23577e5a8aa89e28d10aad913edb2fac2f7aa39a4ce0e6327e8482af90802053

Analysis

user interaction
yes
max time kernel
44s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 10:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
discord-1-0-9246.exe
Size 116.4MB
Sample260722-l96cjsshlf
SHA256 23577e5a8aa89e28d10aad913edb2fac2f7aa39a4ce0e6327e8482af90802053
MD5 5e5e782d190245a1fb74b6f10eaac989
SHA1 de6a53039692f2612201d257f25f12369e52ddb1
SHA512 f21fefc442c0f323ec9fd88d06dc376a6637b3a2e4d7255a6bcccbf936ed3039c6a52b3154905eae149735b8ed93afaa1cd971086ec50d561283a57059baa574
SSDEEP 3145728:RAfUmRqGpaGBvoD4Nm5nIq9BSWzEqXM2D:RAbRmWvoFIirzEq82D
TLSH
T1964833C2F4E637C9D869CF3E73F262310D06BF906721966A52467BC71E7258BC266D02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Discord = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\Update.exe\" --processStart Discord.exe --process-start-args \"--start-inactive\""	reg.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	Discord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	Update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	Discord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	Discord.exe

Executes dropped EXE 12 IoCs

pid	Process
756	Update.exe
3516	Discord.exe
3840	Discord.exe
224	Update.exe
3628	Discord.exe
1472	Discord.exe
4712	Update.exe
4940	Discord.exe
976	Discord.exe
4676	Discord.exe
4348	Discord.exe
4936	Discord.exe

Loads dropped DLL 12 IoCs

pid	Process
3628	Discord.exe
3628	Discord.exe
3628	Discord.exe
3628	Discord.exe
3628	Discord.exe
4940	Discord.exe
4676	Discord.exe
4676	Discord.exe
4676	Discord.exe
4676	Discord.exe
4676	Discord.exe
4936	Discord.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	discord-1-0-9246.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe

Checks processor information in registry 2 TTPs 48 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Discord.exe

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Discord	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Discord	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Discord	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Discord\URL Protocol	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Discord\DefaultIcon	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Discord\shell\open\command	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Discord\ = "URL:Discord Protocol"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Discord	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Discord\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9246\\Discord.exe\",-1"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Discord\shell	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Discord\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9246\\Discord.exe\" --url -- \"%1\""	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Discord\shell\open\command	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Discord\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9246\\Discord.exe\" --url -- \"%1\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Discord\ = "URL:Discord Protocol"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Discord\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9246\\Discord.exe\",-1"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Discord\URL Protocol	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Discord\DefaultIcon	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Discord	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Discord\shell\open	reg.exe

Modifies registry key 1 TTPs 10 IoCs

Modify Registry

T1112

pid	Process
2664	reg.exe
1224	reg.exe
4668	reg.exe
4884	reg.exe
3932	reg.exe
2876	reg.exe
4696	reg.exe
1176	reg.exe
1672	reg.exe
1476	reg.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3516	Discord.exe
Token: SeCreatePagefilePrivilege	3516	Discord.exe
Token: SeShutdownPrivilege	3516	Discord.exe
Token: SeCreatePagefilePrivilege	3516	Discord.exe
Token: SeShutdownPrivilege	4940	Discord.exe
Token: SeCreatePagefilePrivilege	4940	Discord.exe
Token: SeShutdownPrivilege	4940	Discord.exe
Token: SeCreatePagefilePrivilege	4940	Discord.exe
Token: SeShutdownPrivilege	4940	Discord.exe
Token: SeCreatePagefilePrivilege	4940	Discord.exe
Token: SeShutdownPrivilege	4940	Discord.exe
Token: SeCreatePagefilePrivilege	4940	Discord.exe
Token: SeShutdownPrivilege	4940	Discord.exe
Token: SeCreatePagefilePrivilege	4940	Discord.exe
Token: SeShutdownPrivilege	4940	Discord.exe
Token: SeCreatePagefilePrivilege	4940	Discord.exe
Token: SeShutdownPrivilege	4940	Discord.exe
Token: SeCreatePagefilePrivilege	4940	Discord.exe
Token: SeShutdownPrivilege	4940	Discord.exe
Token: SeCreatePagefilePrivilege	4940	Discord.exe
Token: SeShutdownPrivilege	4940	Discord.exe
Token: SeCreatePagefilePrivilege	4940	Discord.exe
Token: SeShutdownPrivilege	4940	Discord.exe
Token: SeCreatePagefilePrivilege	4940	Discord.exe
Token: SeShutdownPrivilege	4940	Discord.exe
Token: SeCreatePagefilePrivilege	4940	Discord.exe
Token: SeShutdownPrivilege	4940	Discord.exe
Token: SeCreatePagefilePrivilege	4940	Discord.exe
Token: SeShutdownPrivilege	4940	Discord.exe
Token: SeCreatePagefilePrivilege	4940	Discord.exe
Token: SeShutdownPrivilege	4940	Discord.exe
Token: SeCreatePagefilePrivilege	4940	Discord.exe
Token: SeShutdownPrivilege	4940	Discord.exe
Token: SeCreatePagefilePrivilege	4940	Discord.exe
Token: SeShutdownPrivilege	4940	Discord.exe
Token: SeCreatePagefilePrivilege	4940	Discord.exe
Token: SeShutdownPrivilege	4940	Discord.exe
Token: SeCreatePagefilePrivilege	4940	Discord.exe
Token: SeShutdownPrivilege	4940	Discord.exe
Token: SeCreatePagefilePrivilege	4940	Discord.exe
Token: SeShutdownPrivilege	4940	Discord.exe
Token: SeCreatePagefilePrivilege	4940	Discord.exe
Token: SeShutdownPrivilege	4940	Discord.exe
Token: SeCreatePagefilePrivilege	4940	Discord.exe
Token: SeShutdownPrivilege	4940	Discord.exe
Token: SeCreatePagefilePrivilege	4940	Discord.exe
Token: SeShutdownPrivilege	4940	Discord.exe
Token: SeCreatePagefilePrivilege	4940	Discord.exe
Token: SeShutdownPrivilege	4940	Discord.exe
Token: SeCreatePagefilePrivilege	4940	Discord.exe
Token: SeShutdownPrivilege	4940	Discord.exe
Token: SeCreatePagefilePrivilege	4940	Discord.exe
Token: SeShutdownPrivilege	4940	Discord.exe
Token: SeCreatePagefilePrivilege	4940	Discord.exe
Token: SeShutdownPrivilege	4940	Discord.exe
Token: SeCreatePagefilePrivilege	4940	Discord.exe
Token: SeShutdownPrivilege	4940	Discord.exe
Token: SeCreatePagefilePrivilege	4940	Discord.exe
Token: SeShutdownPrivilege	4940	Discord.exe
Token: SeCreatePagefilePrivilege	4940	Discord.exe
Token: SeShutdownPrivilege	4940	Discord.exe
Token: SeCreatePagefilePrivilege	4940	Discord.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
756	Update.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 756	4072	discord-1-0-9246.exe	83
PID 756 wrote to memory of 3516	756	Update.exe	84
PID 3516 wrote to memory of 3840	3516	Discord.exe	85
PID 3516 wrote to memory of 224	3516	Discord.exe	86
PID 3516 wrote to memory of 3628	3516	Discord.exe	87
PID 3516 wrote to memory of 3628	3516	Discord.exe	87
PID 3516 wrote to memory of 1472	3516	Discord.exe	88
PID 3516 wrote to memory of 2664	3516	Discord.exe	89
PID 3516 wrote to memory of 4884	3516	Discord.exe	92
PID 3516 wrote to memory of 3932	3516	Discord.exe	94
PID 3516 wrote to memory of 1224	3516	Discord.exe	96
PID 3516 wrote to memory of 2876	3516	Discord.exe	98
PID 3516 wrote to memory of 4696	3516	Discord.exe	118
PID 4712 wrote to memory of 4940	4712	Update.exe	105
PID 4940 wrote to memory of 976	4940	Discord.exe	106
PID 4940 wrote to memory of 4676	4940	Discord.exe	107
PID 4940 wrote to memory of 4676	4940	Discord.exe	107
PID 4940 wrote to memory of 4348	4940	Discord.exe	108
PID 4940 wrote to memory of 1176	4940	Discord.exe	109
PID 4940 wrote to memory of 4936	4940	Discord.exe	111
PID 4940 wrote to memory of 4668	4940	Discord.exe	114
PID 4940 wrote to memory of 1672	4940	Discord.exe	116
PID 4940 wrote to memory of 1476	4940	Discord.exe	119

C:\Users\Admin\AppData\Local\Temp\discord-1-0-9246.exe
"C:\Users\Admin\AppData\Local\Temp\discord-1-0-9246.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:756
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\Discord.exe" --squirrel-install 1.0.9246
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3516
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\Discord.exe
      C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9246 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=37.6.0 --initial-client-data=0x478,0x47c,0x480,0x474,0x484,0x7ff61040c074,0x7ff61040c080,0x7ff61040c090
      4⤵
      Executes dropped EXE
      PID:3840
  - - C:\Users\Admin\AppData\Local\Discord\Update.exe
      C:\Users\Admin\AppData\Local\Discord\Update.exe --createShortcut Discord.exe --setupIcon C:\Users\Admin\AppData\Local\Discord\app.ico
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:224
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1780,i,4994828508746440141,3080258792129884081,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1776 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3628
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=1780,i,4994828508746440141,3080258792129884081,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:3
      4⤵
      Executes dropped EXE
      PID:1472
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v Discord /f
      4⤵
      Modifies registry key
      PID:2664
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "\"C:\Users\Admin\AppData\Local\Discord\Update.exe\" --processStart Discord.exe --process-start-args \"--start-inactive\"" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:4884
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:3932
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:1224
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\Discord.exe\",-1" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:2876
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\Discord.exe\" --url -- \"%1\"" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:4696

C:\Users\Admin\AppData\Local\Discord\Update.exe
"C:\Users\Admin\AppData\Local\Discord\Update.exe" --processStart Discord.exe --process-start-args "--start-inactive"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\Discord.exe
  "C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\Discord.exe" --start-inactive
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\Discord.exe
    C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9246 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=37.6.0 --initial-client-data=0x490,0x494,0x498,0x48c,0x49c,0x7ff61040c074,0x7ff61040c080,0x7ff61040c090
    3⤵
    - Executes dropped EXE
    PID:976
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1804,i,14319369771971561493,356522431378138025,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1800 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4676
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1804,i,14319369771971561493,356522431378138025,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:3
    3⤵
    - Executes dropped EXE
    PID:4348
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:1176
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1784714802242947 --launch-time-ticks=544907999 --field-trial-handle=1804,i,14319369771971561493,356522431378138025,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2800 --splash-media-format=webm /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4936
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:4668
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\Discord.exe\",-1" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:1672
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\Discord.exe\" --url -- \"%1\"" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:1476

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:4696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SquirrelSetup.log

Path C:\Users\Admin\AppData\Local\Discord\SquirrelSetup.log
Size 2KB
SHA256 6be5baa6cb53597458016855608d92ac7a541ef7baac3f65f6be4ff9e2b38b03
MD5 82277fcc6082d74f2b2e153d82f37347
SHA1 012acde11aabfa6a6371ae16e881711d8f5fc669
SHA512 b30f78341847d7a0fd2592eab827b906b7697654c9f718e388b258f6114b500d1fa2084c3eb5462ffedc139096ed7178068bb7a1018d1ccdae7cd0c19aaff927
TLSH
T19651EF4347A9840F12C6D4878B756689C3D3E84473AA7A24A3648D5C3B82509FBFA9D7
MD5 SHA1 SHA512 TLSH

Submit Download

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\D3DCompiler_47.dll
Size 4.5MB
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.ico

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\app.ico
Size 278KB
SHA256 dfcea1bea8a924252d507d0316d8cf38efc61cf1314e47dca3eb723f47d5fe43
MD5 084f9bc0136f779f82bea88b5c38a358
SHA1 64f210b7888e5474c3aabcb602d895d58929b451
SHA512 65bccb3e1d4849b61c68716831578300b20dcaf1cbc155512edbc6d73dccbaf6e5495d4f95d089ee496f8e080057b7097a628cc104fa8eaad8da866891d9e3eb
SSDEEP 192:uz/QWppKvrIXANuBox26FIeSyyEh9Y1kM12wngfi3TjOueN3/R/l:E/QWppKvrIXANuBc6gq3TjOuevl
TLSH
T1D25444E56118FF0ACA31CFBC08B186526C79BD17A923640777453BCD0A77ADB5232D92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\chrome_100_percent.pak
Size 163KB
SHA256 4474d496b4eb082073fb439133728eed72da35f4519505c1c246ef2b9552cf49
MD5 7bd1757ba953d8b304da1d6fb4fd7573
SHA1 4d5744d0ba3444405eeb7f43e74653f2ed3fd799
SHA512 12d7124511067f2cec4fc9f3a9022971867c540d9f01f6cc0b5dde834f106c065faf860bf7a421a836fceae9616221dfe97e8b1181f636576509cfb63f5bab5c
SSDEEP 3072:e4PisCv+/P9NebGz8LI1TwuLjQBHUP1L2o418Gb0+VRLf0ld0GY3cQ3ERVh2I:jYWFUbGz8LI1TnjQB05K18Gb0OV8ld0Q
TLSH
T120F3E1D7B7F0ED7DCA5B4AB797560071ECB30B2D0792124A5A8ED475252AB88D8C83C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\chrome_200_percent.pak
Size 252KB
SHA256 3e815b1223026c0bdfffcee62a58885e0ccd99d77f0b950778d109832e38e9cc
MD5 6a460ee2c4e796e53f9be9b050cca017
SHA1 52fb1eba7629f2896c6432969010f34f1903f8c2
SHA512 23ae8fdf5618582bd51b3690526efd135228f97649c6755e2d024b8048e214e4069f355fe4e7f09f82be45accccabf06dd6c065aecc6ed354de996f88a48ce03
SSDEEP 6144:rGQ+N6uSZQDQYakvyAkcjQB0ugx5GMRejnbdZnVE6Yoppx4:rQN6uS/fkvyAkcjK0a6edhVELoXx4
TLSH
T1FB44F1D773B8ED3DD9670AB3A21600F0FDB611290AB2525A569FDC393955EC888CD383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\icudtl.dat
Size 10.0MB
SHA256 5070de99fbd8a48378543511fb7a072f85bf36f94b4f4e1d420d54be1435d6f1
MD5 4171402e385f07007de57f45ff540e9a
SHA1 aab98edda310e6ddd3e4b71f95b6225c4defa7fc
SHA512 53e303895fa80944f7b0e0f64ab657b79bfe0d7c462b853ed06b556e42d78c639021c4c337743f18174614a1f74c805198ae868c52dfd8a2e270e4ce4a2880ff
SSDEEP 196608:rwPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2YDU:rswkpHiXUxY/iJ53IWhlVjEeI0U
TLSH
T1CEB63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\libEGL.dll
Size 503KB
SHA256 f75ea9af75b24bfd12ec7053cf9db2b7b53d2174955382c470a21dc75dd381ff
MD5 dc4afa3148dcd642f240ec869d387e5b
SHA1 291a2b59bba7ca8be336407b3cc1b10a254aeb61
SHA512 7e8ba6dfeb83d218e76693b0966db79aa13a7723fe2e1f91fd203bd9878184c8b57e11e6ddc2d59a1e22b5c8fefaabb1aab7815622a50b530f78c8ad4ca5ec78
SSDEEP 6144:crc4fsnH0sMclrRbnrJtHL1kbRQIPt7rccicQ+PDOIgxrkM8M9:crcUsDMEhnrP1vIPt7rccicQUO2C
TLSH
T120B49E15B3D84669E06AC5348B534642DA76B8860B65FADF03E092793F3BFE45B3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\libglesv2.dll
Size 7.7MB
SHA256 0fc59ac6f8bde0fb45764a88bab7d6cd4ac0885c166a41836016a00ff2836e00
MD5 4ab5b4817284d2ae03781a9c6b828eda
SHA1 97dcc29007164f84b792d10ea641218fe36ef8dc
SHA512 eee6c3ec800c5f60e89b70bb935f98fe1e731c58a56525001a54d57faae6caba3494445bc0fc8d153a18753408099b5016e3baf1a2f731e44dffccb620500cec
SSDEEP 98304:dB+3PUNOzpVYHl9SqK0PHus8NWC9BZEXYImyN:qfUgp0PHn8wCWXmyN
TLSH
T140867B03F69680D9D04DE2B4875B9227FA34B8850324B6CF279457152F67FE0AB7EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\locales\en-US.pak
Size 494KB
SHA256 3c99e588acc5ead62c1bd695cc851ccedc9ec27fc1cfd7657b56bb91fb6bba73
MD5 f8dc05885c6df5dcc56fef7cd2132fc8
SHA1 56fafb4da53d7197d52de6e38e21f68f55f2e4b5
SHA512 1108939b4cc23c0a32224b389bef8949c905814762b311204294d75680dd05620270c71e732931270b611aeac5669c3bdb9e3aeff0646667cc63c56b6b15698c
SSDEEP 6144:16y1qHLXyRnuWm9KSMP9e+QRV3faY7vzalKn5ehj1yng3Z/wRwf:31qHLXyRnxSMvQRV5f5AjEwf
TLSH
T1CCB43C1FF7441269069352627F0995B2FF32D06CB39112563CBD802C33B6B6A83B76E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\resources.pak
Size 5.6MB
SHA256 cafd58e840d8b4aeaf6cc87b56e63dd5889b7ffebff7e0e959d45066bc85caad
MD5 8a8bf409e675a154a0bbf8172e563ab4
SHA1 36b1b4441c708c0ac55113923329f0048cd5f9ab
SHA512 53be87c1ab6234a7da0ff1935c1e166931f670ac6d273842b67a9fa3024199615db31ecd1e04fbec49849109cd5736ef501bffe97d9cd4fa7232377c5e94fe71
SSDEEP 98304:Y/RTgs94POX7P8kARvlaLIPzXH9MnsRrwrC/ICGaZZJjoMzL9+CfLRneSmD0Pk:sr94WX7EDlZbNMsRkrCAGoMFnxCGk
TLSH
T1F14633D177E61E6FE50893B8C1B88371CE2D882635152105608CB229FD35A6FAFD25BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\resources\app.asar
Size 3.4MB
SHA256 e9ecb18bf8d5cff4fe438cd909f518e7bd8777035f6252f3b441f14d544c7db6
MD5 485651ed330db9e854e2410d8ff8b95e
SHA1 e47edc8b0fb25b452fe90f00f44a8ef5859a3de3
SHA512 c526f02f0b83322cde404e26f8d5c917e069a807b17f636630fd77d6358e50a46bd3e60db73e39af8d9e1a3483bc51c53604a78c538104c397cb4076525f7d32
SSDEEP 98304:yvkysaTSKMeiDmFhGd4l1pJERJB0zEOnA7:ytq901pJERJB0zM
TLSH
T1B5F59EE5725269B34FEB22EDE932550276B9C006B054607AFAACCECE15C4409B3B773D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

build_info.json

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\resources\build_info.json
Size 175B
SHA256 335699fad9ed6c434c4c1c8130cd86aeee35741b03f492ca6cf52016c4c74a23
MD5 788816e48a6bbcf1ae781e599ce5cad9
SHA1 cc0e25f16e0ed41dde2b36c6c6bf9d3c29c7fee1
SHA512 4be54c5cc78d5463262b8c4c75cf863fffdde93d7a3991088b1190d04bd7bf6ba3fdf67f3a261580534381a2d1488380df3ce99d2c081a630bc56652c720b3ee
TLSH
T128C012A39254253742F09BE68A4154255200ED8E45745D6E207B0504A6A19B05A41F04
MD5 SHA1 SHA512 TLSH

Submit Download

updater.node

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\updater.node
Size 4.2MB
SHA256 b783201f4f697026bc17d62519b3971cd691da3e29b8e4bdf4fc5e6d50d13a55
MD5 79c4656285115ac8bf8ccd42d43bb48f
SHA1 aaa2889ab9bc142748ee365696bd281062c8116a
SHA512 62a177ee70ce13b622b7f2758580112537df403c3b2862e0276a97ca987c4a3d900d79c41ce929d9a9a160a8965d705a0e2a2f1b7be3efe39704aec9237e37d2
SSDEEP 49152:/DxSWblN5Q9O3zC2hcLmmy4YQoOYibx7QvQ86/nQBa6KpT+cQnaJcGAQPkKrR29k:4WblN53qNxf+XBaFN7HJkQPd29RYis
TLSH
T1E8165B03FA9546AAC06EC178835B9637E772B8890720B7EB17D44A313E53FA11E7D358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\v8_context_snapshot.bin
Size 683KB
SHA256 9537f5ad5847faf38a7030e0688b2b77d1582d196c034a9f2d5f19038f11b813
MD5 d635b18dbc2a7b288603216c0c5b3fa8
SHA1 a6210b0bcf439eef14854797cb1f161acbd1014f
SHA512 e825955307c0668676186245ac77245c6a5499c45eafb8c11f0f67d10b13718086eb50933e37f42221719e6dd98c080ad3e3a9b4f1aaf521ac6a9818a5df3370
SSDEEP 6144:qqGRvt+yUQj/sFq2Vdk1p2VXy1fawkWe9YITbg1HoSFrUb6keXjxQOLL:qxMk1pX1y/We/Tb8HozbeTTX
TLSH
T182E46156A75FDF27CACE187D5EE59F453DB5B08EAF0B422B311803BCA43A2640A9530D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\vk_swiftshader.dll
Size 5.3MB
SHA256 f9ae7b5412283779b9db948cf2ec6ba531762a86065bcd1fa101314a9c4ee8f9
MD5 389713ca20d9b1bdd9bf79ab6fc1ca07
SHA1 c7b0ccf2285827ad94e6e2d77811a8cf81d57379
SHA512 eb5bc532b0f0beee6e1ee87ef989911e268bb8cb18a6d0473d2b8036847af3ef666776bea14a5085c602f8a77dfe465cbcda6b2ba601f2a424f16b2d558160f7
SSDEEP 49152:yYyu/q9DxTIB1vQwSd5MBtnGfilWeEZZKmna8NnzMgGzqSQ71WJjZOzXBRXmFzAM:yYyu/uPJSJwSWrlJsJR
TLSH
T17D463703F28A80D9F05DD579875F9622F672B8814B2276DF52A01F192E7BFE0A739701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9246\vulkan-1.dll
Size 910KB
SHA256 62fe2519a67136e7771e63aac310628c6d00877282290455c3cc9e9f3e1791f0
MD5 8247b859df1825211a35780bfa984277
SHA1 c06e1a426d96f2ebdf18da779e68d222fd5f0c3c
SHA512 85b5b93a21843059cb828d1b29a1b8381e456b69b26e428440af148f0ddfe9182330f94f150cb0b9d43d92b01781acf2f909c397468a5f36c614925a66a4126b
SSDEEP 24576:9dFNgyp/0pJBjx2E/Wa6ml6Z5WRDYsHm6g3P0zAk71zT:dNgCcpJB3Oa6ml6Z5WRDYsHm6g3P0zAW
TLSH
T137154B23A6948569D57AD034C9D28603C9B174822326B9CF02AC57087F6FFF47B7DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Update.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Update.exe.log
Size 1KB
SHA256 e96331392d474ca0fbc51036c7d55aa3a37aae6b074d50ebd106a277b0cb4097
MD5 6eb96c16eb677b6a8c1df381a0497a1a
SHA1 d4596baadc2d4bee89d57e1718ab30c0b7d563ec
SHA512 3d472d56ceb73a3df3f65eff6af088b3a81ab553153cbda925091500a6543cf83e84872f2bc81f218deddecd8f3c9868d784c2fe08ece95f915138becaecfb0b
TLSH
T1F0310F312271B0D88D133F53193C258563EF4358FA505F187519624FEA3A00B6F261F3
MD5 SHA1 SHA512 TLSH

Submit Download

RELEASES

Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
Size 81B
SHA256 fa473e03641a4420a3f5c64eafe7c5c7546340722f76e57ff132243d5af88e78
MD5 9444196639d3052bae418a26c5cd1e57
SHA1 c754be5c343cce0ffc614abe80a7c172b99496bf
SHA512 68e371ee9fe82ac172802f82f720007d99f52efe199531e6423991534ec3c0951f7ff1316f8d6da80c39be79baebcdb48ad42980771779bb9072185fb6b54229
TLSH
T148A012173091344C81D0E144400401DE57225129AD4B0300463D56414D6411DC14050B
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 1.5MB
SHA256 62bacfbf6b91eb28c5cfb820a07e347058aca620fd11cae98a6cad816cafe026
MD5 7e292a4b2b3b05ca951628156c95e725
SHA1 091427df1fd173cbd86a2e71d771bb3ec73c7ddf
SHA512 cad0d98f14ef8aba5ebee8ee4835e8cf94ec4619f2faae3d27bbe882856a529dd95253accab304a7b22e71abdc494a57e063fe9948d3b3ab0723d0de81b06d51
SSDEEP 24576:eBJkrlr7AiOlwOpJeYOdTNK9RgIM/aR9Gl7MRHg:eBJkAlwO/X9GlmA
TLSH
T1EB753911B7E88A2BE4AE57BAB071016547F3E5866376F78F6A4CA1781FD37804C02367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\discord\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\discord\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 59329c01a0684f8095cd3693529ff718ecbe6f4afa439ad75f4eb7e40e8a6455
MD5 81e394fc48b9672125a0f9824a7592bc
SHA1 2e7ce8930c628a92575b52a01662cb8cce3740bb
SHA512 1c22b3a639e80cf306a9563936d498f14d33a9133416d27dbd6fd05f6b47b0a5c9500fcba88c82f071492618a325839bbd0207afd13015dfaa9b8cba0200331d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\discord\Crashpad\settings.dat
Size 40B
SHA256 06c37a0325dd046935d2e4dfe2d1568db4e9fafc7eed6efc06c07a961279ae9f
MD5 9fc63506a36dc57274e908effd34ead6
SHA1 1cd406137bff7c96faf6d4d2e5f9c4869735d98f
SHA512 a05726abc3b5f07c117b38ba4c9e2dd1c3fec8630970a0639075a5d4f2528fdfd65471afc2dcd37405aab0f1e36850bb117b974d99da1af00501769c669bd7df
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\discord\Local State
Size 434B
SHA256 d11d974b15d06836a8d3de289960e756d8701db1d59a82b6d34c80ee8db1daca
MD5 ac3899765f5c5687b088ea070ec59c14
SHA1 4dbffc10cc2c6a83ad565eb320e4d3227a08c44b
SHA512 c361e4d301f7929c801f6804339e9ebefd7fb5693b8dd4b7bcf0c975b91e0948c3be4183554c3ee3ca52ab160b651f29639dd74f5e136b5bbedc582e40cb635f
TLSH
T173E0AB3428D05B91B35D1D936334B10A1E2460FB49105A21E5BC052621DAF707729DA8
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\discord\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Roaming\discord\Local Storage\leveldb\LOG
Size 245B
SHA256 78c0d690f766c82799da4978239641ccddfe4973e0f526bb45ac641023b6a86a
MD5 d53f45e4589a281f0a4de6d7f145bf6c
SHA1 805a285d6f723a4c4699b05b5afb10825a897df8
SHA512 d76e25c365511b4f4b94bcdaf0d7b7fb580d1d374d8df3e8c54a6f1626b33a704f28e066270a86496be4611ca82e59752663ed6cf4792ab4e3eec452d28740cc
TLSH
T13FD02E3200DEC25D024A80EB9639B70CCB30A0D06EDC32485EA2ED4C7059008EB2A4C3
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\discord\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\discord\Preferences
Size 93B
SHA256 529b6595a4727a6b2d6cc154ae51f426216c01fc7fda02de2460abfb3de118a4
MD5 322f01bb491180333c338526d93f115a
SHA1 554d5e43d5e46774b8f2a6b3682243a289927754
SHA512 69f8e980f44b1465cee8c0485598fa00be163db0fe88598e45ab2f817f9bea36a2b70dbb9d25d5214174ea9c198b9641bb3d5a86c18b1a4ea4493c00e2e95eb2
TLSH
T103B01253B810A0324B1B09E5000BC94F2CBE00340E475A0510D4F39D492DD4D088702B
MD5 SHA1 SHA512 TLSH

Submit Download

7_22_2026__11_15_41_AM_GMT_1-0-events.log

Path C:\Users\Admin\AppData\Roaming\discord\module_data\crashlogs\7_22_2026__11_15_41_AM_GMT_1-0-events.log
Size 416B
SHA256 02f9d67cc7c1d7af229cfbe90352a64993c95a55953f6e0e5159b7993640a6bf
MD5 0e1cafce1365e438bec4772bfa0150cf
SHA1 ffb63dff0174e5b1cd22102395c59b4adf15f097
SHA512 813bd2ce584c338b89c64ade8b6829502fe167524d1a303ecc4ae97d87e1c1f7a856f34647e8481f69ba1083cea3a03ffd3db64472b84c109ddefd585f459bd4
TLSH
T1E7E068E11EDD6E3F4380E7EA8D80834EC30411F4681C6AB0A293184C299B0D19F4CE02
MD5 SHA1 SHA512 TLSH

Submit Download

scope_v3.json

Path C:\Users\Admin\AppData\Roaming\discord\sentry\scope_v3.json
Size 3KB
SHA256 9bab8b1c4653e258bd8086bc8073442eb68cb21f6df59dd2c252aa3de73efc12
MD5 f40a06369d4e3cab8a18da5dbdfef118
SHA1 50e8343a0c46be3d35efae4e3d9e1731c7ea6735
SHA512 77dae8b02650bf3083112312a96ccc66b87506fff8e85d9cca08e662fa80c6b897f565e7f5eb0eae0419d6d78aa8d4febc62761482446756f7055c80655b04c3
TLSH
T1A28163723E2CECBA2FC9E6D864613D1ED3F821C255DC6C8214E2DF0C868D9A5645C12B
MD5 SHA1 SHA512 TLSH

Submit Download

Discord.lnk

Path C:\Users\Admin\Desktop\Discord.lnk
Size 2KB
SHA256 2ffb5eba27181481bd0351069915d5ebdc1be262fccf917b0e1f3e5cc6e1c264
MD5 4229cce54178c2438718e7d453b8c3f1
SHA1 dcab977a2a87da30bf1cf53012d46ce36aba9f51
SHA512 ee384043264f878669779b91d54d49dcccccebd55c320dab99cf13e930de31ea0ee1367465f68d5c461e43fac0d41eae986f315cd0d7c77825e91d030d4e611b
TLSH
T19C41CD02BAEA9B21D3FAAC3807EA1210CEB5B861FE519A4E0050524C4C60F01CD68F5F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/224-215-0x0000000005670000-0x0000000005690000-memory.dmp

Download

memory/756-200-0x0000000008500000-0x0000000008538000-memory.dmp

Download

memory/756-9-0x0000000000530000-0x00000000006BA000-memory.dmp

Download

memory/756-198-0x0000000005760000-0x0000000005768000-memory.dmp

Download

memory/756-201-0x00000000057C0000-0x00000000057CE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads