67e096ccf1a94c0d11033bb248490e5bd90b26e776c942d47d5d41b05bb6b83c

Analysis

user interaction
yes
max time kernel
91s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
discord-quest-helper-Windows-x64-0.9.3-setup.msi
Size 6.6MB
Sample260804-tkxywathph
SHA256 67e096ccf1a94c0d11033bb248490e5bd90b26e776c942d47d5d41b05bb6b83c
MD5 7e02177094b7b4d44a86934856707521
SHA1 bb68e5baa41d41474aba696e73de2439804feaff
SHA512 404f968cc4b9e9ed60d7f09d17b48982bda8206878cf8334335d824644254d5a51de062a2e42564d176faf5daf488425fb1b0042531e127dda0be01ac39dfb1e
SSDEEP 196608:NnwhAkMd5/vrw/OlcDA5cEeaEreOGZC9Nkdy:VW2JlcM5zdjPo9o
TLSH
T1F266334BBE91DA31C6A24D76883AABB39379FC100795B4436AD8354DDDF12C40EF1AD2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4040	discord-quest-helper.exe
1888	svc_01f883f6.exe
2220	overwatch.exe

Loads dropped DLL 1 IoCs

pid	Process
3368	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svc_01f883f6.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
105	discord.com
107	discord.com
118	discord.com

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
3196	GameBarPresenceWriter.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Discord Quest Helper\discord-cdp-launcher-sidecar.exe	msiexec.exe
File created	C:\Program Files\Discord Quest Helper\discord-quest-helper.exe	msiexec.exe
File created	C:\Program Files\Discord Quest Helper\Uninstall Discord Quest Helper.lnk	msiexec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI385C.tmp	msiexec.exe
File created	C:\Windows\Installer\e593716.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5773975F-E709-491D-8342-2645166EE723}	msiexec.exe
File created	C:\Windows\Installer\{5773975F-E709-491D-8342-2645166EE723}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{5773975F-E709-491D-8342-2645166EE723}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e593714.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e593714.msi	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5020	msiexec.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1244	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee0681d78f5363a20000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ee0681d70000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ee0681d7000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aee0681d7000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dee0681d7000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303333111642561"	msedgewebview2.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 26 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\99C10AB36CABCAE57AFCA3685E77A849	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F5793775907ED1943824625461E67E32\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F5793775907ED1943824625461E67E32\ShortcutsFeature = "MainProgram"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F5793775907ED1943824625461E67E32	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F5793775907ED1943824625461E67E32\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F5793775907ED1943824625461E67E32\Version = "589827"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F5793775907ED1943824625461E67E32\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F5793775907ED1943824625461E67E32\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F5793775907ED1943824625461E67E32\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F5793775907ED1943824625461E67E32\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F5793775907ED1943824625461E67E32\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F5793775907ED1943824625461E67E32\ProductIcon = "C:\\Windows\\Installer\\{5773975F-E709-491D-8342-2645166EE723}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F5793775907ED1943824625461E67E32\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F5793775907ED1943824625461E67E32\SourceList\PackageName = "discord-quest-helper-Windows-x64-0.9.3-setup.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F5793775907ED1943824625461E67E32\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F5793775907ED1943824625461E67E32\Environment = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F5793775907ED1943824625461E67E32\PackageCode = "6C85DC53AFADCEF47B440D0EA79818C5"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F5793775907ED1943824625461E67E32\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F5793775907ED1943824625461E67E32\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\99C10AB36CABCAE57AFCA3685E77A849\F5793775907ED1943824625461E67E32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F5793775907ED1943824625461E67E32\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F5793775907ED1943824625461E67E32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F5793775907ED1943824625461E67E32\MainProgram	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F5793775907ED1943824625461E67E32\External	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F5793775907ED1943824625461E67E32\ProductName = "Discord Quest Helper"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F5793775907ED1943824625461E67E32\AuthorizedLUAApp = "0"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4508	msiexec.exe
4508	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4012	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5020	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5020	msiexec.exe
Token: SeSecurityPrivilege	4508	msiexec.exe
Token: SeCreateTokenPrivilege	5020	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5020	msiexec.exe
Token: SeLockMemoryPrivilege	5020	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5020	msiexec.exe
Token: SeMachineAccountPrivilege	5020	msiexec.exe
Token: SeTcbPrivilege	5020	msiexec.exe
Token: SeSecurityPrivilege	5020	msiexec.exe
Token: SeTakeOwnershipPrivilege	5020	msiexec.exe
Token: SeLoadDriverPrivilege	5020	msiexec.exe
Token: SeSystemProfilePrivilege	5020	msiexec.exe
Token: SeSystemtimePrivilege	5020	msiexec.exe
Token: SeProfSingleProcessPrivilege	5020	msiexec.exe
Token: SeIncBasePriorityPrivilege	5020	msiexec.exe
Token: SeCreatePagefilePrivilege	5020	msiexec.exe
Token: SeCreatePermanentPrivilege	5020	msiexec.exe
Token: SeBackupPrivilege	5020	msiexec.exe
Token: SeRestorePrivilege	5020	msiexec.exe
Token: SeShutdownPrivilege	5020	msiexec.exe
Token: SeDebugPrivilege	5020	msiexec.exe
Token: SeAuditPrivilege	5020	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5020	msiexec.exe
Token: SeChangeNotifyPrivilege	5020	msiexec.exe
Token: SeRemoteShutdownPrivilege	5020	msiexec.exe
Token: SeUndockPrivilege	5020	msiexec.exe
Token: SeSyncAgentPrivilege	5020	msiexec.exe
Token: SeEnableDelegationPrivilege	5020	msiexec.exe
Token: SeManageVolumePrivilege	5020	msiexec.exe
Token: SeImpersonatePrivilege	5020	msiexec.exe
Token: SeCreateGlobalPrivilege	5020	msiexec.exe
Token: SeCreateTokenPrivilege	5020	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5020	msiexec.exe
Token: SeLockMemoryPrivilege	5020	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5020	msiexec.exe
Token: SeMachineAccountPrivilege	5020	msiexec.exe
Token: SeTcbPrivilege	5020	msiexec.exe
Token: SeSecurityPrivilege	5020	msiexec.exe
Token: SeTakeOwnershipPrivilege	5020	msiexec.exe
Token: SeLoadDriverPrivilege	5020	msiexec.exe
Token: SeSystemProfilePrivilege	5020	msiexec.exe
Token: SeSystemtimePrivilege	5020	msiexec.exe
Token: SeProfSingleProcessPrivilege	5020	msiexec.exe
Token: SeIncBasePriorityPrivilege	5020	msiexec.exe
Token: SeCreatePagefilePrivilege	5020	msiexec.exe
Token: SeCreatePermanentPrivilege	5020	msiexec.exe
Token: SeBackupPrivilege	5020	msiexec.exe
Token: SeRestorePrivilege	5020	msiexec.exe
Token: SeShutdownPrivilege	5020	msiexec.exe
Token: SeDebugPrivilege	5020	msiexec.exe
Token: SeAuditPrivilege	5020	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5020	msiexec.exe
Token: SeChangeNotifyPrivilege	5020	msiexec.exe
Token: SeRemoteShutdownPrivilege	5020	msiexec.exe
Token: SeUndockPrivilege	5020	msiexec.exe
Token: SeSyncAgentPrivilege	5020	msiexec.exe
Token: SeEnableDelegationPrivilege	5020	msiexec.exe
Token: SeManageVolumePrivilege	5020	msiexec.exe
Token: SeImpersonatePrivilege	5020	msiexec.exe
Token: SeCreateGlobalPrivilege	5020	msiexec.exe
Token: SeCreateTokenPrivilege	5020	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5020	msiexec.exe
Token: SeLockMemoryPrivilege	5020	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
5020	msiexec.exe
5020	msiexec.exe
1888	svc_01f883f6.exe
2220	overwatch.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5296	OpenWith.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 3368	4508	msiexec.exe	94
PID 4508 wrote to memory of 3740	4508	msiexec.exe	104
PID 5020 wrote to memory of 4040	5020	msiexec.exe	110
PID 4040 wrote to memory of 1888	4040	discord-quest-helper.exe	111
PID 1888 wrote to memory of 4012	1888	svc_01f883f6.exe	112
PID 4012 wrote to memory of 3052	4012	msedgewebview2.exe	113
PID 4012 wrote to memory of 3516	4012	msedgewebview2.exe	115
PID 4012 wrote to memory of 3516	4012	msedgewebview2.exe	115
PID 4012 wrote to memory of 3516	4012	msedgewebview2.exe	115
PID 4012 wrote to memory of 2584	4012	msedgewebview2.exe	116
PID 4012 wrote to memory of 4532	4012	msedgewebview2.exe	117
PID 4012 wrote to memory of 4532	4012	msedgewebview2.exe	117
PID 4012 wrote to memory of 5580	4012	msedgewebview2.exe	119
PID 4012 wrote to memory of 5580	4012	msedgewebview2.exe	119
PID 4012 wrote to memory of 5580	4012	msedgewebview2.exe	119
PID 1888 wrote to memory of 1244	1888	svc_01f883f6.exe	129
PID 1244 wrote to memory of 2220	1244	cmd.exe	131

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\discord-quest-helper-Windows-x64-0.9.3-setup.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Program Files\Discord Quest Helper\discord-quest-helper.exe
  "C:\Program Files\Discord Quest Helper\discord-quest-helper.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4040
- - C:\Users\Admin\AppData\Local\Temp\svc_01f883f6.exe
    "C:\Users\Admin\AppData\Local\Temp\svc_01f883f6.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1888
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=svc_01f883f6.exe --webview-exe-version=0.9.3 --user-data-dir="C:\Users\Admin\AppData\Local\com.masterain.discord-quest-helper\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=1888.5064.8567379098872977660
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:4012
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.masterain.discord-quest-helper\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.masterain.discord-quest-helper\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7fff4991b078,0x7fff4991b084,0x7fff4991b090
        5⤵
        
        PID:3052
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.masterain.discord-quest-helper\EBWebView" --webview-exe-name=svc_01f883f6.exe --webview-exe-version=0.9.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1780,i,7230566105652961200,3273031415158430391,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1692 /prefetch:2
        5⤵
        
        PID:3516
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.masterain.discord-quest-helper\EBWebView" --webview-exe-name=svc_01f883f6.exe --webview-exe-version=0.9.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1356,i,7230566105652961200,3273031415158430391,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:3
        5⤵
        
        PID:2584
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.masterain.discord-quest-helper\EBWebView" --webview-exe-name=svc_01f883f6.exe --webview-exe-version=0.9.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2428,i,7230566105652961200,3273031415158430391,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:8
        5⤵
        
        PID:4532
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.masterain.discord-quest-helper\EBWebView" --webview-exe-name=svc_01f883f6.exe --webview-exe-version=0.9.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3716,i,7230566105652961200,3273031415158430391,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
        5⤵
        
        PID:5580
  - - C:\Windows\system32\cmd.exe
      "cmd" /C start "" C:\Users\Admin\Documents\DiscordQuestGames\overwatch.exe
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1244
    - - C:\Users\Admin\Documents\DiscordQuestGames\overwatch.exe
        
        C:\Users\Admin\Documents\DiscordQuestGames\overwatch.exe
        5⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        
        PID:2220

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2FEC3BA38829D08E624B6DC73F959CD3 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3368
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3740

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2384

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:3196

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
PID:5412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e593715.rbs

Path C:\Config.Msi\e593715.rbs
Size 10KB
SHA256 22e89629633b860df4eb402374299d34cc68c7a458daa4e016076c67b5d3548c
MD5 469179a103ac21d05554e49d29ef8d56
SHA1 085c304f0af6aad84c0a08b5363874d8808a9a1c
SHA512 a5bfe0a493d139c6f11317fd231822162fc25a43b6b60cbfd7b05491892e4ef58d47f0c0dcd80c7f989885ccf29cb22d5e70c3162d3a6cc170803bad737674bd
SSDEEP 192:LNXrhXFhx5erlcDgoGKgoBUCYv6mDDm+PmFHWm6i34fV6gipaAm5TEbkqI:LlrhXFhOlagGg6UCYNDa+OFhH34fV6Iz
TLSH
T177223143A601C7E2F9969734CB47272537B2D3C6A349A34B45CC61325E02B8D6E94AEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

discord-quest-helper.exe

Path C:\Program Files\Discord Quest Helper\discord-quest-helper.exe
Size 18.4MB
SHA256 4a2efe69dbee25f8c0f24e0efb2d01e66550c95e90098ee6c11f936b06ec7d01
MD5 7aa2c8d035935a3a89a8328cba13b28a
SHA1 6c5399d75a71eba037863d2cb48c27c7de57c536
SHA512 fb41506dd32f7662681584de511e4ab7cb416c73f83625e2407fa3b0831a31169f7daab86796f046822fb1ac054d417006b7c594e7e4154f13b2f27077296509
SSDEEP 196608:fSuPZ6wYQA5aF+T0N78kIJJyw5ts8xrqLS+7h9YY7eKAk:6bwYQA5aF+T0N78kCvdxrqL37hukeK1
TLSH
T12D17F960BA5B996CD19BC47483478A730A3130DB0B35B9FF548496382F79BF46F38269
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Discord Quest Helper.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Discord Quest Helper\Discord Quest Helper.lnk
Size 2KB
SHA256 ebcc0f8021624640115ab912f45dbe9e42f405b28f8ca6367a25248645d1f736
MD5 92709ceebe0b1b5919bf388a8151c101
SHA1 aef7fa3df75e66334eb0201227af30bbb7f5e48a
SHA512 8a11132818c2691d7100adc97c10386975701d5b0afd8978e43cd72fa43c24997831be3aa77a8f2e8d3512dc439ac3696036911813fcd2c8d2392a68f7f1673f
TLSH
T172416E3427E94A69F3715A305D755E51DB637802FE799F1F418941884CF4B00EE78F2A
MD5 SHA1 SHA512 TLSH

Submit Download

Discord Quest Helper.lnk~RFe593a40.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Discord Quest Helper\Discord Quest Helper.lnk~RFe593a40.TMP
Size 2KB
SHA256 4550770180e74f45848c198db7de62be3ccccccdd233604e3019d3f187d0754f
MD5 11e4c6ebe38ed1f3943078be28bf3813
SHA1 65362ca10d5902d6eec2767a36a4553d8b8d8b2a
SHA512 db31286b00d1456cd57a5946ac7ef326eff0e98a1f9088058c68c93b4d383bdf4ed3e37f8217e18177679099b3e1297d3bc2b4b331e91538b0781ebfaacb2b07
TLSH
T13B41783427EA0A69F3B15A30AD754F51DB63B802EE759F1F408941894CF4B00EE78F2A
MD5 SHA1 SHA512 TLSH

Submit Download

MSIED59.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIED59.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

326cf16e-7258-4968-80ba-bb74f0753bf1.tmp

Path C:\Users\Admin\AppData\Local\com.masterain.discord-quest-helper\EBWebView\326cf16e-7258-4968-80ba-bb74f0753bf1.tmp
Size 1KB
SHA256 ecaa8b46b36ffb50fd7e0e22fa1b44f3d175e8e3575966dd97b1694ebcdedb63
MD5 4a227f786636c65f4ddd32014cb48335
SHA1 dc74700012a72d3eae9855445ab18917489f19f0
SHA512 f4c683b72204a4c62d80e8537739a8aff6af19fe2b2bc5769c3e549891288862d781aad96fd973f5dcfdc8f5c056e8c74d413a28bd9194c52de564d308a50ee4
TLSH
T19831A976D8E03E723C81598671C63F872C21612AD2508FCCA1DD6B1802EB6DC5457C37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.masterain.discord-quest-helper\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f98b109749b998f7b8f73658c079d06029e0f72caa24cef218ffa3a6c7f4a734
MD5 bf1a1651ae952e855d4325a5b500108c
SHA1 250a16aefb7d87c96c1d6f797d87be626d60e403
SHA512 bd75d8e09bb47c9fbdfdcd3695a31c1c0f21af941b458e7210f25ad3b3ce9e64b315348ad9ab67d99acb61b5fd8486f14a099cb0dbdfd3d99994cdc2e25b39c6
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.masterain.discord-quest-helper\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 96f9d1fd254cbc648a079789a2ca37734bcea5e7719e55a79424ea16eba34d53
MD5 fa6704f2681f4423e4596b712a334adb
SHA1 2366c9e48b5cc8d17ca411a1380b2da2448ebc85
SHA512 2d21422d802b4690befcd6be456bf609c5060fab3b2fc6e8a57e5ceebd0c4d7375382bc46969fceb48c2a8824b679e9448bb2fa9758b62ba8d22da4a3571b11b
TLSH
T144D0121A7A420334C05026330493A1081400C52F40954200682DD62E1B440904902496
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.masterain.discord-quest-helper\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.masterain.discord-quest-helper\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 5477b72c6a9953c6358bfa0199e4aeb0e212ebc6561546725b28767ed3f5002a
MD5 c8de5835e1e237499469e18d72e93a09
SHA1 37aaa4aa2405baa2955203613e7235432a52b13c
SHA512 32467b8ea04671f1c63f21da295814bfe2998ac96fa7f0f96ad2c6842c353f94c5bf689db83fb6986bd97fec0f248f37e4bb1700d2e586978cec10898263a2a0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.masterain.discord-quest-helper\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 5de7e9b5b4a6ec3f0bc63461beb317cf55a3e88a7248b98fc0c2f1dd60bbac88
MD5 a76d1af64924d863999d1a1dacc00ea1
SHA1 04a2b04aaf98dd869921e8cf26f7db766d182909
SHA512 4f096d425be5ed47bb13a2ce890131599644f5f23fab2ef3dc6f0786c5a1bf5de2531bfaa4230a1586e9017fb2e008e1704115f174d881a2bd3077c6b0f1053b
TLSH
T11FA002B002C65152CA04837534D6319D76329E500243176396E046B4CC9036841171D6
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.masterain.discord-quest-helper\EBWebView\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.masterain.discord-quest-helper\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.masterain.discord-quest-helper\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.masterain.discord-quest-helper\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.masterain.discord-quest-helper\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.masterain.discord-quest-helper\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.masterain.discord-quest-helper\EBWebView\Default\Preferences
Size 6KB
SHA256 e9ee50063923a44113cd1472e8d7cd520735c752d4f70342a28095e217a8b5bb
MD5 e3e1d14b27827912dd09b9098ac59ffb
SHA1 ad4b002be67b0fe0a05a4c3ae4053223b73a34d1
SHA512 0171b29be3008c8bcb5c9bd21d45747b00ff5c45dc67aba679621fe2a5916e63f42f0e5266ef7aa1e2505cbccb78dad5695818199876fda0967f9746642cc7e2
SSDEEP 96:st705Nj6zb9eNffKZZ8i0vhErktIm/7qx+WVHMSm+uecJc3SjMdQj2+gdtMOB:st70ThfUZ8paGh/S+WiTciodjHtMC
TLSH
T190E1C8065E686D774CC7E6197A35BF52E2F6606261D44E58BBFCC61C08E66CC220790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5a0919.TMP

Path C:\Users\Admin\AppData\Local\com.masterain.discord-quest-helper\EBWebView\Default\Preferences~RFe5a0919.TMP
Size 6KB
SHA256 5e1c97aa08d7f1b6f4ba59a2e946583b61eda409f781d16aa9a341bcad55c976
MD5 fb4e90430ae589d47278a38a033ef309
SHA1 2d455b0f3ea894b2e2dccae2c45b5041013e38e2
SHA512 9e503842c0b2c25018ed46ca4277f6d86193622aad8050353c767e91bfcfedc696aa00e80b836031e542f9534fe5c575f98091e205d39b8c321be5bc16eb4797
SSDEEP 96:st705Nj6zb9wNffKZZ8i0vhErktIm/7qx+WVHMSm+uecJM/S1idQj2+gzVtMEB:st70TLfUZ8paGh/S+WiTMqwdj5VtM8
TLSH
T16FD1B7065F68697B4CCBE21D7A35BF52D2FA206271D44E98EBFC951C08E66CC220790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.masterain.discord-quest-helper\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.masterain.discord-quest-helper\EBWebView\Local State
Size 16KB
SHA256 8b721a7ef393ee26541f7cfe8f9b9db8435653e78c7ee2510e912ddc8fe69901
MD5 f47f77adeee4af461ccb459b4236a40f
SHA1 e98dfbeda817120e95651d8d5446504df6e36380
SHA512 b8ea4c0ae213d5582907f5ec924869b936196e086fdf5c9695d20e8a07f121ffcde715999eb21e3565a432761ce8b23c7aded05ef4d4986583991a37aedc91a3
SSDEEP 384:zN+aQikB+z/xvxjg/qhEwNb2lp5l8N2U29zc:c/UxvxjgC+3Hl8N2U2Fc
TLSH
T100728E2B95693E3368F3E945799C1F4BD6B5946390C16FBC4AED6F09069B3D80302C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.masterain.discord-quest-helper\EBWebView\Local State
Size 2KB
SHA256 b925c60c322beb1995d999bc176186b6e6c1096c6b73c7e454fee541143b71e2
MD5 cff6f14b840a237f37dc27dd66343970
SHA1 cbec05d3af70c23b967fd8b57417f35768a9240b
SHA512 37c947cfd4c1d53dc727c0bec8afa7621d26f7ce247dadb1eb40decc70661ac233cdbd7ce5096360e4ea42f57884c2d0f98c7a0e98713590b8223054a09d3062
TLSH
T1F651E873AC54BE3759E34A4478C93F53A9366126A6911FA4A5DD2F1C01DB2EC2343C2F
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.masterain.discord-quest-helper\EBWebView\Local State
Size 3KB
SHA256 1e2aa228927bd21f4a788b8079bcf7864e17301ca683e0361cfa75d92149808f
MD5 72f6275b3012038b1f2f2ee2465d1c5c
SHA1 98d19b6d0c3973424396902b0152eff34991ad1f
SHA512 7fe426cc2a5e97c22693e4ec94d12bfc6bfc0236c7086277462ebb31d607fff310a168e05448dd727e7e61b5c46adb6c6d687e0e1c65a5e0e520bd82070ed2a9
TLSH
T18F71A526ACA4A9371DE29E45B8C53F02B6665127E1D13FA8D9EC1F0C019B3D81342C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59695f.TMP

Path C:\Users\Admin\AppData\Local\com.masterain.discord-quest-helper\EBWebView\Local State~RFe59695f.TMP
Size 1KB
SHA256 b59390374de5dc1d9680afb18fb72f280c9319aba268d9312bac1e5320eb00a0
MD5 a2c911b44496b5d9d5cfc063504a7e65
SHA1 9ae631f17007de121b19f3365f3b3b00bdd233fb
SHA512 cfc74b0fe9a77ffa7af5469c3960aa7f43f40efbbf6713b3525a68146c5c42d16144a3051dfcf94f0f201424c8c88b1d4b857c9af08540a254b1dc379a654d75
TLSH
T12E216577C8E43D763D815D95B0C67F872C11612A92508F9CE1CE671802AB5EC5557C37
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

overwatch.exe

Path C:\Users\Admin\Documents\DiscordQuestGames\overwatch.exe
Size 300KB
SHA256 a06009a4f160bdf7b7fc6acb2fc3b402e8613903e4368ae8beef1b93822c2bde
MD5 d9e5837dd0cb0f66c5e6e436aa493ef9
SHA1 626efab66188e1ae23b50d157468e6e87cae43d2
SHA512 16c5e85272947f6742f1f438c4a7c3a7ed7d970ac6d47c2c3f9a41926af217521d0fa12182f325a320b78d40d985b87f743505661fbb57141768f7968b9ab503
SSDEEP 6144:zod1PstQXuguJmpHu7xHRGAgH7bnhhrE6:cdxsVIopQAazL
TLSH
T165646B52F29544FDE06EC078838A9672BB3674850B216BEF13E902213F1BAE57F39754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

e593714.msi

Path C:\Windows\Installer\e593714.msi
Size 6.6MB
SHA256 67e096ccf1a94c0d11033bb248490e5bd90b26e776c942d47d5d41b05bb6b83c
MD5 7e02177094b7b4d44a86934856707521
SHA1 bb68e5baa41d41474aba696e73de2439804feaff
SHA512 404f968cc4b9e9ed60d7f09d17b48982bda8206878cf8334335d824644254d5a51de062a2e42564d176faf5daf488425fb1b0042531e127dda0be01ac39dfb1e
SSDEEP 196608:NnwhAkMd5/vrw/OlcDA5cEeaEreOGZC9Nkdy:VW2JlcM5zdjPo9o
TLSH
T1F266334BBE91DA31C6A24D76883AABB39379FC100795B4436AD8354DDDF12C40EF1AD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 c7e6e97fbe5e191d1bb4e2499f834054956cd72e94d9fe1547bc7467d92a6144
MD5 7a5dbb3220839d709d9cca0035937497
SHA1 bc6415aceed70b07c2cd755e71dfa02fc915e5a2
SHA512 1010b06b8bdce41b310030f8671d41b487c06182a75c64409ba03efb477b8af1b47048ae1cef405f14758aeb39cd320adc72ec76af3b4b14922680d74c1602f2
SSDEEP 24576:Mu8m+1zOdoO/vvTLbWhuEGalg4kzZ1hSdnGdT+AVpUqwu2YMo/F4ZHaRk:p
TLSH
T1E947D32437F92200E7F79F3DACF06A23493A7D5B9C159E8D45411B4E0921BB1E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{9fb8739a-9714-4289-8593-c120dc2b8b15}_OnDiskSnapshotProp

Path \??\Volume{d78106ee-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{9fb8739a-9714-4289-8593-c120dc2b8b15}_OnDiskSnapshotProp
Size 6KB
SHA256 ce0b08f226dfd29c0dc4e334431c5c1e18fcc80e4f92a28966a3cc1fd495fb5d
MD5 79e65c88958945ef92e693db12894492
SHA1 cd40722bd6ae0d3560a4cba97f2b52df5c74db87
SHA512 8f670461de0609b13867babbf22d2661ac47b8b9d7f34a04002f1190c3682ab9503892da8967b66b1cecc5db544ea7e1f28575d9fb22735b84a0ef03d9870d70
SSDEEP 96:FHvKVIyvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:VvJIb++ZVmN
TLSH
T1ACD18A185AE54311E2F3AB7228F14557A877B911FF33CB8E0198238E6670A10F875F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3516-273-0x0000014F23E60000-0x0000014F24318000-memory.dmp

Download

memory/3516-75-0x00007FFF69C00000-0x00007FFF69C01000-memory.dmp

Download

memory/3516-288-0x0000014F23E60000-0x0000014F24318000-memory.dmp

Download

memory/4532-90-0x00007FFF69AE0000-0x00007FFF69AE1000-memory.dmp

Download

memory/4532-91-0x00007FFF69210000-0x00007FFF69211000-memory.dmp

Download

memory/5580-178-0x00007FFF69C00000-0x00007FFF69C01000-memory.dmp

Download