c96f7aea7646cf35cb7db59462894bc0e042ab4f811d662ec184e46bfbc69637

Analysis

max time kernel
149s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 12:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Discord.Lite_3.1.3_x64_en-US.msi
Size 19.3MB
Sample261107-p3gbmax14j
SHA256 c96f7aea7646cf35cb7db59462894bc0e042ab4f811d662ec184e46bfbc69637
MD5 df6fa688f18bc5716e1612d3715dbc34
SHA1 183fb71b67339be26f8ced22e23c065e68bf62df
SHA512 4d3d9ba2f009d5c4927fe239a6567c9432767eddf120c25eabf5b7d03145c96d315928769eecd28d4f8ff8b5ce4e2f82ae25a3bce09b70a3913723ff6a66e7aa
SSDEEP 393216:/ALSyXfkHOnJCoURmacJrs/JG08j9yvBQbnKtN5oOrJb:/A+CkHOJCoEmacJrs/MZ0mnKtfXr
TLSH
T1921733277C81E730D50E5C70927DABD82AB93D64AF05A85B2A447736EDF43C0987A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware spyware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5116	discord-lite.exe

Loads dropped DLL 1 IoCs

pid	Process
2488	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	discord-lite.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Discord Lite\discord-lite.exe	msiexec.exe
File created	C:\Program Files\Discord Lite\Uninstall Discord Lite.lnk	msiexec.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5568_313270460\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5568_313270460\LICENSE	msedgewebview2.exe
File created	C:\Windows\Installer\e5a282a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a282a.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0AA1A40670F9B5B6.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\{FC3416D0-B034-4B19-9CD1-6CCE2880BF74}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5568_313270460\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5568_313270460\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\Installer\SourceHash{FC3416D0-B034-4B19-9CD1-6CCE2880BF74}	msiexec.exe
File created	C:\Windows\Installer\{FC3416D0-B034-4B19-9CD1-6CCE2880BF74}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDCDBE88215C78E41.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7B84716883BCBF45.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAC6BECB34C3C723E.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI327B.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a282c.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5568_313270460\keys.json	msedgewebview2.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
864	msiexec.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	discord-lite.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	discord-lite.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	discord-lite.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	discord-lite.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000463f4e358e8ea170000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838010463f4e30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841010463f4e3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e30463f4e300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e60463f4e300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 27 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0D6143CF430B91B4C91DC6EC8208FB47\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0D6143CF430B91B4C91DC6EC8208FB47\MainProgram	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D6143CF430B91B4C91DC6EC8208FB47\PackageCode = "582FFDDADCD6E6B40B82B6C84EDD7C52"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D6143CF430B91B4C91DC6EC8208FB47\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D6143CF430B91B4C91DC6EC8208FB47\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D6143CF430B91B4C91DC6EC8208FB47\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D6143CF430B91B4C91DC6EC8208FB47\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D6143CF430B91B4C91DC6EC8208FB47	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D6143CF430B91B4C91DC6EC8208FB47\ProductName = "Discord Lite"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D6143CF430B91B4C91DC6EC8208FB47\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D6143CF430B91B4C91DC6EC8208FB47\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D6143CF430B91B4C91DC6EC8208FB47\SourceList\PackageName = "Discord.Lite_3.1.3_x64_en-US.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D6143CF430B91B4C91DC6EC8208FB47\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{C2B42CA3-4F9A-454A-92CC-3F92CDD5F233}	msedgewebview2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0D6143CF430B91B4C91DC6EC8208FB47\Environment = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D6143CF430B91B4C91DC6EC8208FB47\ProductIcon = "C:\\Windows\\Installer\\{FC3416D0-B034-4B19-9CD1-6CCE2880BF74}\\ProductIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2BDDF1C45F6F77556B22F79A2C78A20B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2BDDF1C45F6F77556B22F79A2C78A20B\0D6143CF430B91B4C91DC6EC8208FB47	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D6143CF430B91B4C91DC6EC8208FB47\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D6143CF430B91B4C91DC6EC8208FB47\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D6143CF430B91B4C91DC6EC8208FB47\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0D6143CF430B91B4C91DC6EC8208FB47	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0D6143CF430B91B4C91DC6EC8208FB47\External	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D6143CF430B91B4C91DC6EC8208FB47\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D6143CF430B91B4C91DC6EC8208FB47\Version = "50397187"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D6143CF430B91B4C91DC6EC8208FB47\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0D6143CF430B91B4C91DC6EC8208FB47\AuthorizedLUAApp = "0"	msiexec.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	discord-lite.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 6b00000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df019000000010000001000000076935b5c5a037216daaf8aac76df42c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	discord-lite.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c00000001000000040000008001000019000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576146b00000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a2000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	discord-lite.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	discord-lite.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	discord-lite.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	discord-lite.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5504	msiexec.exe
5504	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5568	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	864	msiexec.exe
Token: SeIncreaseQuotaPrivilege	864	msiexec.exe
Token: SeSecurityPrivilege	5504	msiexec.exe
Token: SeCreateTokenPrivilege	864	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	864	msiexec.exe
Token: SeLockMemoryPrivilege	864	msiexec.exe
Token: SeIncreaseQuotaPrivilege	864	msiexec.exe
Token: SeMachineAccountPrivilege	864	msiexec.exe
Token: SeTcbPrivilege	864	msiexec.exe
Token: SeSecurityPrivilege	864	msiexec.exe
Token: SeTakeOwnershipPrivilege	864	msiexec.exe
Token: SeLoadDriverPrivilege	864	msiexec.exe
Token: SeSystemProfilePrivilege	864	msiexec.exe
Token: SeSystemtimePrivilege	864	msiexec.exe
Token: SeProfSingleProcessPrivilege	864	msiexec.exe
Token: SeIncBasePriorityPrivilege	864	msiexec.exe
Token: SeCreatePagefilePrivilege	864	msiexec.exe
Token: SeCreatePermanentPrivilege	864	msiexec.exe
Token: SeBackupPrivilege	864	msiexec.exe
Token: SeRestorePrivilege	864	msiexec.exe
Token: SeShutdownPrivilege	864	msiexec.exe
Token: SeDebugPrivilege	864	msiexec.exe
Token: SeAuditPrivilege	864	msiexec.exe
Token: SeSystemEnvironmentPrivilege	864	msiexec.exe
Token: SeChangeNotifyPrivilege	864	msiexec.exe
Token: SeRemoteShutdownPrivilege	864	msiexec.exe
Token: SeUndockPrivilege	864	msiexec.exe
Token: SeSyncAgentPrivilege	864	msiexec.exe
Token: SeEnableDelegationPrivilege	864	msiexec.exe
Token: SeManageVolumePrivilege	864	msiexec.exe
Token: SeImpersonatePrivilege	864	msiexec.exe
Token: SeCreateGlobalPrivilege	864	msiexec.exe
Token: SeCreateTokenPrivilege	864	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	864	msiexec.exe
Token: SeLockMemoryPrivilege	864	msiexec.exe
Token: SeIncreaseQuotaPrivilege	864	msiexec.exe
Token: SeMachineAccountPrivilege	864	msiexec.exe
Token: SeTcbPrivilege	864	msiexec.exe
Token: SeSecurityPrivilege	864	msiexec.exe
Token: SeTakeOwnershipPrivilege	864	msiexec.exe
Token: SeLoadDriverPrivilege	864	msiexec.exe
Token: SeSystemProfilePrivilege	864	msiexec.exe
Token: SeSystemtimePrivilege	864	msiexec.exe
Token: SeProfSingleProcessPrivilege	864	msiexec.exe
Token: SeIncBasePriorityPrivilege	864	msiexec.exe
Token: SeCreatePagefilePrivilege	864	msiexec.exe
Token: SeCreatePermanentPrivilege	864	msiexec.exe
Token: SeBackupPrivilege	864	msiexec.exe
Token: SeRestorePrivilege	864	msiexec.exe
Token: SeShutdownPrivilege	864	msiexec.exe
Token: SeDebugPrivilege	864	msiexec.exe
Token: SeAuditPrivilege	864	msiexec.exe
Token: SeSystemEnvironmentPrivilege	864	msiexec.exe
Token: SeChangeNotifyPrivilege	864	msiexec.exe
Token: SeRemoteShutdownPrivilege	864	msiexec.exe
Token: SeUndockPrivilege	864	msiexec.exe
Token: SeSyncAgentPrivilege	864	msiexec.exe
Token: SeEnableDelegationPrivilege	864	msiexec.exe
Token: SeManageVolumePrivilege	864	msiexec.exe
Token: SeImpersonatePrivilege	864	msiexec.exe
Token: SeCreateGlobalPrivilege	864	msiexec.exe
Token: SeCreateTokenPrivilege	864	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	864	msiexec.exe
Token: SeLockMemoryPrivilege	864	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
864	msiexec.exe
864	msiexec.exe
5116	discord-lite.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5116	discord-lite.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
864	msiexec.exe
5504	msiexec.exe
2488	MsiExec.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5504 wrote to memory of 2488	5504	msiexec.exe	89
PID 5504 wrote to memory of 4732	5504	msiexec.exe	95
PID 864 wrote to memory of 5116	864	msiexec.exe	98
PID 5116 wrote to memory of 5568	5116	discord-lite.exe	99
PID 5568 wrote to memory of 3832	5568	msedgewebview2.exe	100
PID 5568 wrote to memory of 4120	5568	msedgewebview2.exe	101
PID 5568 wrote to memory of 4120	5568	msedgewebview2.exe	101
PID 5568 wrote to memory of 4120	5568	msedgewebview2.exe	101
PID 5568 wrote to memory of 4120	5568	msedgewebview2.exe	101
PID 5568 wrote to memory of 4300	5568	msedgewebview2.exe	102
PID 5568 wrote to memory of 4936	5568	msedgewebview2.exe	103
PID 5568 wrote to memory of 4936	5568	msedgewebview2.exe	103
PID 5568 wrote to memory of 4936	5568	msedgewebview2.exe	103
PID 5568 wrote to memory of 5716	5568	msedgewebview2.exe	104
PID 5568 wrote to memory of 5716	5568	msedgewebview2.exe	104
PID 5568 wrote to memory of 5716	5568	msedgewebview2.exe	104
PID 5568 wrote to memory of 5716	5568	msedgewebview2.exe	104
PID 5568 wrote to memory of 5716	5568	msedgewebview2.exe	104
PID 5568 wrote to memory of 3748	5568	msedgewebview2.exe	105
PID 5568 wrote to memory of 3748	5568	msedgewebview2.exe	105
PID 5568 wrote to memory of 3748	5568	msedgewebview2.exe	105
PID 5568 wrote to memory of 3436	5568	msedgewebview2.exe	106
PID 5568 wrote to memory of 5412	5568	msedgewebview2.exe	109
PID 5568 wrote to memory of 5412	5568	msedgewebview2.exe	109
PID 5568 wrote to memory of 5412	5568	msedgewebview2.exe	109

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Discord.Lite_3.1.3_x64_en-US.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:864
- C:\Program Files\Discord Lite\discord-lite.exe
  "C:\Program Files\Discord Lite\discord-lite.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies trusted root certificate store through registry
  - Reads the TCP/IP host and domain name from the registry
  - Modifies system certificate store
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=discord-lite.exe --webview-exe-version=3.1.3 --user-data-dir="C:\Users\Admin\AppData\Local\com.discordlite.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5116.2608.6063530851568055092 /pfhostedapp:bc9a728c4e278c191cc9bf30172636173588fa51
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:5568
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.discordlite.app\EBWebView /prefetch:4 /pfhostedapp:bc9a728c4e278c191cc9bf30172636173588fa51 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.discordlite.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7fff8a665fd8,0x7fff8a665fe4,0x7fff8a665ff0
      4⤵
      PID:3832
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.discordlite.app\EBWebView" --webview-exe-name=discord-lite.exe --webview-exe-version=3.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1752 --field-trial-handle=1756,i,6723298468554542108,9785310185623266855,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:bc9a728c4e278c191cc9bf30172636173588fa51
      4⤵
      PID:4120
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.discordlite.app\EBWebView" --webview-exe-name=discord-lite.exe --webview-exe-version=3.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2172 --field-trial-handle=1756,i,6723298468554542108,9785310185623266855,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:bc9a728c4e278c191cc9bf30172636173588fa51
      4⤵
      PID:4300
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.discordlite.app\EBWebView" --webview-exe-name=discord-lite.exe --webview-exe-version=3.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2336 --field-trial-handle=1756,i,6723298468554542108,9785310185623266855,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bc9a728c4e278c191cc9bf30172636173588fa51
      4⤵
      PID:4936
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.discordlite.app\EBWebView" --webview-exe-name=discord-lite.exe --webview-exe-version=3.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=2888 --field-trial-handle=1756,i,6723298468554542108,9785310185623266855,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:bc9a728c4e278c191cc9bf30172636173588fa51 /prefetch:1
      4⤵
      PID:5716
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.discordlite.app\EBWebView" --webview-exe-name=discord-lite.exe --webview-exe-version=3.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=1756,i,6723298468554542108,9785310185623266855,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bc9a728c4e278c191cc9bf30172636173588fa51
      4⤵
      PID:3748
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.discordlite.app\EBWebView" --webview-exe-name=discord-lite.exe --webview-exe-version=3.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4204 --field-trial-handle=1756,i,6723298468554542108,9785310185623266855,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bc9a728c4e278c191cc9bf30172636173588fa51
      4⤵
      Modifies registry class
      PID:3436
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.discordlite.app\EBWebView" --webview-exe-name=discord-lite.exe --webview-exe-version=3.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4712 --field-trial-handle=1756,i,6723298468554542108,9785310185623266855,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bc9a728c4e278c191cc9bf30172636173588fa51
      4⤵
      PID:5412

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5504
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E41D2061EFAED6A3616C8FC55C92270E C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2488
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4732

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a282b.rbs

Path C:\Config.Msi\e5a282b.rbs
Size 9KB
SHA256 116b09dd8acb0eef3bfbe26cf83b94178695140567e946f1c0c82fdb971853bb
MD5 0006ff34592a7f7268c30069f680e471
SHA1 40d11379e6fce9cec8249e2fcc63d5662f43ab77
SHA512 68df02fb9ed964427dc795d755b88a028186d50f1ad09bc85e8b627a39d47b684f69e934e093f6e41b11514cc1f9a6a8667bbed5ace25220da253501943da423
SSDEEP 192:9wLVrisqx/kukhWsMSPNbCXOSE3G1SE3T0mzpwMpFMEWTiGEgBpk:9wLVr5qx/kukhWsMSPNdSEESEjFuMUcH
TLSH
T190223307660485D2F95B1B39CB1B27213BF6D3C9832E978B188E92368F4B7850ED954F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

discord-lite.exe

Path C:\Program Files\Discord Lite\discord-lite.exe
Size 42.8MB
SHA256 1e47d43c1746ea0135559c91832b4bcf20a0343548defe82c028737a38670829
MD5 c819f99bf8bfd6bc12394a45902e8d09
SHA1 acdc2f71ccaeb98899feaf35b363003ffc52cb0c
SHA512 2a9f647fbeb134551a97c0f3dd5788156cd9a391d3d0ab086c9b374f921ce274db68145c270cecbc92064790a9054b4788ad04073bbda7ca9f3a2633596ca896
SSDEEP 393216:kvY8J2aumw02QNGvRt0hetvGNxI/57eb8mraDCWohEW2zvBrwm85+rHFGvTZNjPf:kvYF0u/lKvGsm85qHFGvn
TLSH
T1A0A75A55BB9655A8D05BC470834A8A22E93134CF0B35A9FF45C496383F7ABF42F38B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Discord Lite.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Discord Lite\Discord Lite.lnk
Size 1KB
SHA256 8d514567ba994458028ccf8d21e7bbc0f7a4aa1fac7f00efd20899a9b03cea97
MD5 0c15721a04b3b47ed03f60438c28b7c7
SHA1 37e755cb27d41e3b5cbe9f60b0926bec9fa2c7d1
SHA512 de276363bb05ea2c1cb4510af665c7bed1a6bcd5d197af6306cd733689cb93a09218eead9a562d81367830cf1bd07b61a9ac41192454f2042c3eb793a50c4d82
TLSH
T17141AD0057A94B26F3B21B3679E10722DB31FC10EA788F6F488542CA5C71A429969F3B
MD5 SHA1 SHA512 TLSH

Submit Download

~iscord Lite.tmp

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Discord Lite\~iscord Lite.tmp
Size 2KB
SHA256 69db3527e70b9367306e4fa5b974a514bfd206c0c922e3c5cb4865500ff07747
MD5 c1c4ba252da89e504f3c785c2215e5c8
SHA1 2306bf3ea2bd8072a431fb297e76f88ffb030568
SHA512 acd51d656dcd4c36e4bbe0794817820c063a23f8f67aa13abcc56849c3a0a0b90ababc61b4e14491a78dfdc8b60dd265275ad0ed6e94ee4be1f799877dc0f405
TLSH
T1D541CE0117A95B26F3B21B3679E00722DB31FC10F5788F2F488542C95C75A028969F3B
MD5 SHA1 SHA512 TLSH

Submit Download

MSIC99F.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIC99F.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

023794fa-ea0b-4e6f-bdb1-e41d1d5a8cd3.tmp

Path C:\Users\Admin\AppData\Local\com.discordlite.app\EBWebView\023794fa-ea0b-4e6f-bdb1-e41d1d5a8cd3.tmp
Size 15KB
SHA256 7a8ce3b19e7f78f0111a62b803e8eb2a9db12599f3d9c70e581b4edd8876a711
MD5 484706c39b3d7da81cad6b079e1163be
SHA1 32cdcdf2e12ba36569286376574d1dff5d67850b
SHA512 b38991fd244366171efd8806589a081ab909266a954a135a2628e7ce4a61113b2abdbe82ce048f6544122e353b5db3818516c619851fed48b654acc8c63e461c
SSDEEP 384:H+OBqImmJvGBLx3NaFMJFNNBSK0e1gogg6rJ:WcvGtlNZd+V
TLSH
T180729E3A78655E336CEB890EBB8E634BCB65A257C1D57BD9C8EC9F0F016F0841392815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

30723dd0-fd99-438f-b0bb-520c886f5970.tmp

Path C:\Users\Admin\AppData\Local\com.discordlite.app\EBWebView\30723dd0-fd99-438f-b0bb-520c886f5970.tmp
Size 2KB
SHA256 14aa2a05c5a7000d0c94dfda02c016acf33195d4d8a882b4dceb4f8ceab8e34c
MD5 31fb4f02c468bc68b869ac4801d45c36
SHA1 d99f4652c072c89e01babf69410b5cb81de5e571
SHA512 0ee7abbb92ff18f904f30066aed0fc0d72c42ef4cbdd045cfc8f0b1ee75bd64460287eab189fe3e0c4dd9af6710fe02d226640147fb2281e6481e0fbaec047de
TLSH
T1A8517533B910AB33D9E68A0DB64B7B2BDE3991699B922F5195DC0B0C01D725D6381C37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.discordlite.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7fe8ba0e30102350765ae30c0b48825fde03f1866f8420540819f3096937092e
MD5 0234b549253af54e555becc11d95105e
SHA1 13f9ede1edbd63b45374faa99e536cfc4495d056
SHA512 a2247a4947dd63f4db86e57d1942f15721327ffed2344cec89e1910909283ca0bb2cc80a369584b5c10c272ca5ac0317a77c5ea49db8bd8db700baf7d463d8e4
TLSH
T1A2D00470D1010011C0071533053451144131DF415D0517040010011C445141DC11501D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.discordlite.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1e0a281729f46037ea41729724b3fd09236f0f6be1eafa277db53f2b5b049b78
MD5 813b57caf17036886ed0c25a47d92f4c
SHA1 d41301cab4974a27eb47bf51f4fabb518b35a1cd
SHA512 63ed6c03de36ce20766f11036bd7defdaee9569cc4dec699acf53a7eadbbc65d6ff51e2ca7b0b9cd824a264c55612835590a485dbaf43138a22d6aee26144adb
TLSH
T1DDD0122272020134C01125330512710C0411D70B850941045428862D5A1446C4A1645E
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.discordlite.app\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.discordlite.app\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 120B
SHA256 4f64157f6abb40e91daff4fa96b53e52e365d53998beda5bbb4eb75d1b698320
MD5 7d42df05c68ba838ccd71286ab1a7560
SHA1 be0687fee785621a3a637800d3321e75daf7bb53
SHA512 4399928581b805788fa5f77605cb4a009150d5be6f2a7bde704bc51fe68ae403856f705d5d7d48460b387c45f2f796e1c6028b6fb870f54e0eb4fde6b7e49238
TLSH
T146B01240047D004FC7311D3003C33904B1300B2483330F2289D250B98A533E49A04100
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.discordlite.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 6ba36511cde50723adf84f8254b29a62bf46283e6b3ecef8571cf3e8dc7362af
MD5 7ae74c7735556af90f5b74d13f9453e5
SHA1 02563ae7f92eb06570b94f6f03349a27d2858741
SHA512 388ab3a81ad533280b5c479291f8feb5106428e685beb157659e002ce85acdd44eeed171f837c7c9fdee2f7e755c257f4cf73c7221f2ce68fded6e6b35524998
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.discordlite.app\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

37299d5c-bb6a-4f66-b040-bda32784eb30.tmp

Path C:\Users\Admin\AppData\Local\com.discordlite.app\EBWebView\Default\Network\37299d5c-bb6a-4f66-b040-bda32784eb30.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.discordlite.app\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.discordlite.app\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.discordlite.app\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

f1b3cc6e-9054-4975-b0d4-2b9a8a7620f3.tmp

Path C:\Users\Admin\AppData\Local\com.discordlite.app\EBWebView\Default\f1b3cc6e-9054-4975-b0d4-2b9a8a7620f3.tmp
Size 6KB
SHA256 9741c2e0115004ec0c2daf962fcf0cc321df41de9485ec5ed4557d7f3516ab1b
MD5 73d0c13cf3379c8882b50f4e2d89a497
SHA1 ad923ab8cac499027339e55c80198e27e5ee0229
SHA512 9b74e0945a4356b59520a65a50c7d66b842538e3f6824e5274493ffacaf7e6a821fb34185c010d682a18d8c1053c70ba1d8611fe13d67f4303d60450fc82b7b0
SSDEEP 96:stx/dalAwLdb9Ck+Do5h16Z0ds7/x+6MhmuecJx11ejeyK+gOz28XM1C7K:stlOAvondsV+Fdx1QjOuG6K
TLSH
T196D1A701AE24B97B8CCBE509BA25BB07E2F5903165D51E58EBF8861C04DB6CD6317907
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.discordlite.app\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.discordlite.app\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.discordlite.app\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.discordlite.app\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.discordlite.app\EBWebView\Local State
Size 1KB
SHA256 4949a08df7c59cccb07f8971de39d371aefbd065e3d3787c2a6ef18744290a6a
MD5 9cb7aa4331280578aa39bbc49dd796c8
SHA1 1111eb7405130786c962a75b9f299e65a4040f7b
SHA512 28a792a83fc03d1a26d8829da48ff58cdf0eb7e7dcd5fed9bbc327a78e279a6ce812635e7dc23376896ba23c361238d0d80883fcedeebec47e57580a413fbb45
TLSH
T126214272E5645B32FC86550F7247B76F5E21912F82419E0494DD871D02E719DF3AAC33
MD5 SHA1 SHA512 TLSH

Submit Download

ae6134a1-83d4-4b5a-a2ef-6ecc984f60d5.tmp

Path C:\Users\Admin\AppData\Local\com.discordlite.app\EBWebView\ae6134a1-83d4-4b5a-a2ef-6ecc984f60d5.tmp
Size 3KB
SHA256 21daa950dbcf306b87abbc73823665f3aa2f5122b829a2100a3909b59b737d36
MD5 010b988c411e69d84c21f87d72ba9fca
SHA1 31049ffcef5c5c545d5f03e308f90e1f33f538c5
SHA512 8b3a742a7dc00573b302fe533958ac1936fa1a4860cef6b3ba060a7dc68750e943feffd613682b5e7c7fc9c401b7d7486cac85cf883ee226e4f82b316a3fbc20
TLSH
T155618437B930AA379DE68A09B5863B1BABA5912BE5C13F95C5EC0F0D01D739C2381C17
MD5 SHA1 SHA512 TLSH

Submit Download

e5a282c.msi

Path C:\Windows\Installer\e5a282c.msi
Size 19.3MB
SHA256 c96f7aea7646cf35cb7db59462894bc0e042ab4f811d662ec184e46bfbc69637
MD5 df6fa688f18bc5716e1612d3715dbc34
SHA1 183fb71b67339be26f8ced22e23c065e68bf62df
SHA512 4d3d9ba2f009d5c4927fe239a6567c9432767eddf120c25eabf5b7d03145c96d315928769eecd28d4f8ff8b5ce4e2f82ae25a3bce09b70a3913723ff6a66e7aa
SSDEEP 393216:/ALSyXfkHOnJCoURmacJrs/JG08j9yvBQbnKtN5oOrJb:/A+CkHOJCoEmacJrs/MZ0mnKtfXr
TLSH
T1921733277C81E730D50E5C70927DABD82AB93D64AF05A85B2A447736EDF43C0987A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5568_313270460\manifest.json
Size 80B
SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
MD5 3790d9257ba14f8be2ba08acf259a57f
SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
TLSH
T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 f0a998b5496ca817d3be2a33f87fccb9a84d0522ff1356fe6ed84996372adda8
MD5 f0d3ae20435ba1d4672086a235f7af12
SHA1 fe6225c4654f3fcf177ccb4f071464b0616a31bc
SHA512 3f5e74cbb64790730591f6850e4d7089f2e855ed1c7030bf9f81c91ebfa890858a9044285b95a29b16e1a3c5410f1f7574e5af99a092ce04bef5ed2007d4aa08
SSDEEP 24576:oFo3DMPRdoO/vvTL/Sgn3iFwfru9MrwkEqhl9qJfBiJ6JQ2XMYR23uNmz+H:AHo
TLSH
T17E57022472F92211E7F39E3CA8F06A23493E7D9B9C15DE8D45411B4E0862F71E872F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{cbb630b8-2bab-476f-99cd-da7940dcd96e}_OnDiskSnapshotProp

Path \??\Volume{e3f46304-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{cbb630b8-2bab-476f-99cd-da7940dcd96e}_OnDiskSnapshotProp
Size 6KB
SHA256 a60f7a43003937108a22272446b40b026fb04f264289e107b7ca45b9def41452
MD5 5c0e5d3e538564ee03d055a509ee63e0
SHA1 a9c9a1820fcde6d2cf059f7186600e0e678a357e
SHA512 bd27bc9fa5b9c924e76546ebdf5d38e27964d3a57c24b1eeb0dc466e208a1a3dd5a62b8461fc3a9f51a9b5af04a3fa533c6629c755f2ba4fd2e1225596179792
SSDEEP 96:FdY9jqvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:jYYb++uVmN
TLSH
T16BD188085AF54711E2B3AB3129F18557A877B811FF33CB8E0198638E6671A10F935F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4120-250-0x000001738CE00000-0x000001738CE2F000-memory.dmp

Download

memory/4120-67-0x00007FFFACDB0000-0x00007FFFACDB1000-memory.dmp

Download

memory/5412-299-0x00007FFFAE290000-0x00007FFFAE291000-memory.dmp

Download

memory/5412-298-0x00007FFFAD1A0000-0x00007FFFAD1A1000-memory.dmp

Download

memory/5716-87-0x00007FFFACDB0000-0x00007FFFACDB1000-memory.dmp

Download