5db36b87a646986d7de3621dfd17afda210e1dec7277de4b4d9d1fe60d8800d7

Analysis

user interaction
yes
max time kernel
120s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 06:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DiscordSetup.exe
Size 116.4MB
Sample260723-g3mjmseq3t
SHA256 5db36b87a646986d7de3621dfd17afda210e1dec7277de4b4d9d1fe60d8800d7
MD5 90ff39a02e0130e1b20d3bbcf8a0e06f
SHA1 d7cecbdffd65280d64a0a92934d133d0a8e81869
SHA512 2e7e2398a92b31d2f88eb8d190e3a56663f6f253aaf4735b434ccbc7a5a4b616a9db7ce54a5a99926e183919ede638f5f401ebe28a1838b5b5336dd2c3ddbd70
SSDEEP 1572864:kFTQIdWBKeeaTHjBDELwfclircf/Cb06NEpdU4Pl+WNBZgmJDCmtJ6I9OozgjQ6w:kFTQIdUtHG+4kIZfz00OoJkxF42C
TLSH
T11E4833B2F921B3BBE113CEBE62F142F44E177D71A51E8D10B24AB7421731E578942D8A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Discord = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\Update.exe\" --processStart Discord.exe --process-start-args \"--start-inactive\""	reg.exe

Executes dropped EXE 12 IoCs

pid	Process
2524	Update.exe
2852	Discord.exe
3068	Discord.exe
4452	Update.exe
2500	Discord.exe
5712	Discord.exe
2532	Update.exe
2004	Discord.exe
4600	Discord.exe
1772	Discord.exe
6056	Discord.exe
5920	Discord.exe

Loads dropped DLL 12 IoCs

pid	Process
2500	Discord.exe
2500	Discord.exe
2500	Discord.exe
2500	Discord.exe
2500	Discord.exe
1772	Discord.exe
1772	Discord.exe
1772	Discord.exe
1772	Discord.exe
1772	Discord.exe
2004	Discord.exe
5920	Discord.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DiscordSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe

Checks processor information in registry 2 TTPs 48 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Discord.exe

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Discord	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Discord	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Discord\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9248\\Discord.exe\" --url -- \"%1\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Discord\ = "URL:Discord Protocol"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Discord	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Discord\ = "URL:Discord Protocol"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Discord\URL Protocol	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Discord\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9248\\Discord.exe\",-1"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Discord\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9248\\Discord.exe\" --url -- \"%1\""	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Discord	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Discord\URL Protocol	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Discord\shell	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Discord\shell\open	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Discord	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Discord\DefaultIcon	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Discord\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9248\\Discord.exe\",-1"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Discord\shell\open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Discord\DefaultIcon	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Discord\shell\open\command	reg.exe

Modifies registry key 1 TTPs 10 IoCs

Modify Registry

T1112

pid	Process
1868	reg.exe
4160	reg.exe
2624	reg.exe
4848	reg.exe
3780	reg.exe
1460	reg.exe
5300	reg.exe
4576	reg.exe
4184	reg.exe
5868	reg.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2852	Discord.exe
Token: SeCreatePagefilePrivilege	2852	Discord.exe
Token: SeShutdownPrivilege	2004	Discord.exe
Token: SeCreatePagefilePrivilege	2004	Discord.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2524	Update.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2524	2924	DiscordSetup.exe	88
PID 2524 wrote to memory of 2852	2524	Update.exe	89
PID 2852 wrote to memory of 3068	2852	Discord.exe	90
PID 2852 wrote to memory of 4452	2852	Discord.exe	91
PID 2852 wrote to memory of 2500	2852	Discord.exe	92
PID 2852 wrote to memory of 2500	2852	Discord.exe	92
PID 2852 wrote to memory of 5712	2852	Discord.exe	93
PID 2852 wrote to memory of 4576	2852	Discord.exe	94
PID 2852 wrote to memory of 4184	2852	Discord.exe	96
PID 2852 wrote to memory of 5868	2852	Discord.exe	98
PID 2852 wrote to memory of 2624	2852	Discord.exe	100
PID 2852 wrote to memory of 4848	2852	Discord.exe	102
PID 2852 wrote to memory of 3780	2852	Discord.exe	104
PID 2532 wrote to memory of 2004	2532	Update.exe	109
PID 2004 wrote to memory of 4600	2004	Discord.exe	110
PID 2004 wrote to memory of 1772	2004	Discord.exe	111
PID 2004 wrote to memory of 1772	2004	Discord.exe	111
PID 2004 wrote to memory of 6056	2004	Discord.exe	112
PID 2004 wrote to memory of 1460	2004	Discord.exe	113
PID 2004 wrote to memory of 5920	2004	Discord.exe	115
PID 2004 wrote to memory of 1868	2004	Discord.exe	116
PID 2004 wrote to memory of 5300	2004	Discord.exe	118
PID 2004 wrote to memory of 4160	2004	Discord.exe	120

C:\Users\Admin\AppData\Local\Temp\DiscordSetup.exe
"C:\Users\Admin\AppData\Local\Temp\DiscordSetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe" --squirrel-install 1.0.9248
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2852
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe
      C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9248 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=37.6.0 --initial-client-data=0x4a4,0x4a8,0x4ac,0x4a0,0x4b0,0x7ff783e2a074,0x7ff783e2a080,0x7ff783e2a090
      4⤵
      Executes dropped EXE
      PID:3068
  - - C:\Users\Admin\AppData\Local\Discord\Update.exe
      C:\Users\Admin\AppData\Local\Discord\Update.exe --createShortcut Discord.exe --setupIcon C:\Users\Admin\AppData\Local\Discord\app.ico
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4452
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1868,i,13289714807890913515,6227000474781258713,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1864 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2500
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=1868,i,13289714807890913515,6227000474781258713,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:11
      4⤵
      Executes dropped EXE
      PID:5712
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v Discord /f
      4⤵
      Modifies registry key
      PID:4576
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "\"C:\Users\Admin\AppData\Local\Discord\Update.exe\" --processStart Discord.exe --process-start-args \"--start-inactive\"" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:4184
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:5868
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:2624
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe\",-1" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:4848
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe\" --url -- \"%1\"" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:3780

C:\Users\Admin\AppData\Local\Discord\Update.exe
"C:\Users\Admin\AppData\Local\Discord\Update.exe" --processStart Discord.exe --process-start-args "--start-inactive"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe
  "C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe" --start-inactive
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe
    C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9248 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=37.6.0 --initial-client-data=0x4a4,0x4a8,0x4ac,0x478,0x4b0,0x7ff783e2a074,0x7ff783e2a080,0x7ff783e2a090
    3⤵
    - Executes dropped EXE
    PID:4600
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1808,i,17757389529830547726,4286308752757969845,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1804 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1772
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1808,i,17757389529830547726,4286308752757969845,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:11
    3⤵
    - Executes dropped EXE
    PID:6056
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:1460
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1784787011568805 --launch-time-ticks=626478817 --field-trial-handle=1808,i,17757389529830547726,4286308752757969845,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2812 --splash-media-format=webm /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5920
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:1868
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe\",-1" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:5300
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\Discord.exe\" --url -- \"%1\"" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:4160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SquirrelSetup.log

Path C:\Users\Admin\AppData\Local\Discord\SquirrelSetup.log
Size 4KB
SHA256 f0f522c5d4be2608d62e61df55ce54994a99a84a67ed95e2da29d1efa4771432
MD5 c4b40c7da6c7dda1937e3460f0b43c2e
SHA1 a48ec159c833f7f3ddada2ec8c14ecafbb1e0c44
SHA512 55e23d287a07ce6d1fa9ebd0d1420cf0a65f8919d69a28e0052a71ee244a5ffef8cb188c1a04c0d797802b9c00582156e562adedd4dc102e5e36423ce14d7c3a
SSDEEP 96:UT9muGufo9oQuGuKqO+C4uKWO+C4uK2rO+C4uKpO+CZLu38:U9O+CpO+CBrO+C8O+C1
TLSH
T1B781F0C307EA841E48C691978B79758AC2D3E94873112B54A3744A0D7F83146FAE7ECF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.ico

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\app.ico
Size 278KB
SHA256 dfcea1bea8a924252d507d0316d8cf38efc61cf1314e47dca3eb723f47d5fe43
MD5 084f9bc0136f779f82bea88b5c38a358
SHA1 64f210b7888e5474c3aabcb602d895d58929b451
SHA512 65bccb3e1d4849b61c68716831578300b20dcaf1cbc155512edbc6d73dccbaf6e5495d4f95d089ee496f8e080057b7097a628cc104fa8eaad8da866891d9e3eb
SSDEEP 192:uz/QWppKvrIXANuBox26FIeSyyEh9Y1kM12wngfi3TjOueN3/R/l:E/QWppKvrIXANuBc6gq3TjOuevl
TLSH
T1D25444E56118FF0ACA31CFBC08B186526C79BD17A923640777453BCD0A77ADB5232D92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\chrome_100_percent.pak
Size 163KB
SHA256 4474d496b4eb082073fb439133728eed72da35f4519505c1c246ef2b9552cf49
MD5 7bd1757ba953d8b304da1d6fb4fd7573
SHA1 4d5744d0ba3444405eeb7f43e74653f2ed3fd799
SHA512 12d7124511067f2cec4fc9f3a9022971867c540d9f01f6cc0b5dde834f106c065faf860bf7a421a836fceae9616221dfe97e8b1181f636576509cfb63f5bab5c
SSDEEP 3072:e4PisCv+/P9NebGz8LI1TwuLjQBHUP1L2o418Gb0+VRLf0ld0GY3cQ3ERVh2I:jYWFUbGz8LI1TnjQB05K18Gb0OV8ld0Q
TLSH
T120F3E1D7B7F0ED7DCA5B4AB797560071ECB30B2D0792124A5A8ED475252AB88D8C83C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\chrome_200_percent.pak
Size 252KB
SHA256 3e815b1223026c0bdfffcee62a58885e0ccd99d77f0b950778d109832e38e9cc
MD5 6a460ee2c4e796e53f9be9b050cca017
SHA1 52fb1eba7629f2896c6432969010f34f1903f8c2
SHA512 23ae8fdf5618582bd51b3690526efd135228f97649c6755e2d024b8048e214e4069f355fe4e7f09f82be45accccabf06dd6c065aecc6ed354de996f88a48ce03
SSDEEP 6144:rGQ+N6uSZQDQYakvyAkcjQB0ugx5GMRejnbdZnVE6Yoppx4:rQN6uS/fkvyAkcjK0a6edhVELoXx4
TLSH
T1FB44F1D773B8ED3DD9670AB3A21600F0FDB611290AB2525A569FDC393955EC888CD383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\d3dcompiler_47.dll
Size 4.5MB
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\icudtl.dat
Size 10.0MB
SHA256 5070de99fbd8a48378543511fb7a072f85bf36f94b4f4e1d420d54be1435d6f1
MD5 4171402e385f07007de57f45ff540e9a
SHA1 aab98edda310e6ddd3e4b71f95b6225c4defa7fc
SHA512 53e303895fa80944f7b0e0f64ab657b79bfe0d7c462b853ed06b556e42d78c639021c4c337743f18174614a1f74c805198ae868c52dfd8a2e270e4ce4a2880ff
SSDEEP 196608:rwPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2YDU:rswkpHiXUxY/iJ53IWhlVjEeI0U
TLSH
T1CEB63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libegl.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\libegl.dll
Size 503KB
SHA256 94f74802fd47b0e125e7375485e6a063b08bb70c702bd4dc5cd6938efb4319f4
MD5 43994b2c056c2a270fe57c6f23a84359
SHA1 4e0b70b84d650777d0a59e2209d656ad81b2b21e
SHA512 03974e3d5e3cb74f27698e62ee59598d831f0a4f5bbaeb4958cbde7ad79e54676c139bcd9c9afa6ac01e0685a0dd2d3297ff52372ae3cfd1a474d5e59bac0732
SSDEEP 6144:5rc4fsnH0sMclrRbnrJtHL1kbRQIPt7rccicQ+PDDIgxrkM8U:5rcUsDMEhnrP1vIPt7rccicQUD2U
TLSH
T17BB49E15B3D84669E06AC5348B534642DA76B8860B65FADF03E092793F3BFE45B3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\libglesv2.dll
Size 7.7MB
SHA256 569f80ffdf8d4ee24a6e50d507f22c9b5461aea8e606ef250d19e58c5f0e7f19
MD5 e2bbd4389cb8d32f72c4248e091147a9
SHA1 95ca04ac8a06538c0378b663efade14e2c08fc29
SHA512 cc3032cc7c583b2dab947892576facc4b0dfab603558a4c94435954c8d44c8541e67608fd6ebeaf78237896d3f82c6aa3c2c086c315ed7eb70257c642d75cfb7
SSDEEP 98304:MB+3PUNOzpVYHl9SqK0PHus8NWC9BZEXYAYt:ZfUgp0PHn8wCWvYt
TLSH
T152867B03F69680D9D04DE2B4875B9227FA34B8850324B6CF279457152F67FE0AB7EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\locales\en-US.pak
Size 494KB
SHA256 3c99e588acc5ead62c1bd695cc851ccedc9ec27fc1cfd7657b56bb91fb6bba73
MD5 f8dc05885c6df5dcc56fef7cd2132fc8
SHA1 56fafb4da53d7197d52de6e38e21f68f55f2e4b5
SHA512 1108939b4cc23c0a32224b389bef8949c905814762b311204294d75680dd05620270c71e732931270b611aeac5669c3bdb9e3aeff0646667cc63c56b6b15698c
SSDEEP 6144:16y1qHLXyRnuWm9KSMP9e+QRV3faY7vzalKn5ehj1yng3Z/wRwf:31qHLXyRnxSMvQRV5f5AjEwf
TLSH
T1CCB43C1FF7441269069352627F0995B2FF32D06CB39112563CBD802C33B6B6A83B76E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\resources.pak
Size 5.6MB
SHA256 cafd58e840d8b4aeaf6cc87b56e63dd5889b7ffebff7e0e959d45066bc85caad
MD5 8a8bf409e675a154a0bbf8172e563ab4
SHA1 36b1b4441c708c0ac55113923329f0048cd5f9ab
SHA512 53be87c1ab6234a7da0ff1935c1e166931f670ac6d273842b67a9fa3024199615db31ecd1e04fbec49849109cd5736ef501bffe97d9cd4fa7232377c5e94fe71
SSDEEP 98304:Y/RTgs94POX7P8kARvlaLIPzXH9MnsRrwrC/ICGaZZJjoMzL9+CfLRneSmD0Pk:sr94WX7EDlZbNMsRkrCAGoMFnxCGk
TLSH
T1F14633D177E61E6FE50893B8C1B88371CE2D882635152105608CB229FD35A6FAFD25BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\resources\app.asar
Size 3.4MB
SHA256 e9ecb18bf8d5cff4fe438cd909f518e7bd8777035f6252f3b441f14d544c7db6
MD5 485651ed330db9e854e2410d8ff8b95e
SHA1 e47edc8b0fb25b452fe90f00f44a8ef5859a3de3
SHA512 c526f02f0b83322cde404e26f8d5c917e069a807b17f636630fd77d6358e50a46bd3e60db73e39af8d9e1a3483bc51c53604a78c538104c397cb4076525f7d32
SSDEEP 98304:yvkysaTSKMeiDmFhGd4l1pJERJB0zEOnA7:ytq901pJERJB0zM
TLSH
T1B5F59EE5725269B34FEB22EDE932550276B9C006B054607AFAACCECE15C4409B3B773D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

build_info.json

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\resources\build_info.json
Size 175B
SHA256 ec492ae083528322c3ec8ef0d37c1bee885cb8a54054cd5346e2da0273df9e73
MD5 d54971bdde56e4185cb3bec2d8ff85d7
SHA1 5033ea13fe8a916a79112b8aa1b054ece3842607
SHA512 a7e90f1845faf28294b5ab54d280242cf8ebe9c117fbd1abc950a34a5b1651994ff1c8ecdac0bd930a090b300a6b9c730bf5c2a8983532ed922263a14b608439
TLSH
T122C012535704213703F0CBF5928590236108DE8F0277497E207F16089AA19651542E59
MD5 SHA1 SHA512 TLSH

Submit Download

updater.node

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\updater.node
Size 4.2MB
SHA256 0484f36ed4684f93e4a328b5d7af02c7b2c4d79732b1ed17ab4723070306e514
MD5 54b18acdecfe34c561430f66c282a365
SHA1 7dfef866814bf8f0531b80ceb38e46ae264cb58b
SHA512 7fcdceab48e60bd2149872d19e5fe85c95068180520170ee340fcd973854a5a36b830b7c24d13b19111b6e61e28bc31c3b49cf9d98ed722a4e74a3ab8766d8aa
SSDEEP 49152:TDxoWb1N5QtO3vCBhxZmmy4wQgOeD2x7QbQ86/nQBa6KpT+cQnaJcGAQPkYr729o:OWb1N5HONxo1XBaFN7HJkQ5H29RYY6
TLSH
T173165B03FA9546AAC06EC178835B9637E772B8890720B7EB17D44A313E53FA11E7D358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\v8_context_snapshot.bin
Size 683KB
SHA256 9537f5ad5847faf38a7030e0688b2b77d1582d196c034a9f2d5f19038f11b813
MD5 d635b18dbc2a7b288603216c0c5b3fa8
SHA1 a6210b0bcf439eef14854797cb1f161acbd1014f
SHA512 e825955307c0668676186245ac77245c6a5499c45eafb8c11f0f67d10b13718086eb50933e37f42221719e6dd98c080ad3e3a9b4f1aaf521ac6a9818a5df3370
SSDEEP 6144:qqGRvt+yUQj/sFq2Vdk1p2VXy1fawkWe9YITbg1HoSFrUb6keXjxQOLL:qxMk1pX1y/We/Tb8HozbeTTX
TLSH
T182E46156A75FDF27CACE187D5EE59F453DB5B08EAF0B422B311803BCA43A2640A9530D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\vk_swiftshader.dll
Size 5.3MB
SHA256 9f806a17ee22fe161ff63ee12199e56189ad083ac9352edea7f5ceea825fc436
MD5 824ede9b9522984979a7f9d0b9e0acc7
SHA1 9ee26f86eeddfb4b0adbae9d9e71b1ba97987f1d
SHA512 d2defcfed12acca2ffa419454a4231900806da08c836e4c48b20c65752bba4b516f6f1c6f79419316a66027ee87c4d66de7508fc86db76fd9c8391f5f1578a54
SSDEEP 49152:+Yyu/q9DxTIB1vQwSd5MBtnGfilWeEZZKmna8NnzMgGzqSQ71WJjZOzXBRXmFzAK:+Yyu/uPJSJwSWrlzsJ5
TLSH
T1DF463703F28A80D9F05DD579875F9622F672B8814B2276DF52A01F192E7BFE0A739701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9248\vulkan-1.dll
Size 910KB
SHA256 81b70a1a96fb3faf37868f0c0bb34cf92e3207630aa3de8e73fe09ac4e294923
MD5 180851c419d9580f780b8ce9ec515efe
SHA1 b65cc5c5e57d2cf7fae42f2ebd8f61e204a1c813
SHA512 bba763bfb73068a262b903d1ce11d68b3558cb37c07abcac13fb87821093c58c514924a8028dca95d42550d763408c48a21f497f1fad06c13b4061075506c8a9
SSDEEP 24576:8dFNgyp/0pJBjx2E/Wa6ml6Z5WRDYsHm6g3P0zAk71MW:GNgCcpJB3Oa6ml6Z5WRDYsHm6g3P0zA6
TLSH
T14F154A23A6948569D57AD034C9D28603C9B174822326B9CF02AC57087F6FFF47B7DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RELEASES

Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
Size 81B
SHA256 3997332f8a2bff8f19b55302551169946b2675fa0717f5621ae877370fdd7be6
MD5 fb04a29f0d0c807b8215705aec4cd6da
SHA1 f9e38d2aa70550ce2a2f9dde5fd978d866434b26
SHA512 c08e20116be3d53538a9e9224ff1a1194290fea9fc2ada2a3c09533a215b3f3d39affed229246aa6044cdb235a8487ac31389ae7d00ffbefdd3218c4ea578cf6
TLSH
T17AA01237C054A09C8CE9D1851810519146030190921839A0984982150C690075294929
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 1.5MB
SHA256 42ca4b766b957346631c88eac22b6fc7450ec6ec61320cf06a1a23714f434c5d
MD5 24ed459a46b6e6981a2743cfeba844c0
SHA1 84dd7af1e9923fbd1a56a40b4f9a7d283f60b500
SHA512 8e4baf77543a3491a6dd6571a57e60f447370075d8de05e6232b4573a7c3f072f707a9af3aab02ad1f9ecb8f1eb64295fddada7272b00c0d330e7ad359e3120d
SSDEEP 24576:sBJkrlr7AiOlwOpJeYOdTNK9RgIM/aR9Gl7MRHE:sBJkAlwO/X9Glmk
TLSH
T1B5753911B7E88A2BE4AE57BAB071016547F3E5866376F78F6A4CA1781FD37804C02367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Discord.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Discord Inc\Discord.lnk
Size 2KB
SHA256 240e6d814448e20698fb1d8ddb6572435eb676829eca9d0fe536552007eb27d3
MD5 cf910a3ad25136824721a1271ac9e853
SHA1 19e77357770a9cef616a0cfbb344ba3981f4bf65
SHA512 88a552ee2dcc1298cfb3556c87d64346a8bf341ec30075d1302c4fe0213b7930c1c34e80540ba591ad480d84ecc1aff0c33a748150dee7a60657ba5cd6e5059c
TLSH
T1E241AB0666EA9F10E3FA8C7555EB2221DAB6BC20FE259B4E044082481C75F01ED68F6F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\discord\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 996a0433d1b50ef550b4a6cbdb995dd358656685d1095b6775ea4749e3e8e1a0
MD5 23dd34b911b6fc0699ace33b6e088b8f
SHA1 a90cd8dca2acc5fcbe7c513fd29ae440b193cb24
SHA512 52a80e276640e2cb8b443f549a264457267390b25ab1134ce9ac41e554ace197dcc12de3a6090df2df3e750ae9e4ead0f81823663dbcb86568bb8a1a32e994f2
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\discord\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\discord\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 731577e1c35265dd78ffa6cee301a1f6eb36ea1e874b13d5cecef84563073dff
MD5 b19bb5c43d0c062e6e593f3ef3e0c152
SHA1 b525a966d46ff49f8b69b450507da857caa6e445
SHA512 a423ae5029463d0d9f743bff0c72ebb9498c48cfda5123d4afd5262b6e8124a857627041e06be82d9698d18fe4b890b2bbee9b7f203942b3d4f33eab10f8c371
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\discord\Crashpad\settings.dat
Size 40B
SHA256 fd6d824ffe6a80466bb088bddea315ae2d0470f9d2fac8cb11314a779452f82d
MD5 95a434ad8ab1d1fbf233cd8583691919
SHA1 89735dc0ddf6c1634025e249971187fc42597dae
SHA512 2342b578362150f8bf350862d3b34168b5d5b2404acf5148c339e6c9325549e8cbc8c152bc1254014d70479b86189216c9a10851bb46ceafca98b595b7f980d8
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\discord\Local State
Size 434B
SHA256 67daa6048d01c0880d66b579f3f605e81c095c37b747a40907081017b7e0e2c3
MD5 9798eb4c9847f6c03f5e2c9bd5250140
SHA1 14453cfe35e09968d72416428c176aa073974cd3
SHA512 ff2c725838022e946095507d5f4441e4a140938818acb608bb8528baddbe306fdf10607d6509328b6def5f92c4516172dd3970253d1aba1407a9bf2353821d2a
TLSH
T1BCE0F1716C2CBFF876DC667410E9F6290CF52E738BA5E619B24E456782B78484744E30
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\discord\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Roaming\discord\Local Storage\leveldb\LOG
Size 247B
SHA256 d9b405f01b95f85f13c295525ca11c9d05d82393f2d597b033ad224294eefab1
MD5 801b556c6dd1506cd72a8229c64d8201
SHA1 35706c23fc8c510390f5188386fd8a564211b597
SHA512 927df703254f8eb5eb145555325f0decada1833992b7764a1a37040223c1d79a7b5d8832eb88fb38d49203761b51e5006843512e90b67247c9c1f728e2424fff
TLSH
T161D02B3140CD829D524980978A71F30DC730A0816B9D27888E44F69C305A04D97208C3
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\discord\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\discord\Preferences
Size 93B
SHA256 529b6595a4727a6b2d6cc154ae51f426216c01fc7fda02de2460abfb3de118a4
MD5 322f01bb491180333c338526d93f115a
SHA1 554d5e43d5e46774b8f2a6b3682243a289927754
SHA512 69f8e980f44b1465cee8c0485598fa00be163db0fe88598e45ab2f817f9bea36a2b70dbb9d25d5214174ea9c198b9641bb3d5a86c18b1a4ea4493c00e2e95eb2
TLSH
T103B01253B810A0324B1B09E5000BC94F2CBE00340E475A0510D4F39D492DD4D088702B
MD5 SHA1 SHA512 TLSH

Submit Download

7_23_2026__7_20_34_AM_GMT_1-0-events.log

Path C:\Users\Admin\AppData\Roaming\discord\module_data\crashlogs\7_23_2026__7_20_34_AM_GMT_1-0-events.log
Size 413B
SHA256 3d5ff77bfca5284c828c5e4702b45a8f87d1f8bf847f26aa182bf9b1ab300aad
MD5 432981433d11199bd2ad0a6980d29af3
SHA1 f12834fd1f17d1d47f2c37c23cef6105fdf482f4
SHA512 b7787dda0ce8e3970b23c7b81dbca7b3003d251263dcc41b42b514860689da63dfb4b8f55ce0287a78ef590c5dc6f953999f914824027a8a18d2600d4c61264f
TLSH
T19FE068A20ECEA93F47E1D7E9C588804FD30820E5050B17F0D287154C1B9B082D84DE13
MD5 SHA1 SHA512 TLSH

Submit Download

scope_v3.json

Path C:\Users\Admin\AppData\Roaming\discord\sentry\scope_v3.json
Size 3KB
SHA256 af16c831d9dacefa6a45ec7d1f2892523973a7028cdfd485a956c094f4422043
MD5 20bf83a6d39a6004967a812145f7ee3f
SHA1 c96c39ede49deff54d2363890df98383ae48c857
SHA512 3a4b253f992bcc897948b3a640f8bbf965c2f61f0966183fc358cad80a5827780d687189fc94d8ec02d7ed6a2be5fe85e7a575dab1d1a6309006a0842b78c38c
TLSH
T1756132712E2C5DBE2F95F6996492394FD7B865C2419A9C8308E5EF0C87CE999A00C13F
MD5 SHA1 SHA512 TLSH

Submit Download

Discord.lnk

Path C:\Users\Admin\Desktop\Discord.lnk
Size 2KB
SHA256 36cc75946796e559ecf038be778f83428bb0beddaceec38315ad73da473ba73d
MD5 a144986d672c51f1c4c80a0090cbca1c
SHA1 1f841310eee452cd3b347490f5513d7ae835f859
SHA512 f367cbc728b3028fc20be3cc8cbc0095d4412c63cf47a5b7fc9491fed721557aeaaf85867c31e45bad2cdf62203ffa2f8ffd4b90e55c8462c382df8c05912694
TLSH
T120419D0267E68B10E3FA9C7956EB2211DA79B825FE25DB4E045182081C71F01DD28F6F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2524-11-0x0000000000DF0000-0x0000000000F7A000-memory.dmp

Download

memory/2524-192-0x0000000009830000-0x000000000983E000-memory.dmp

Download

memory/2524-191-0x0000000009850000-0x000000000988E000-memory.dmp

Download

memory/2524-190-0x0000000008FB0000-0x0000000008FB8000-memory.dmp

Download

memory/4452-227-0x0000000005960000-0x0000000005980000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads