analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

DiscordSetup.exe

Full analysis: https://app.any.run/tasks/f6b02cc0-f23a-485f-a842-8e46408c39dd
Verdict: Malicious activity
Analysis date: October 05, 2022, 00:58:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

2F8A7BB9C48C4B3ECF223D1FBBD8AFA3

SHA1:

6D00DC4F25408161AC63B1D28226C515E9EC04C5

SHA256:

5EDC53181D1300141E42BC756A7188949F3CE6BBEBCAFE80CD8E326DEEC21EAE

SSDEEP:

1572864:OE4SZ1wRDBY5ev0B1QvvPz7OlCc5a5vE8HnJRk7u/lGyTtwc7vPkux4uneCsL:OELZ1wLYcv0ByvPHOlCc5sE8fpd7hxJC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • DiscordSetup.exe (PID: 2896)
      • Update.exe (PID: 1528)
      • Discord.exe (PID: 3564)
      • Discord.exe (PID: 3828)

    • Application was dropped or rewritten from another process

      • Update.exe (PID: 1528)
      • Update.exe (PID: 3460)

    • Loads dropped or rewritten executable

      • Discord.exe (PID: 1944)
      • Discord.exe (PID: 2816)
      • Discord.exe (PID: 2488)
      • Discord.exe (PID: 3564)
      • Discord.exe (PID: 3784)
      • Discord.exe (PID: 2324)
      • Discord.exe (PID: 2972)
      • Discord.exe (PID: 2436)
      • Discord.exe (PID: 1376)
      • Discord.exe (PID: 2956)
      • Discord.exe (PID: 3828)
      • Discord.exe (PID: 3244)
      • Discord.exe (PID: 2180)
      • Discord.exe (PID: 3952)
      • Discord.exe (PID: 2380)
      • Discord.exe (PID: 4084)
      • Discord.exe (PID: 3340)

    • Changes the autorun value in the registry

      • reg.exe (PID: 3480)
      • reg.exe (PID: 2412)

  • SUSPICIOUS

    • Checks supported languages

      • DiscordSetup.exe (PID: 2896)
      • Update.exe (PID: 1528)
      • Discord.exe (PID: 2816)
      • Update.exe (PID: 3460)
      • Discord.exe (PID: 1944)
      • Discord.exe (PID: 2488)
      • Discord.exe (PID: 3564)
      • Discord.exe (PID: 3784)
      • Discord.exe (PID: 2324)
      • Discord.exe (PID: 2972)
      • Discord.exe (PID: 2436)
      • Discord.exe (PID: 1376)
      • Discord.exe (PID: 3828)
      • Discord.exe (PID: 2956)
      • Discord.exe (PID: 3244)
      • Discord.exe (PID: 3952)
      • Discord.exe (PID: 2180)
      • Discord.exe (PID: 2380)
      • Discord.exe (PID: 4084)
      • Discord.exe (PID: 3340)
      • cmd.exe (PID: 3400)

    • Executable content was dropped or overwritten

      • DiscordSetup.exe (PID: 2896)
      • Update.exe (PID: 1528)
      • Discord.exe (PID: 3564)
      • Discord.exe (PID: 3828)

    • Drops a file with a compile date too recent

      • DiscordSetup.exe (PID: 2896)
      • Update.exe (PID: 1528)
      • Discord.exe (PID: 3564)
      • Discord.exe (PID: 3828)

    • Reads the computer name

      • Update.exe (PID: 1528)
      • Discord.exe (PID: 2816)
      • Update.exe (PID: 3460)
      • Discord.exe (PID: 2488)
      • Discord.exe (PID: 3564)
      • Discord.exe (PID: 2324)
      • Discord.exe (PID: 2972)
      • Discord.exe (PID: 1376)
      • Discord.exe (PID: 3828)
      • Discord.exe (PID: 3244)
      • Discord.exe (PID: 3952)
      • Discord.exe (PID: 2380)
      • Discord.exe (PID: 4084)
      • Discord.exe (PID: 3340)

    • Reads Environment values

      • Discord.exe (PID: 2816)
      • Discord.exe (PID: 3564)
      • Discord.exe (PID: 3828)
      • Discord.exe (PID: 4084)

    • Application launched itself

      • Discord.exe (PID: 2816)
      • Discord.exe (PID: 3564)
      • Discord.exe (PID: 3828)

    • Creates files in the user directory

      • Discord.exe (PID: 1944)
      • Discord.exe (PID: 2816)
      • Update.exe (PID: 3460)
      • Discord.exe (PID: 3564)
      • Discord.exe (PID: 2972)
      • Discord.exe (PID: 3828)
      • Discord.exe (PID: 3952)
      • Discord.exe (PID: 4084)

    • Uses REG.EXE to modify Windows registry

      • Discord.exe (PID: 2816)
      • Discord.exe (PID: 3564)
      • Discord.exe (PID: 3828)

    • Changes default file association

      • reg.exe (PID: 524)
      • reg.exe (PID: 3388)
      • reg.exe (PID: 2880)

    • Creates a software uninstall entry

      • Update.exe (PID: 1528)

    • Reads CPU info

      • Discord.exe (PID: 4084)

    • Starts CMD.EXE for commands execution

      • Discord.exe (PID: 4084)

  • INFO

    • Checks supported languages

      • WISPTIS.EXE (PID: 2404)
      • reg.exe (PID: 3480)
      • reg.exe (PID: 2568)
      • reg.exe (PID: 2732)
      • reg.exe (PID: 1856)
      • reg.exe (PID: 524)
      • reg.exe (PID: 2784)
      • reg.exe (PID: 3412)
      • reg.exe (PID: 3632)
      • reg.exe (PID: 3388)
      • reg.exe (PID: 1760)
      • reg.exe (PID: 2412)
      • reg.exe (PID: 3556)
      • reg.exe (PID: 2264)
      • reg.exe (PID: 2184)
      • reg.exe (PID: 2880)

    • Reads the computer name

      • WISPTIS.EXE (PID: 2404)

    • Reads the hosts file

      • Discord.exe (PID: 2816)
      • Discord.exe (PID: 3564)
      • Discord.exe (PID: 2972)
      • Discord.exe (PID: 3828)
      • Discord.exe (PID: 3952)

    • Reads settings of System Certificates

      • Discord.exe (PID: 3564)
      • Discord.exe (PID: 3828)
      • Discord.exe (PID: 4084)

    • Checks Windows Trust Settings

      • Discord.exe (PID: 4084)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2021-Aug-07 00:35:47
Detected languages:
  • English - United States
Debug artifacts:
  • C:\Users\michael.pavone\Squirrel.Windows\src\Setup\bin\Release\Setup.pdb
FileDescription: Discord - https://discord.com/
FileVersion: 1.0.9004
InternalName: Setup.exe
LegalCopyright: Copyright (c) 2022 Discord Inc. All rights reserved.
OriginalFilename: Setup.exe
ProductName: Discord - https://discord.com/
ProductVersion: 1.0.9004
SquirrelAwareVersion: 1
CompanyName: Discord Inc.

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 280

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 7
TimeDateStamp: 2021-Aug-07 00:35:47
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
4096
131381
131584
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.63723
.rdata
139264
46958
47104
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.92214
.data
188416
6428
3584
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.0684
.gfids
196608
300
512
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
2.33673
.tls
200704
9
512
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.0203931
.rsrc
204800
82793672
82793984
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.9981
.reloc
83001344
7056
7168
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.61065

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.01108
1128
Latin 1 / Western European
English - United States
RT_ICON
2
3.49078
4264
Latin 1 / Western European
English - United States
RT_ICON
3
3.67794
9640
Latin 1 / Western European
English - United States
RT_ICON
4
2.40176
270376
Latin 1 / Western European
English - United States
RT_ICON
7
3.00563
142
Latin 1 / Western European
English - United States
RT_STRING
107
2.37447
34
Latin 1 / Western European
English - United States
RT_GROUP_ICON
108
2.49212
34
Latin 1 / Western European
English - United States
RT_GROUP_ICON
131
7.99865
82505385
Latin 1 / Western European
English - United States
DATA
1 (#2)
2.37928
62
Latin 1 / Western European
English - United States
RT_GROUP_ICON
1 (#3)
3.41043
896
Latin 1 / Western European
English - United States
RT_VERSION

Imports

COMCTL32.dll
KERNEL32.dll
USER32.dll (delay-loaded)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
95
Monitored processes
38
Malicious processes
8
Suspicious processes
6

Behavior graph

Click at the process to see the details
drop and start start discordsetup.exe update.exe wisptis.exe no specs wisptis.exe discord.exe no specs discord.exe no specs update.exe no specs discord.exe no specs reg.exe reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs discord.exe discord.exe no specs discord.exe no specs reg.exe no specs discord.exe discord.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs discord.exe no specs reg.exe no specs reg.exe discord.exe discord.exe no specs discord.exe no specs reg.exe no specs discord.exe discord.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs discord.exe no specs discord.exe no specs discord.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2896"C:\Users\admin\Desktop\DiscordSetup.exe" C:\Users\admin\Desktop\DiscordSetup.exe
Explorer.EXE
User:
admin
Company:
Discord Inc.
Integrity Level:
MEDIUM
Description:
Discord - https://discord.com/
Exit code:
0
Version:
1.0.9004
Modules
Images
c:\users\admin\desktop\discordsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
1528"C:\Users\admin\AppData\Local\SquirrelTemp\Update.exe" --install . C:\Users\admin\AppData\Local\SquirrelTemp\Update.exe
DiscordSetup.exe
User:
admin
Company:
GitHub
Integrity Level:
MEDIUM
Description:
Update
Exit code:
0
Version:
1.1.1.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\squirreltemp\update.exe
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3924"C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;C:\Windows\SYSTEM32\WISPTIS.EXE—Update.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Pen and Touch Input Component
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wisptis.exe
c:\windows\system32\ntdll.dll
2404"C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;C:\Windows\SYSTEM32\WISPTIS.EXE
Update.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Pen and Touch Input Component
Exit code:
24
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wisptis.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2816"C:\Users\admin\AppData\Local\Discord\app-1.0.9004\Discord.exe" --squirrel-install 1.0.9004C:\Users\admin\AppData\Local\Discord\app-1.0.9004\Discord.exe—Update.exe
User:
admin
Company:
Discord Inc.
Integrity Level:
MEDIUM
Description:
Discord
Exit code:
0
Version:
1.0.9004
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\discord\app-1.0.9004\discord.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\discord\app-1.0.9004\ffmpeg.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1944C:\Users\admin\AppData\Local\Discord\app-1.0.9004\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\admin\AppData\Roaming\discord /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\admin\AppData\Roaming\discord\Crashpad --url=https://sentry.io/api/146342/minidump/?sentry_key=384ce4413de74fe0be270abe03b2b35a "--annotation=_companyName=Discord Inc." --annotation=_productName=Discord --annotation=_version=1.0.9004 --annotation=prod=Electron --annotation=ver=13.6.6 --initial-client-data=0x2e8,0x2ec,0x2f0,0x2e0,0x2f4,0x7113850,0x7113860,0x711386cC:\Users\admin\AppData\Local\Discord\app-1.0.9004\Discord.exe—Discord.exe
User:
admin
Company:
Discord Inc.
Integrity Level:
MEDIUM
Description:
Discord
Exit code:
0
Version:
1.0.9004
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\users\admin\appdata\local\discord\app-1.0.9004\discord.exe
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\discord\app-1.0.9004\ffmpeg.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
3460C:\Users\admin\AppData\Local\Discord\Update.exe --createShortcut Discord.exe --setupIcon C:\Users\admin\AppData\Local\Discord\app.icoC:\Users\admin\AppData\Local\Discord\Update.exe—Discord.exe
User:
admin
Company:
GitHub
Integrity Level:
MEDIUM
Description:
Update
Exit code:
0
Version:
1.1.1.0
Modules
Images
c:\users\admin\appdata\local\discord\update.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2488"C:\Users\admin\AppData\Local\Discord\app-1.0.9004\Discord.exe" --type=gpu-process --field-trial-handle=1120,9737510850198673215,6113243337378282999,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1116 /prefetch:2C:\Users\admin\AppData\Local\Discord\app-1.0.9004\Discord.exe—Discord.exe
User:
admin
Company:
Discord Inc.
Integrity Level:
LOW
Description:
Discord
Exit code:
0
Version:
1.0.9004
Modules
Images
c:\users\admin\appdata\local\discord\app-1.0.9004\discord.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\users\admin\appdata\local\discord\app-1.0.9004\ffmpeg.dll
c:\windows\system32\lpk.dll
3480C:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "C:\Users\admin\AppData\Local\Discord\Update.exe --processStart Discord.exe" /fC:\Windows\System32\reg.exe
Discord.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2568C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /fC:\Windows\System32\reg.exe—Discord.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\reg.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\user32.dll
Total events
16 858
Read events
16 732
Write events
126
Delete events
0

Modification events

(PID) Process:(1528) Update.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
Update.exe
(PID) Process:(1528) Update.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1528) Update.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1528) Update.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1528) Update.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2404) WISPTIS.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
WISPTIS.EXE
(PID) Process:(2404) WISPTIS.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Wisp\Touch
Operation:writeName:TouchGate
Value:
1
(PID) Process:(2404) WISPTIS.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Wisp\MultiTouch
Operation:writeName:MultiTouchEnabled
Value:
1
(PID) Process:(2404) WISPTIS.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Wisp\Pen\SysEventParameters
Operation:writeName:FlickMode
Value:
1
(PID) Process:(2404) WISPTIS.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Wisp\Pen\SysEventParameters
Operation:writeName:TouchFlickTolerance
Value:
50
Executable files
45
Suspicious files
290
Text files
1 226
Unknown types
205

Dropped files

PID
Process
Filename
Type
2896DiscordSetup.exeC:\Users\admin\AppData\Local\SquirrelTemp\Discord-1.0.9004-full.nupkg —
MD5:—
SHA256:—
1528Update.exeC:\Users\admin\AppData\Local\Discord\packages\Discord-1.0.9004-full.nupkg —
MD5:—
SHA256:—
1528Update.exeC:\Users\admin\AppData\Local\Discord\app-1.0.9004\lib\net45\Discord.exe —
MD5:—
SHA256:—
1528Update.exeC:\Users\admin\AppData\Local\Discord\app-1.0.9004\lib\net45\icudtl.dat —
MD5:—
SHA256:—
1528Update.exeC:\Users\admin\AppData\Local\Discord\app-1.0.9004\lib\net45\resources.pak —
MD5:—
SHA256:—
2896DiscordSetup.exeC:\Users\admin\AppData\Local\SquirrelTemp\RELEASEStext
MD5:6AAB95E146FA773BA3B0CDA33C67B032
SHA256:002EBBB665B2C208636EE9C59473091E75554F097585B6616CE9871B6D335913
1528Update.exeC:\Users\admin\AppData\Local\Discord\app-1.0.9004\lib\net45\ffmpeg.dllexecutable
MD5:9B42ABF15163AF5D85210D289E1F8CB3
SHA256:7D35C0B8786CF30FE1A32D9D27DA491E575B81D9A0BB11076B02661D20A5A2AB
1528Update.exeC:\Users\admin\AppData\Local\Discord\app-1.0.9004\lib\net45\installer.dbsqlite
MD5:B9D1D3F3BF3F14AF6A16EE2CA412E3A4
SHA256:F5774ECA840880F31A0932A9A6A56BB926E015964821A66ADFA46FC13FB69A87
1528Update.exeC:\Users\admin\AppData\Local\Discord\app-1.0.9004\lib\net45\vk_swiftshader.dllexecutable
MD5:89217B7853A3D1FA814FA3CA6EDA2477
SHA256:9FD78AA36A548477D19DECE9FC5A7C1978C790120A6D44194C4BB5A8F45FD496
1528Update.exeC:\Users\admin\AppData\Local\Discord\app-1.0.9004\lib\net45\updater.nodeexecutable
MD5:3B8EDD09C20448500394CC73BAF5BE91
SHA256:600D1DFFC7F08644396556ED4F9B26F55F2E19B43810827804A013FBC0AAB4A5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
12
DNS requests
11
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2972
Discord.exe
172.217.17.110:443
redirector.gvt1.com
GOOGLE
US
whitelisted
3564
Discord.exe
162.159.138.232:443
discord.com
CLOUDFLARENET
—
malicious
3952
Discord.exe
162.159.136.234:443
remote-auth-gateway.discord.gg
CLOUDFLARENET
—
shared
3828
Discord.exe
162.159.133.232:443
dl.discordapp.net
CLOUDFLARENET
—
shared
—
—
162.159.133.233:443
discordapp.com
CLOUDFLARENET
—
shared
3828
Discord.exe
162.159.138.232:443
discord.com
CLOUDFLARENET
—
malicious
3952
Discord.exe
162.159.130.233:443
discordapp.com
CLOUDFLARENET
—
shared
3564
Discord.exe
162.159.133.232:443
dl.discordapp.net
CLOUDFLARENET
—
shared
2972
Discord.exe
173.194.150.171:443
r5---sn-5goeen76.gvt1.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
redirector.gvt1.com
  • 172.217.17.110
whitelisted
r5---sn-5goeen76.gvt1.com
  • 173.194.150.171
whitelisted
discord.com
  • 162.159.138.232
  • 162.159.137.232
  • 162.159.136.232
  • 162.159.135.232
  • 162.159.128.233
whitelisted
dl.discordapp.net
  • 162.159.133.232
  • 162.159.129.232
  • 162.159.130.232
  • 162.159.134.232
  • 162.159.128.232
whitelisted
updates.discord.com
  • 162.159.138.232
  • 162.159.136.232
  • 162.159.135.232
  • 162.159.137.232
  • 162.159.128.233
malicious
discordapp.com
  • 162.159.130.233
  • 162.159.134.233
  • 162.159.135.233
  • 162.159.133.233
  • 162.159.129.233
whitelisted
cdn.discordapp.com
  • 162.159.133.233
  • 162.159.135.233
  • 162.159.130.233
  • 162.159.134.233
  • 162.159.129.233
shared
remote-auth-gateway.discord.gg
  • 162.159.136.234
  • 162.159.135.234
  • 162.159.133.234
  • 162.159.130.234
  • 162.159.134.234
suspicious

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
3564
Discord.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
—
—
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
3828
Discord.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
—
—
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discordapp .com)
3952
Discord.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
—
—
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discordapp .com)
3952
Discord.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
Process
Message
DiscordSetup.exe
Start up installer:
DiscordSetup.exe
Elevated process: ?
DiscordSetup.exe
Want standard install
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
DiscordSetup.exe