download:

DiscordSetup.exe

Full analysis: https://app.any.run/tasks/f6b02cc0-f23a-485f-a842-8e46408c39dd
Verdict: Malicious activity
Analysis date: October 05, 2022, 00:58:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

2F8A7BB9C48C4B3ECF223D1FBBD8AFA3

SHA1:

6D00DC4F25408161AC63B1D28226C515E9EC04C5

SHA256:

5EDC53181D1300141E42BC756A7188949F3CE6BBEBCAFE80CD8E326DEEC21EAE

SSDEEP:

1572864:OE4SZ1wRDBY5ev0B1QvvPz7OlCc5a5vE8HnJRk7u/lGyTtwc7vPkux4uneCsL:OELZ1wLYcv0ByvPHOlCc5sE8fpd7hxJC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • Update.exe (PID: 1528)
      • DiscordSetup.exe (PID: 2896)
      • Discord.exe (PID: 3564)
      • Discord.exe (PID: 3828)

    • Application was dropped or rewritten from another process

      • Update.exe (PID: 1528)
      • Update.exe (PID: 3460)

    • Loads dropped or rewritten executable

      • Discord.exe (PID: 1944)
      • Discord.exe (PID: 2816)
      • Discord.exe (PID: 2488)
      • Discord.exe (PID: 3564)
      • Discord.exe (PID: 3784)
      • Discord.exe (PID: 2972)
      • Discord.exe (PID: 1376)
      • Discord.exe (PID: 2956)
      • Discord.exe (PID: 3244)
      • Discord.exe (PID: 3828)
      • Discord.exe (PID: 2180)
      • Discord.exe (PID: 3952)
      • Discord.exe (PID: 2380)
      • Discord.exe (PID: 4084)
      • Discord.exe (PID: 2436)
      • Discord.exe (PID: 2324)
      • Discord.exe (PID: 3340)

    • Changes the autorun value in the registry

      • reg.exe (PID: 3480)
      • reg.exe (PID: 2412)

  • SUSPICIOUS

    • Checks supported languages

      • DiscordSetup.exe (PID: 2896)
      • Update.exe (PID: 1528)
      • Discord.exe (PID: 2816)
      • Discord.exe (PID: 1944)
      • Discord.exe (PID: 2488)
      • Update.exe (PID: 3460)
      • Discord.exe (PID: 2324)
      • Discord.exe (PID: 3784)
      • Discord.exe (PID: 3564)
      • Discord.exe (PID: 2436)
      • Discord.exe (PID: 1376)
      • Discord.exe (PID: 3828)
      • Discord.exe (PID: 2956)
      • Discord.exe (PID: 3244)
      • Discord.exe (PID: 3952)
      • Discord.exe (PID: 2380)
      • Discord.exe (PID: 2180)
      • Discord.exe (PID: 4084)
      • Discord.exe (PID: 2972)
      • cmd.exe (PID: 3400)
      • Discord.exe (PID: 3340)

    • Drops a file with a compile date too recent

      • DiscordSetup.exe (PID: 2896)
      • Update.exe (PID: 1528)
      • Discord.exe (PID: 3564)
      • Discord.exe (PID: 3828)

    • Executable content was dropped or overwritten

      • DiscordSetup.exe (PID: 2896)
      • Update.exe (PID: 1528)
      • Discord.exe (PID: 3564)
      • Discord.exe (PID: 3828)

    • Reads the computer name

      • Update.exe (PID: 1528)
      • Discord.exe (PID: 2816)
      • Update.exe (PID: 3460)
      • Discord.exe (PID: 2488)
      • Discord.exe (PID: 3564)
      • Discord.exe (PID: 2972)
      • Discord.exe (PID: 2324)
      • Discord.exe (PID: 1376)
      • Discord.exe (PID: 3828)
      • Discord.exe (PID: 3244)
      • Discord.exe (PID: 3952)
      • Discord.exe (PID: 2380)
      • Discord.exe (PID: 3340)
      • Discord.exe (PID: 4084)

    • Reads Environment values

      • Discord.exe (PID: 2816)
      • Discord.exe (PID: 3564)
      • Discord.exe (PID: 3828)
      • Discord.exe (PID: 4084)

    • Application launched itself

      • Discord.exe (PID: 2816)
      • Discord.exe (PID: 3564)
      • Discord.exe (PID: 3828)

    • Creates files in the user directory

      • Discord.exe (PID: 1944)
      • Discord.exe (PID: 2816)
      • Update.exe (PID: 3460)
      • Discord.exe (PID: 2972)
      • Discord.exe (PID: 3828)
      • Discord.exe (PID: 3952)
      • Discord.exe (PID: 3564)
      • Discord.exe (PID: 4084)

    • Uses REG.EXE to modify Windows registry

      • Discord.exe (PID: 2816)
      • Discord.exe (PID: 3564)
      • Discord.exe (PID: 3828)

    • Changes default file association

      • reg.exe (PID: 524)
      • reg.exe (PID: 3388)
      • reg.exe (PID: 2880)

    • Creates a software uninstall entry

      • Update.exe (PID: 1528)

    • Reads CPU info

      • Discord.exe (PID: 4084)

    • Starts CMD.EXE for commands execution

      • Discord.exe (PID: 4084)

  • INFO

    • Checks supported languages

      • WISPTIS.EXE (PID: 2404)
      • reg.exe (PID: 2568)
      • reg.exe (PID: 3480)
      • reg.exe (PID: 1856)
      • reg.exe (PID: 2732)
      • reg.exe (PID: 524)
      • reg.exe (PID: 2784)
      • reg.exe (PID: 3412)
      • reg.exe (PID: 3388)
      • reg.exe (PID: 2412)
      • reg.exe (PID: 1760)
      • reg.exe (PID: 3556)
      • reg.exe (PID: 2264)
      • reg.exe (PID: 2184)
      • reg.exe (PID: 2880)
      • reg.exe (PID: 3632)

    • Reads the computer name

      • WISPTIS.EXE (PID: 2404)

    • Reads the hosts file

      • Discord.exe (PID: 2816)
      • Discord.exe (PID: 2972)
      • Discord.exe (PID: 3828)
      • Discord.exe (PID: 3952)
      • Discord.exe (PID: 3564)

    • Reads settings of System Certificates

      • Discord.exe (PID: 3564)
      • Discord.exe (PID: 3828)
      • Discord.exe (PID: 4084)

    • Checks Windows Trust Settings

      • Discord.exe (PID: 4084)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2021-Aug-07 00:35:47
Detected languages:
  • English - United States
Debug artifacts:
  • C:\Users\michael.pavone\Squirrel.Windows\src\Setup\bin\Release\Setup.pdb
FileDescription: Discord - https://discord.com/
FileVersion: 1.0.9004
InternalName: Setup.exe
LegalCopyright: Copyright (c) 2022 Discord Inc. All rights reserved.
OriginalFilename: Setup.exe
ProductName: Discord - https://discord.com/
ProductVersion: 1.0.9004
SquirrelAwareVersion: 1
CompanyName: Discord Inc.

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 280

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 7
TimeDateStamp: 2021-Aug-07 00:35:47
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
4096
131381
131584
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.63723
.rdata
139264
46958
47104
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.92214
.data
188416
6428
3584
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.0684
.gfids
196608
300
512
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
2.33673
.tls
200704
9
512
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.0203931
.rsrc
204800
82793672
82793984
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.9981
.reloc
83001344
7056
7168
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.61065

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.01108
1128
Latin 1 / Western European
English - United States
RT_ICON
2
3.49078
4264
Latin 1 / Western European
English - United States
RT_ICON
3
3.67794
9640
Latin 1 / Western European
English - United States
RT_ICON
4
2.40176
270376
Latin 1 / Western European
English - United States
RT_ICON
7
3.00563
142
Latin 1 / Western European
English - United States
RT_STRING
107
2.37447
34
Latin 1 / Western European
English - United States
RT_GROUP_ICON
108
2.49212
34
Latin 1 / Western European
English - United States
RT_GROUP_ICON
131
7.99865
82505385
Latin 1 / Western European
English - United States
DATA
1 (#2)
2.37928
62
Latin 1 / Western European
English - United States
RT_GROUP_ICON
1 (#3)
3.41043
896
Latin 1 / Western European
English - United States
RT_VERSION

Imports

COMCTL32.dll
KERNEL32.dll
USER32.dll (delay-loaded)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
95
Monitored processes
38
Malicious processes
8
Suspicious processes
6

Behavior graph

Click at the process to see the details
drop and start start discordsetup.exe update.exe wisptis.exe no specs wisptis.exe discord.exe no specs discord.exe no specs update.exe no specs discord.exe no specs reg.exe reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs discord.exe discord.exe no specs discord.exe no specs reg.exe no specs discord.exe discord.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs discord.exe no specs reg.exe no specs reg.exe discord.exe discord.exe no specs discord.exe no specs reg.exe no specs discord.exe discord.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs discord.exe no specs discord.exe no specs discord.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
524C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\admin\AppData\Local\Discord\app-1.0.9004\Discord.exe\" --url -- \"%1\"" /fC:\Windows\System32\reg.exe—Discord.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1376"C:\Users\admin\AppData\Local\Discord\app-1.0.9004\Discord.exe" --type=gpu-process --field-trial-handle=1012,12443268639492408276,9106057786077832595,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1020 /prefetch:2C:\Users\admin\AppData\Local\Discord\app-1.0.9004\Discord.exe—Discord.exe
User:
admin
Company:
Discord Inc.
Integrity Level:
LOW
Description:
Discord
Exit code:
0
Version:
1.0.9004
Modules
Images
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\discord\app-1.0.9004\discord.exe
c:\users\admin\appdata\local\discord\app-1.0.9004\ffmpeg.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1528"C:\Users\admin\AppData\Local\SquirrelTemp\Update.exe" --install . C:\Users\admin\AppData\Local\SquirrelTemp\Update.exe
DiscordSetup.exe
User:
admin
Company:
GitHub
Integrity Level:
MEDIUM
Description:
Update
Exit code:
0
Version:
1.1.1.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\squirreltemp\update.exe
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1760C:\Windows\System32\reg.exe query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v DiscordC:\Windows\System32\reg.exe—Discord.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\reg.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1856C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /fC:\Windows\System32\reg.exe—Discord.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1944C:\Users\admin\AppData\Local\Discord\app-1.0.9004\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\admin\AppData\Roaming\discord /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\admin\AppData\Roaming\discord\Crashpad --url=https://sentry.io/api/146342/minidump/?sentry_key=384ce4413de74fe0be270abe03b2b35a "--annotation=_companyName=Discord Inc." --annotation=_productName=Discord --annotation=_version=1.0.9004 --annotation=prod=Electron --annotation=ver=13.6.6 --initial-client-data=0x2e8,0x2ec,0x2f0,0x2e0,0x2f4,0x7113850,0x7113860,0x711386cC:\Users\admin\AppData\Local\Discord\app-1.0.9004\Discord.exe—Discord.exe
User:
admin
Company:
Discord Inc.
Integrity Level:
MEDIUM
Description:
Discord
Exit code:
0
Version:
1.0.9004
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\users\admin\appdata\local\discord\app-1.0.9004\discord.exe
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\discord\app-1.0.9004\ffmpeg.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
2180"C:\Users\admin\AppData\Local\Discord\app-1.0.9006\Discord.exe" --type=renderer --autoplay-policy=no-user-gesture-required --field-trial-handle=1028,8215702617578547134,8751770423088701099,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\admin\AppData\Local\Discord\app-1.0.9006\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1780 /prefetch:1C:\Users\admin\AppData\Local\Discord\app-1.0.9006\Discord.exe—Discord.exe
User:
admin
Company:
Discord Inc.
Integrity Level:
MEDIUM
Description:
Discord
Exit code:
0
Version:
1.0.9006
Modules
Images
c:\users\admin\appdata\local\discord\app-1.0.9006\discord.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\users\admin\appdata\local\discord\app-1.0.9006\ffmpeg.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
2184C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\admin\AppData\Local\Discord\app-1.0.9006\Discord.exe\",-1" /fC:\Windows\System32\reg.exe—Discord.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\lpk.dll
2264C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /fC:\Windows\System32\reg.exe—Discord.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2324"C:\Users\admin\AppData\Local\Discord\app-1.0.9004\Discord.exe" --type=gpu-process --field-trial-handle=1012,12443268639492408276,9106057786077832595,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1020 /prefetch:2C:\Users\admin\AppData\Local\Discord\app-1.0.9004\Discord.exe—Discord.exe
User:
admin
Company:
Discord Inc.
Integrity Level:
LOW
Description:
Discord
Exit code:
0
Version:
1.0.9004
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\discord\app-1.0.9004\discord.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\discord\app-1.0.9004\ffmpeg.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
16 858
Read events
16 732
Write events
126
Delete events
0

Modification events

(PID) Process:(1528) Update.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
Update.exe
(PID) Process:(1528) Update.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1528) Update.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1528) Update.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1528) Update.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2404) WISPTIS.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
WISPTIS.EXE
(PID) Process:(2404) WISPTIS.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Wisp\Touch
Operation:writeName:TouchGate
Value:
1
(PID) Process:(2404) WISPTIS.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Wisp\MultiTouch
Operation:writeName:MultiTouchEnabled
Value:
1
(PID) Process:(2404) WISPTIS.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Wisp\Pen\SysEventParameters
Operation:writeName:FlickMode
Value:
1
(PID) Process:(2404) WISPTIS.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Wisp\Pen\SysEventParameters
Operation:writeName:TouchFlickTolerance
Value:
50
Executable files
45
Suspicious files
290
Text files
1 226
Unknown types
205

Dropped files

PID
Process
Filename
Type
2896DiscordSetup.exeC:\Users\admin\AppData\Local\SquirrelTemp\Discord-1.0.9004-full.nupkg —
MD5:—
SHA256:—
1528Update.exeC:\Users\admin\AppData\Local\Discord\packages\Discord-1.0.9004-full.nupkg —
MD5:—
SHA256:—
1528Update.exeC:\Users\admin\AppData\Local\Discord\app-1.0.9004\lib\net45\Discord.exe —
MD5:—
SHA256:—
1528Update.exeC:\Users\admin\AppData\Local\Discord\app-1.0.9004\lib\net45\icudtl.dat —
MD5:—
SHA256:—
1528Update.exeC:\Users\admin\AppData\Local\Discord\app-1.0.9004\lib\net45\resources.pak —
MD5:—
SHA256:—
2896DiscordSetup.exeC:\Users\admin\AppData\Local\SquirrelTemp\RELEASEStext
MD5:—
SHA256:—
1528Update.exeC:\Users\admin\AppData\Local\Discord\app-1.0.9004\lib\net45\vulkan-1.dllexecutable
MD5:—
SHA256:—
1528Update.exeC:\Users\admin\AppData\Local\Discord\app-1.0.9004\lib\net45\ffmpeg.dllexecutable
MD5:—
SHA256:—
1528Update.exeC:\Users\admin\AppData\Local\Discord\app-1.0.9004\lib\net45\vk_swiftshader.dllexecutable
MD5:—
SHA256:—
2896DiscordSetup.exeC:\Users\admin\AppData\Local\Temp\SquirrelSetup.logtext
MD5:F9A846467DDC05FCF593AB80F78A7383
SHA256:03A8A782FB7F41A30049483844A4229213459A6FD0D910FA946C9631E012B270
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
12
DNS requests
11
Threats
8

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3564
Discord.exe
162.159.133.232:443
dl.discordapp.net
CLOUDFLARENET
—
shared
3564
Discord.exe
162.159.138.232:443
discord.com
CLOUDFLARENET
—
malicious
2972
Discord.exe
172.217.17.110:443
redirector.gvt1.com
GOOGLE
US
whitelisted
3952
Discord.exe
162.159.130.233:443
discordapp.com
CLOUDFLARENET
—
shared
3828
Discord.exe
162.159.133.232:443
dl.discordapp.net
CLOUDFLARENET
—
shared
3828
Discord.exe
162.159.138.232:443
discord.com
CLOUDFLARENET
—
malicious
2972
Discord.exe
173.194.150.171:443
r5---sn-5goeen76.gvt1.com
GOOGLE
US
whitelisted
3952
Discord.exe
162.159.136.234:443
remote-auth-gateway.discord.gg
CLOUDFLARENET
—
shared
—
—
162.159.133.233:443
discordapp.com
CLOUDFLARENET
—
shared

DNS requests

Domain
IP
Reputation
redirector.gvt1.com
  • 172.217.17.110
whitelisted
r5---sn-5goeen76.gvt1.com
  • 173.194.150.171
whitelisted
discord.com
  • 162.159.138.232
  • 162.159.137.232
  • 162.159.136.232
  • 162.159.135.232
  • 162.159.128.233
whitelisted
dl.discordapp.net
  • 162.159.133.232
  • 162.159.129.232
  • 162.159.130.232
  • 162.159.134.232
  • 162.159.128.232
whitelisted
updates.discord.com
  • 162.159.138.232
  • 162.159.136.232
  • 162.159.135.232
  • 162.159.137.232
  • 162.159.128.233
malicious
discordapp.com
  • 162.159.130.233
  • 162.159.134.233
  • 162.159.135.233
  • 162.159.133.233
  • 162.159.129.233
whitelisted
cdn.discordapp.com
  • 162.159.133.233
  • 162.159.135.233
  • 162.159.130.233
  • 162.159.134.233
  • 162.159.129.233
shared
remote-auth-gateway.discord.gg
  • 162.159.136.234
  • 162.159.135.234
  • 162.159.133.234
  • 162.159.130.234
  • 162.159.134.234
suspicious

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
3564
Discord.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
—
—
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
3828
Discord.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
—
—
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discordapp .com)
3952
Discord.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
—
—
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discordapp .com)
3952
Discord.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
Process
Message
DiscordSetup.exe
Start up installer:
DiscordSetup.exe
Elevated process: ?
DiscordSetup.exe
Want standard install
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DiscordSetup.exe