord.exe --setupIcon C:\Users\Admin\AppData\Local\Discord\app.ico
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4076
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1752,i,4190211649674229628,12976935337056027522,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1744 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5304
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=1752,i,4190211649674229628,12976935337056027522,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:11
      4⤵
      Executes dropped EXE
      PID:6020
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v Discord /f
      4⤵
      Modifies registry key
      PID:1304
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "\"C:\Users\Admin\AppData\Local\Discord\Update.exe\" --processStart Discord.exe --process-start-args \"--start-inactive\"" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:1100
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:4500
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:2372
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe\",-1" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:3912
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe\" --url -- \"%1\"" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:5272

C:\Users\Admin\AppData\Local\Discord\Update.exe
"C:\Users\Admin\AppData\Local\Discord\Update.exe" --processStart Discord.exe --process-start-args "--start-inactive"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe
  "C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe" --start-inactive
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe
    C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9248 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=37.6.0 --initial-client-data=0x4a4,0x4a8,0x4ac,0x4a0,0x4b0,0x7ff799bfa074,0x7ff799bfa080,0x7ff799bfa090
    3⤵
    - Executes dropped EXE
    PID:5672
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1796,i,4675145476646073696,2509822382967456248,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1788 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2880
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1796,i,4675145476646073696,2509822382967456248,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:11
    3⤵
    - Executes dropped EXE
    PID:4220
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:2388
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1796,i,4675145476646073696,2509822382967456248,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2816 --splash-media-format=webm /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5544
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:3268
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe\",-1" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6140

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SquirrelSetup.log

Path C:\Users\Admin\AppData\Local\Discord\SquirrelSetup.log
Size 4KB
SHA256 5dcf9387180eb9666034ac39e78ba2ba438afc57ac2de2981d5a7f06e30fd697
MD5 be1205859da7a2aeed9879d0b2079dac
SHA1 5f0c89463b7a809dc35084bf3571ebb2d632f2c9
SHA512 b3d765675ad4b5a7bdea2ba0395e7ec285941f9f81fcf72e1706461981cee67141454ce4b7bb75e46bd180c759602eb063c833067bb226a62b0cac7a71a8a5e0
SSDEEP 96:1TYJuIufoVoYu83uKqO+CCuKWO+CnuK2rO+CnuKpO+CuLujS+Cu8:1FO+C/O+CerO+CRO+CdS+Ct
TLSH
T1D6A1418313AD800E14D6D1A38B7A364AC2D7E94572153B98F7B00D0E7683188FA97CCF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\D3DCompiler_47.dll
Size 4.5MB
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.ico

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\app.ico
Size 278KB
SHA256 dfcea1bea8a924252d507d0316d8cf38efc61cf1314e47dca3eb723f47d5fe43
MD5 084f9bc0136f779f82bea88b5c38a358
SHA1 64f210b7888e5474c3aabcb602d895d58929b451
SHA512 65bccb3e1d4849b61c68716831578300b20dcaf1cbc155512edbc6d73dccbaf6e5495d4f95d089ee496f8e080057b7097a628cc104fa8eaad8da866891d9e3eb
SSDEEP 192:uz/QWppKvrIXANuBox26FIeSyyEh9Y1kM12wngfi3TjOueN3/R/l:E/QWppKvrIXANuBc6gq3TjOuevl
TLSH
T1D25444E56118FF0ACA31CFBC08B186526C79BD17A923640777453BCD0A77ADB5232D92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\chrome_100_percent.pak
Size 163KB
SHA256 4474d496b4eb082073fb439133728eed72da35f4519505c1c246ef2b9552cf49
MD5 7bd1757ba953d8b304da1d6fb4fd7573
SHA1 4d5744d0ba3444405eeb7f43e74653f2ed3fd799
SHA512 12d7124511067f2cec4fc9f3a9022971867c540d9f01f6cc0b5dde834f106c065faf860bf7a421a836fceae9616221dfe97e8b1181f636576509cfb63f5bab5c
SSDEEP 3072:e4PisCv+/P9NebGz8LI1TwuLjQBHUP1L2o418Gb0+VRLf0ld0GY3cQ3ERVh2I:jYWFUbGz8LI1TnjQB05K18Gb0OV8ld0Q
TLSH
T120F3E1D7B7F0ED7DCA5B4AB797560071ECB30B2D0792124A5A8ED475252AB88D8C83C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\chrome_200_percent.pak
Size 252KB
SHA256 3e815b1223026c0bdfffcee62a58885e0ccd99d77f0b950778d109832e38e9cc
MD5 6a460ee2c4e796e53f9be9b050cca017
SHA1 52fb1eba7629f2896c6432969010f34f1903f8c2
SHA512 23ae8fdf5618582bd51b3690526efd135228f97649c6755e2d024b8048e214e4069f355fe4e7f09f82be45accccabf06dd6c065aecc6ed354de996f88a48ce03
SSDEEP 6144:rGQ+N6uSZQDQYakvyAkcjQB0ugx5GMRejnbdZnVE6Yoppx4:rQN6uS/fkvyAkcjK0a6edhVELoXx4
TLSH
T1FB44F1D773B8ED3DD9670AB3A21600F0FDB611290AB2525A569FDC393955EC888CD383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\icudtl.dat
Size 10.0MB
SHA256 5070de99fbd8a48378543511fb7a072f85bf36f94b4f4e1d420d54be1435d6f1
MD5 4171402e385f07007de57f45ff540e9a
SHA1 aab98edda310e6ddd3e4b71f95b6225c4defa7fc
SHA512 53e303895fa80944f7b0e0f64ab657b79bfe0d7c462b853ed06b556e42d78c639021c4c337743f18174614a1f74c805198ae868c52dfd8a2e270e4ce4a2880ff
SSDEEP 196608:rwPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2YDU:rswkpHiXUxY/iJ53IWhlVjEeI0U
TLSH
T1CEB63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libegl.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\libegl.dll
Size 503KB
SHA256 94f74802fd47b0e125e7375485e6a063b08bb70c702bd4dc5cd6938efb4319f4
MD5 43994b2c056c2a270fe57c6f23a84359
SHA1 4e0b70b84d650777d0a59e2209d656ad81b2b21e
SHA512 03974e3d5e3cb74f27698e62ee59598d831f0a4f5bbaeb4958cbde7ad79e54676c139bcd9c9afa6ac01e0685a0dd2d3297ff52372ae3cfd1a474d5e59bac0732
SSDEEP 6144:5rc4fsnH0sMclrRbnrJtHL1kbRQIPt7rccicQ+PDDIgxrkM8U:5rcUsDMEhnrP1vIPt7rccicQUD2U
TLSH
T17BB49E15B3D84669E06AC5348B534642DA76B8860B65FADF03E092793F3BFE45B3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\libglesv2.dll
Size 7.7MB
SHA256 569f80ffdf8d4ee24a6e50d507f22c9b5461aea8e606ef250d19e58c5f0e7f19
MD5 e2bbd4389cb8d32f72c4248e091147a9
SHA1 95ca04ac8a06538c0378b663efade14e2c08fc29
SHA512 cc3032cc7c583b2dab947892576facc4b0dfab603558a4c94435954c8d44c8541e67608fd6ebeaf78237896d3f82c6aa3c2c086c315ed7eb70257c642d75cfb7
SSDEEP 98304:MB+3PUNOzpVYHl9SqK0PHus8NWC9BZEXYAYt:ZfUgp0PHn8wCWvYt
TLSH
T152867B03F69680D9D04DE2B4875B9227FA34B8850324B6CF279457152F67FE0AB7EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\locales\en-US.pak
Size 494KB
SHA256 3c99e588acc5ead62c1bd695cc851ccedc9ec27fc1cfd7657b56bb91fb6bba73
MD5 f8dc05885c6df5dcc56fef7cd2132fc8
SHA1 56fafb4da53d7197d52de6e38e21f68f55f2e4b5
SHA512 1108939b4cc23c0a32224b389bef8949c905814762b311204294d75680dd05620270c71e732931270b611aeac5669c3bdb9e3aeff0646667cc63c56b6b15698c
SSDEEP 6144:16y1qHLXyRnuWm9KSMP9e+QRV3faY7vzalKn5ehj1yng3Z/wRwf:31qHLXyRnxSMvQRV5f5AjEwf
TLSH
T1CCB43C1FF7441269069352627F0995B2FF32D06CB39112563CBD802C33B6B6A83B76E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\resources.pak
Size 5.6MB
SHA256 cafd58e840d8b4aeaf6cc87b56e63dd5889b7ffebff7e0e959d45066bc85caad
MD5 8a8bf409e675a154a0bbf8172e563ab4
SHA1 36b1b4441c708c0ac55113923329f0048cd5f9ab
SHA512 53be87c1ab6234a7da0ff1935c1e166931f670ac6d273842b67a9fa3024199615db31ecd1e04fbec49849109cd5736ef501bffe97d9cd4fa7232377c5e94fe71
SSDEEP 98304:Y/RTgs94POX7P8kARvlaLIPzXH9MnsRrwrC/ICGaZZJjoMzL9+CfLRneSmD0Pk:sr94WX7EDlZbNMsRkrCAGoMFnxCGk
TLSH
T1F14633D177E61E6FE50893B8C1B88371CE2D882635152105608CB229FD35A6FAFD25BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\resources\app.asar
Size 3.4MB
SHA256 e9ecb18bf8d5cff4fe438cd909f518e7bd8777035f6252f3b441f14d544c7db6
MD5 485651ed330db9e854e2410d8ff8b95e
SHA1 e47edc8b0fb25b452fe90f00f44a8ef5859a3de3
SHA512 c526f02f0b83322cde404e26f8d5c917e069a807b17f636630fd77d6358e50a46bd3e60db73e39af8d9e1a3483bc51c53604a78c538104c397cb4076525f7d32
SSDEEP 98304:yvkysaTSKMeiDmFhGd4l1pJERJB0zEOnA7:ytq901pJERJB0zM
TLSH
T1B5F59EE5725269B34FEB22EDE932550276B9C006B054607AFAACCECE15C4409B3B773D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

build_info.json

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\resources\build_info.json
Size 175B
SHA256 ec492ae083528322c3ec8ef0d37c1bee885cb8a54054cd5346e2da0273df9e73
MD5 d54971bdde56e4185cb3bec2d8ff85d7
SHA1 5033ea13fe8a916a79112b8aa1b054ece3842607
SHA512 a7e90f1845faf28294b5ab54d280242cf8ebe9c117fbd1abc950a34a5b1651994ff1c8ecdac0bd930a090b300a6b9c730bf5c2a8983532ed922263a14b608439
TLSH
T122C012535704213703F0CBF5928590236108DE8F0277497E207F16089AA19651542E59
MD5 SHA1 SHA512 TLSH

Submit Download

updater.node

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\updater.node
Size 4.2MB
SHA256 0484f36ed4684f93e4a328b5d7af02c7b2c4d79732b1ed17ab4723070306e514
MD5 54b18acdecfe34c561430f66c282a365
SHA1 7dfef866814bf8f0531b80ceb38e46ae264cb58b
SHA512 7fcdceab48e60bd2149872d19e5fe85c95068180520170ee340fcd973854a5a36b830b7c24d13b19111b6e61e28bc31c3b49cf9d98ed722a4e74a3ab8766d8aa
SSDEEP 49152:TDxoWb1N5QtO3vCBhxZmmy4wQgOeD2x7QbQ86/nQBa6KpT+cQnaJcGAQPkYr729o:OWb1N5HONxo1XBaFN7HJkQ5H29RYY6
TLSH
T173165B03FA9546AAC06EC178835B9637E772B8890720B7EB17D44A313E53FA11E7D358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\v8_context_snapshot.bin
Size 683KB
SHA256 9537f5ad5847faf38a7030e0688b2b77d1582d196c034a9f2d5f19038f11b813
MD5 d635b18dbc2a7b288603216c0c5b3fa8
SHA1 a6210b0bcf439eef14854797cb1f161acbd1014f
SHA512 e825955307c0668676186245ac77245c6a5499c45eafb8c11f0f67d10b13718086eb50933e37f42221719e6dd98c080ad3e3a9b4f1aaf521ac6a9818a5df3370
SSDEEP 6144:qqGRvt+yUQj/sFq2Vdk1p2VXy1fawkWe9YITbg1HoSFrUb6keXjxQOLL:qxMk1pX1y/We/Tb8HozbeTTX
TLSH
T182E46156A75FDF27CACE187D5EE59F453DB5B08EAF0B422B311803BCA43A2640A9530D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\vk_swiftshader.dll
Size 5.3MB
SHA256 9f806a17ee22fe161ff63ee12199e56189ad083ac9352edea7f5ceea825fc436
MD5 824ede9b9522984979a7f9d0b9e0acc7
SHA1 9ee26f86eeddfb4b0adbae9d9e71b1ba97987f1d
SHA512 d2defcfed12acca2ffa419454a4231900806da08c836e4c48b20c65752bba4b516f6f1c6f79419316a66027ee87c4d66de7508fc86db76fd9c8391f5f1578a54
SSDEEP 49152:+Yyu/q9DxTIB1vQwSd5MBtnGfilWeEZZKmna8NnzMgGzqSQ71WJjZOzXBRXmFzAK:+Yyu/uPJSJwSWrlzsJ5
TLSH
T1DF463703F28A80D9F05DD579875F9622F672B8814B2276DF52A01F192E7BFE0A739701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\vulkan-1.dll
Size 910KB
SHA256 81b70a1a96fb3faf37868f0c0bb34cf92e3207630aa3de8e73fe09ac4e294923
MD5 180851c419d9580f780b8ce9ec515efe
SHA1 b65cc5c5e57d2cf7fae42f2ebd8f61e204a1c813
SHA512 bba763bfb73068a262b903d1ce11d68b3558cb37c07abcac13fb87821093c58c514924a8028dca95d42550d763408c48a21f497f1fad06c13b4061075506c8a9
SSDEEP 24576:8dFNgyp/0pJBjx2E/Wa6ml6Z5WRDYsHm6g3P0zAk71MW:GNgCcpJB3Oa6ml6Z5WRDYsHm6g3P0zA6
TLSH
T14F154A23A6948569D57AD034C9D28603C9B174822326B9CF02AC57087F6FFF47B7DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RELEASES

Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
Size 81B
SHA256 3997332f8a2bff8f19b55302551169946b2675fa0717f5621ae877370fdd7be6
MD5 fb04a29f0d0c807b8215705aec4cd6da
SHA1 f9e38d2aa70550ce2a2f9dde5fd978d866434b26
SHA512 c08e20116be3d53538a9e9224ff1a1194290fea9fc2ada2a3c09533a215b3f3d39affed229246aa6044cdb235a8487ac31389ae7d00ffbefdd3218c4ea578cf6
TLSH
T17AA01237C054A09C8CE9D1851810519146030190921839A0984982150C690075294929
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 1.5MB
SHA256 42ca4b766b957346631c88eac22b6fc7450ec6ec61320cf06a1a23714f434c5d
MD5 24ed459a46b6e6981a2743cfeba844c0
SHA1 84dd7af1e9923fbd1a56a40b4f9a7d283f60b500
SHA512 8e4baf77543a3491a6dd6571a57e60f447370075d8de05e6232b4573a7c3f072f707a9af3aab02ad1f9ecb8f1eb64295fddada7272b00c0d330e7ad359e3120d
SSDEEP 24576:sBJkrlr7AiOlwOpJeYOdTNK9RgIM/aR9Gl7MRHE:sBJkAlwO/X9Glmk
TLSH
T1B5753911B7E88A2BE4AE57BAB071016547F3E5866376F78F6A4CA1781FD37804C02367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Discord.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Discord Inc\Discord.lnk
Size 2KB
SHA256 f871e51a7d7a1c8765ea341e3a7caddc2af7f7270cfe193e5e654bcb4f68bfe9
MD5 0481ba87a249f4001fa20396158f92ad
SHA1 114cda7f27c4201b35653c5ee4ff42c586b4634e
SHA512 790a8c3fa457a4242ebfc6ba844a85f441a7ef27f864d2702f062d48a319db41221249b59fe0967009a5cf63a9b13eb9db8929bf3b8a485b43e6b74fb76a827a
TLSH
T19141D20166EA9F20E3FACD754AD72665DAB9B920FE659F4E000081485CB5F01DD64F1F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\discord\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 22d79ba8f9fd6e03b7c4fa193a23cb0d700b03b2a922c79ee70b3767f2eba81a
MD5 e058a317e61051d7488be377d6464b98
SHA1 b1fa196ca86ab539e8c706d7396bf6cee058b1f6
SHA512 8e5987ef42d38f1b2c6152e655c93f5a9d52f5d2cd337e67a623f3dc581d67925e8c83d7dc615124bca501ab0e8e5fffc6af9ec41200c4e36452618163ae1c76
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\discord\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 c2e89dd327ba0c7b48e875bfc6cc12c661bbab613996baf3fd29adce2844efba
MD5 a20fc6fc8bb540c6fe1607faea7e54d1
SHA1 5398053a36e2081c66bc99937a083e568631327b
SHA512 d5eb7350d9146a8cd33dac8884af345d7213fc50a2f23c43112ebafd3bd995b83dc4e68fb8452bc8df41c7e4179a55a78fb8e4c0aaf17a644e947e6b6a112972
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\discord\Crashpad\settings.dat
Size 40B
SHA256 13b3f6470ea1bce545a504115676c71183cfa3d8298dd1697d49045ee23235ba
MD5 f60a227df5420695a0825b96c075fefa
SHA1 788d878269ee7b0e60005f6bee0e627aefd11885
SHA512 936bd3bb49ae03e88aaef619784a18ef547e95f78de6923874a0358ea1c771a077bd7b04d09f49935c658992e038d67a2e2058466d3e9dfd5cf47d89c4f84dc5
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\discord\Local State
Size 434B
SHA256 9c70ca693c546057de0bb32c7c2f32d61b3a16e4915ebcbe8d743514dec9cbad
MD5 cdc82a93e7dbcd96afeda1dc66f0e9f9
SHA1 911781e529ff9d8f5f9738f3c0cfcb53a7df8dca
SHA512 6c7ff5d02441bb38fd60ace3e537889a425643c6fdd135ddbcd47c0e66e8bf902d33ed66972d0a4928dec44db74b31b3eb27172255d3cd955714271b86f4e616
TLSH
T1A3E0A371A9B21D69B5D659574832735A1C2174978FB011942CFD110F11B7975C20CD15
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\discord\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Roaming\discord\Local Storage\leveldb\LOG
Size 245B
SHA256 0f68ff0dedd485262a35f8b49e1f3bdda69f3cf5493911ab61cf146281335cd7
MD5 0ef37823bdca7e62a45237e23cd46021
SHA1 8943c5cbfd7cb06b5908e1909304e31e16f80c2f
SHA512 fa5619786f3d036cecd349a908768f7350da8deb5083323d8315b0f98821cb3c6efe45413eac7adc3ba2cae210bff13f02751089c0dd5807a0ced24bab2db8dd
TLSH
T106D02B3340E8C75D1285419B9136F30CCF7460447A8C33884F91F94C305D0499501883
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\discord\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\discord\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\discord\Preferences
Size 122B
SHA256 3489a9fcea842f7bd4152b6ac5a20d493dfba1fdadaec75b503c8e5ffa0d9042
MD5 c2211c33b4af50e74d888ca4d28f3fad
SHA1 804e6bad9e0d0deb2d4cd221803d362fe2c310fa
SHA512 83d929bb34348fa0552897b526eb97fe3568f5d00a04b2ed5d9e4446fe68f1ed38fc33c7eeefa02090cf15179fd3d9337b783ba0dbae2434ff745d60bfbd172e
TLSH
T104B02B03B4005033020A16A40007CF0A28AD00341D07F504D0E0F2A82429C4C084701B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\discord\Preferences
Size 93B
SHA256 529b6595a4727a6b2d6cc154ae51f426216c01fc7fda02de2460abfb3de118a4
MD5 322f01bb491180333c338526d93f115a
SHA1 554d5e43d5e46774b8f2a6b3682243a289927754
SHA512 69f8e980f44b1465cee8c0485598fa00be163db0fe88598e45ab2f817f9bea36a2b70dbb9d25d5214174ea9c198b9641bb3d5a86c18b1a4ea4493c00e2e95eb2
TLSH
T103B01253B810A0324B1B09E5000BC94F2CBE00340E475A0510D4F39D492DD4D088702B
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\discord\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

7_18_2026__11_28_57_PM_GMT_1-0-events.log

Path C:\Users\Admin\AppData\Roaming\discord\module_data\crashlogs\7_18_2026__11_28_57_PM_GMT_1-0-events.log
Size 372B
SHA256 0d1e7da5371f0c37933037def5d94d7c8e9bd61eba93d322be23bd4545770375
MD5 59f935447e11b401f94e410210665fc9
SHA1 7066c09297b0d692d86e89dcfa1d6609ad1903d8
SHA512 c959a04175aa1b2776522e22ca104b26aab0a60f3780366ecda624c2548df99ea1ec0430e5a5c27c5b17dece351130c1f1f341c97d9e7b6aa949c5e9e818af9e
TLSH
T18FE026D31ED8BE3E07D4DAE5A5D58257C72400D60A2FA2F45286050C11AB4D2AC4DC52
MD5 SHA1 SHA512 TLSH

Submit Download

scope_v3.json

Path C:\Users\Admin\AppData\Roaming\discord\sentry\scope_v3.json
Size 3KB
SHA256 a1628aa24fd5d76391db01bca247d52b05586be2333ffc04b417e0f2c99edc6c
MD5 87a78230ae712efc0cd684757684c1fa
SHA1 4da65ff54159f7787ad41044bd3341dff75bcfb1
SHA512 846395362b29238f9053ac0ccb842eccd8d61563857b1d5d67d03bb8328350505b95b257c7f499c60a72657f09673d734e81464f2bcf7b37e830ebeee0c1df99
TLSH
T1208134622E28ED7A2B95D6DC71623D4FD7B861C2518A9C8314E6DF0C868D8AD780D43B
MD5 SHA1 SHA512 TLSH

Submit Download

Discord.lnk

Path C:\Users\Admin\Desktop\Discord.lnk
Size 2KB
SHA256 a191ba789e5f6008b51bb8236ee3c3e761dc1d8a4ca35ec1132d403dd3d9c862
MD5 69c6627cd664ad389f961ccbf217ba07
SHA1 40ce92f87799675e42d999d8292a846e2fad8c0e
SHA512 21c66e4a5bac293df4a5d8c2a9d273c87371bd9e781d70fcc7be4e4f0f774843f3241b80c0131e3b6b14e9379258cf0cf7db8cc4487ee903314003209d415a26
TLSH
T14841D20266EA9B21E3FA8D754AD72614DBB8B920EE159F4E0000810C5CB1F01DD64F1F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3352-192-0x0000000009160000-0x000000000916E000-memory.dmp

Download

memory/3352-190-0x00000000088E0000-0x00000000088E8000-memory.dmp

Download

memory/3352-191-0x0000000009180000-0x00000000091BE000-memory.dmp

Download

memory/3352-11-0x0000000000720000-0x00000000008AA000-memory.dmp

Download

memory/4076-239-0x0000000003490000-0x00000000034B0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads