24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 2f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T488,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Draftor.Generic Sample 08b33500f347… — Score 82/100 — Hybrid Analysis","description":"Malicious verdict for sample 08b33500f347…. Malware family: Draftor.Generic. Threat score 82/100. 9/24 AV engines flagged this file. 2 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/08b33500f347d31f5bebd70147c2a7be6ee7fd43ed486c2e881a86ced5e1fb28","keywords":["Malicious","Draftor.Generic","malware analysis","sandbox report","threat intelligence","08b33500f347d31f5bebd70147c2a7be6ee7fd43ed486c2e881a86ced5e1fb28"],"about":{"@type":"SoftwareApplication","name":"FixDiscord.exe","applicationCategory":["peexe","executable"],"identifier":"08b33500f347d31f5bebd70147c2a7be6ee7fd43ed486c2e881a86ced5e1fb28","additionalType":"Malicious sample"},"threatScore":82,"malwareFamily":"Draftor.Generic","antivirusDetections":{"malicious":9,"total":24},"behavioralIndicators":{"malicious":2,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T5de,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "FixDiscord.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "FixDiscord.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "FixDiscord.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "FixDiscord.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "FixDiscord.exe") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "FixDiscord.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "FixDiscord.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "FixDiscord.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp")26:T2b46,Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00005460-37135-52-0034DFAF Assembly shows XOR instruction xor eax esi in Stream UID: 00000000-00005460-37135-137-00322D80 Assembly shows XOR instruction xor edx edi in Stream UID: 00000000-00005460-37135-137-00322D80 Assembly shows XOR instruction xor eax dword ptr [edx+08h] in Stream UID: 00000000-00005460-37135-137-00322D80 Assembly shows XOR instruction xor esi dword ptr [edx+0Ch] in Stream UID: 00000000-00005460-37135-137-00322D80 Assembly shows XOR instruction xor edx 40000000h in Stream UID: 00000000-00005460-37135-155-003376C0 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00005460-37135-155-003376C0 Assembly shows XOR instruction xor edx ebx in Stream UID: 00000000-00005460-37135-155-003376C0 Assembly shows XOR instruction xor ecx 1Fh in Stream UID: 00000000-00005460-37135-155-003376C0 Assembly shows XOR instruction xor eax 1Fh in Stream UID: 00000000-00005460-37135-155-003376C0 Assembly shows XOR instruction xor eax 3Eh in Stream UID: 00000000-00005460-37135-155-003376C0 Assembly shows XOR instruction xor cl 01h in Stream UID: 00000000-00005460-37135-155-003376C0 Assembly shows XOR instruction xor bl cl in Stream UID: 00000000-00005460-37135-156-00337D00 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00005460-37135-156-00337D00 Assembly shows XOR instruction xor bl 01h in Stream UID: 00000000-00005460-37135-156-00337D00 Assembly shows XOR instruction xor edx 40000000h in Stream UID: 00000000-00005460-37135-162-00339CC0 Assembly shows XOR instruction xor ecx dword ptr [ebx-31C6FB85h] in Stream UID: 00000000-00005460-37135-162-00339CC0 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00005460-37135-162-00339CC0 Assembly shows XOR instruction xor edx ebx in Stream UID: 00000000-00005460-37135-162-00339CC0 Assembly shows XOR instruction xor ecx 1Fh in Stream UID: 00000000-00005460-37135-162-00339CC0 Assembly shows XOR instruction xor eax 1Fh in Stream UID: 00000000-00005460-37135-162-00339CC0 Assembly shows XOR instruction xor eax 3Eh in Stream UID: 00000000-00005460-37135-162-00339CC0 Assembly shows XOR instruction xor cl ch in Stream UID: 00000000-00005460-37135-163-0033A280 Assembly shows XOR instruction xor dl ch in Stream UID: 00000000-00005460-37135-163-0033A280 Assembly shows XOR instruction xor al ah in Stream UID: 00000000-00005460-37135-163-0033A280 Assembly shows XOR instruction xor dl ah in Stream UID: 00000000-00005460-37135-163-0033A280 Assembly shows XOR instruction xor edx dword ptr [esp] in Stream UID: 00000000-00005460-37135-177-00331AA1 Assembly shows XOR instruction xor ebx dword ptr [esp+04h] in Stream UID: 00000000-00005460-37135-177-00331AA1 Assembly shows XOR instruction xor edx 40000000h in Stream UID: 00000000-00005460-37135-179-0033D1F0 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00005460-37135-179-0033D1F0 Assembly shows XOR instruction xor edx ebx in Stream UID: 00000000-00005460-37135-179-0033D1F0 Assembly shows XOR instruction xor ecx 1Fh in Stream UID: 00000000-00005460-37135-179-0033D1F0 Assembly shows XOR instruction xor eax 1Fh in Stream UID: 00000000-00005460-37135-179-0033D1F0 Assembly shows XOR instruction xor eax 3Eh in Stream UID: 00000000-00005460-37135-179-0033D1F0 Assembly shows XOR instruction xor cl ch in Stream UID: 00000000-00005460-37135-180-0033D7B0 Assembly shows XOR instruction xor dl ch in Stream UID: 00000000-00005460-37135-180-0033D7B0 Assembly shows XOR instruction xor al ah in Stream UID: 00000000-00005460-37135-180-0033D7B0 Assembly shows XOR instruction xor dl ah in Stream UID: 00000000-00005460-37135-180-0033D7B0 Assembly shows XOR instruction xor eax FFFFFFFEh in Stream UID: 00000000-00005460-37135-206-0032B1FA Assembly shows XOR instruction xor ch cl in Stream UID: 00000000-00005460-37135-206-0032B1FA Assembly shows XOR instruction xor ecx 01h in Stream UID: 00000000-00005460-37135-209-0033E840 Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00005460-37135-238-00327108 Assembly shows XOR instruction xor eax FFFFFFFEh in Stream UID: 00000000-00005460-37135-238-00327108 Assembly shows XOR instruction xor eax FFFFFFFEh in Stream UID: 00000000-00005460-37135-244-00333450 Assembly shows XOR instruction xor ecx dword ptr [ebp-18h] in Stream UID: 00000000-00005460-37135-244-00333450 Assembly shows XOR instruction xor edi esi in Stream UID: 00000000-00005460-37135-244-00333450 Assembly shows XOR instruction xor eax FFFFFFFEh in Stream UID: 00000000-00005460-37135-255-0032BB90 Assembly shows XOR instruction xor eax 0000D800h in Stream UID: 00000000-00005460-37135-270-0031C097 Assembly shows XOR instruction xor eax 02h in Stream UID: 00000000-00005460-37135-287-00326E34 Assembly shows XOR instruction xor eax 02h in Stream UID: 00000000-00005460-37135-294-003265DA Assembly shows XOR instruction xor eax FFFFFFFEh in Stream UID: 00000000-00005460-37135-294-003265DA Assembly shows XOR instruction xor eax 26h in Stream UID: 00000000-00005460-37135-294-003265DA Assembly shows XOR instruction xor ch cl in Stream UID: 00000000-00005460-37135-294-003265DA Assembly shows XOR instruction xor ch dl in Stream UID: 00000000-00005460-37135-294-003265DA Assembly shows XOR instruction xor edx 40000000h in Stream UID: 00000000-00005460-37135-297-0033FBD0 Assembly shows XOR instruction xor eax dword ptr [ebp-20h] in Stream UID: 00000000-00005460-37135-297-0033FBD0 Assembly shows XOR instruction xor edx ebx in Stream UID: 00000000-00005460-37135-297-0033FBD0 Assembly shows XOR instruction xor ecx 1Fh in Stream UID: 00000000-00005460-37135-297-0033FBD0 Assembly shows XOR instruction xor eax 1Fh in Stream UID: 00000000-00005460-37135-297-0033FBD0 Assembly shows XOR instruction xor eax 3Eh in Stream UID: 00000000-00005460-37135-297-0033FBD0 Assembly shows XOR instruction xor cl ch in Stream UID: 00000000-00005460-37135-298-003401B0 Assembly shows XOR instruction xor dl ch in Stream UID: 00000000-00005460-37135-298-003401B0 Assembly shows XOR instruction xor al ah in Stream UID: 00000000-00005460-37135-298-003401B0 Assembly shows XOR instruction xor dl ah in Stream UID: 00000000-00005460-37135-298-003401B0 Assembly shows XOR instruction xor edx 40000000h in Stream UID: 00000000-00005460-37135-310-00340F30 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00005460-37135-310-00340F30 Assembly shows XOR instruction xor edx ebx in Stream UID: 00000000-00005460-37135-310-00340F30 Assembly shows XOR instruction xor ecx 1Fh in Stream UID: 00000000-00005460-37135-310-00340F30 Assembly shows XOR instruction xor eax 1Fh in Stream UID: 00000000-00005460-37135-310-00340F30 Assembly shows XOR instruction xor eax 3Eh in Stream UID: 00000000-00005460-37135-310-00340F30 Assembly shows XOR instruction xor cl ch in Stream UID: 00000000-00005460-37135-311-00341400 Assembly shows XOR instruction xor dl ch in Stream UID: 00000000-00005460-37135-311-00341400 Assembly shows XOR instruction xor eax 03h in Stream UID: 00000000-00005460-37135-311-00341400 Assembly shows XOR instruction xor ecx 03h in Stream UID: 00000000-00005460-37135-311-00341400 Assembly shows XOR instruction xor al cl in Stream UID: 00000000-00005460-37135-311-00341400 Assembly shows XOR instruction xor dl cl in Stream UID: 00000000-00005460-37135-311-00341400 Assembly shows XOR instruction xor cl ch in Stream UID: 00000000-00005460-37135-321-00342360 Assembly shows XOR instruction xor dl ch in Stream UID: 00000000-00005460-37135-321-00342360 Assembly shows XOR instruction xor eax 02h in Stream UID: 00000000-00005460-37135-333-00327F30 Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 00000000-00005460-37135-335-003438C0 Assembly shows XOR instruction xor edx eax in Stream UID: 00000000-00005460-37135-335-003438C0 Assembly shows XOR instruction xor ecx dword ptr [edx] in Stream UID: 00000000-00005460-37135-335-003438C0 Assembly shows XOR instruction xor eax dword ptr [edx+04h] in Stream UID: 00000000-00005460-37135-335-003438C0 Assembly shows XOR instruction xor edx ecx in Stream UID: 00000000-00005460-37135-353-0031400F Assembly shows XOR instruction xor ecx edi in Stream UID: 00000000-00005460-37135-353-0031400F Assembly shows XOR instruction xor eax esi in Stream UID: 00000000-00005460-37135-353-0031400F Assembly shows XOR instruction xor edi esi in Stream UID: 00000000-00005460-37135-353-0031400F Assembly shows XOR instruction xor edx esi in Stream UID: 00000000-00005460-37135-353-0031400F Assembly shows XOR instruction xor edi dword ptr [esp+10h] in Stream UID: 00000000-00005460-37135-353-0031400F Assembly shows XOR instruction xor edi dword ptr [esp+08h] in Stream UID: 00000000-00005460-37135-353-0031400F Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00005460-37135-353-0031400F Assembly shows XOR instruction xor ebx edi in Stream UID: 00000000-00005460-37135-353-0031400F Assembly shows XOR instruction xor eax dword ptr [esp+14h] in Stream UID: 00000000-00005460-37135-353-0031400F Assembly shows XOR instruction xor eax edi in Stream UID: 00000000-00005460-37135-353-0031400F Assembly shows XOR instruction xor edx dword ptr [esp+18h] in Stream UID: 00000000-00005460-37135-353-0031400F Assembly shows XOR instruction xor edx edi in Stream UID: 00000000-00005460-37135-353-0031400F Assembly shows XOR instruction xor ecx ebx in Stream UID: 00000000-00005460-37135-353-0031400F Assembly shows XOR instruction xor esi edi in Stream UID: 00000000-00005460-37135-353-0031400F Assembly shows XOR instruction xor edi ecx in Stream UID: 00000000-00005460-37135-353-0031400F Assembly shows XOR instruction xor dword ptr [esp+0Ch] esi in Stream UID: 00000000-00005460-37135-353-0031400F Assembly shows XOR instruction xor edi dword ptr [esp+1Ch] in Stream UID: 00000000-00005460-37135-353-0031400F Assembly shows XOR instruction xor bl byte ptr [ecx+esi] in Stream UID: 00000000-00005460-37135-353-0031400F Assembly shows XOR instruction xor byte ptr [ebx+eax] dl in Stream UID: 00000000-00005460-37135-353-0031400F Assembly shows XOR instruction xor byte ptr [esi+ecx] dl in Stream UID: 00000000-00005460-37135-353-0031400F Assembly shows XOR instruction xor edi dword ptr [esi+ecx+04h] in Stream UID: 00000000-00005460-37135-353-0031400F Assembly shows XOR instruction xor eax dword ptr [esi+ecx] in Stream UID: 00000000-00005460-37135-353-0031400F Assembly shows XOR instruction xor esi edx in Stream UID: 00000000-00005460-37135-353-0031400F Assembly shows XOR instruction xor ecx esi in Stream UID: 00000000-00005460-37135-353-0031400F Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00005460-37135-353-0031400F Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00005460-37135-353-0031400F27:T6bb,GetProcessHeap@KERNEL32.DLL at 00000000-00005460-37135-111-00322B20 GetProcessHeap@KERNEL32.DLL at 00000000-00005460-37135-117-00320F40 GetProcessHeap@KERNEL32.DLL at 00000000-00005460-37135-119-00315240 GetProcessHeap@KERNEL32.DLL at 00000000-00005460-37135-121-00321000 GetProcessHeap@KERNEL32.DLL at 00000000-00005460-37135-129-003227F0 GetProcessHeap@KERNEL32.DLL at 00000000-00005460-37135-131-00344320 GetProcessHeap@KERNEL32.DLL at 00000000-00005460-37135-135-003472B0 GetProcessHeap@KERNEL32.DLL at 00000000-00005460-37135-150-0033532A GetProcessHeap@KERNEL32.DLL at 00000000-00005460-37135-154-00337430 GetProcessHeap@KERNEL32.DLL at 00000000-00005460-37135-159-00337670 GetProcessHeap@KERNEL32.DLL at 00000000-00005460-37135-160-00334CE2 GetProcessHeap@KERNEL32.DLL at 00000000-00005460-37135-161-00339970 GetProcessHeap@KERNEL32.DLL at 00000000-00005460-37135-164-00339C00 GetProcessHeap@KERNEL32.DLL at 00000000-00005460-37135-168-00331BBC GetProcessHeap@KERNEL32.DLL at 00000000-00005460-37135-170-0033C670 GetProcessHeap@KERNEL32.DLL at 00000000-00005460-37135-172-0033C300 GetProcessHeap@KERNEL32.DLL at 00000000-00005460-37135-173-0033C290 GetProcessHeap@KERNEL32.DLL at 00000000-00005460-37135-174-0033C600 GetProcessHeap@KERNEL32.DLL at 00000000-00005460-37135-175-0033D1D0 GetProcessHeap@KERNEL32.DLL at 00000000-00005460-37135-177-00331AA1 GetProcessHeap@KERNEL32.DLL at 00000000-00005460-37135-178-0033C3D0 GetProcessHeap@KERNEL32.DLL at 00000000-00005460-37135-206-0032B1FA GetProcessHeap@KERNEL32.DLL at 00000000-00005460-37135-209-0033E840 GetProcessHeap@KERNEL32.DLL at 00000000-00005460-37135-212-0032BB30 GetProcessHeap@KERNEL32.DLL at 00000000-00005460-37135-213-0033E5C028:T4985,Found reference to API (Indicator: "GetThreadContext"; File: "FixDiscord.exe") Found reference to API (Indicator: "GetTickCount"; File: "FixDiscord.exe") Found reference to API (Indicator: "ReleaseSemaphore"; File: "FixDiscord.exe") Found reference to API (Indicator: "SuspendThread"; File: "FixDiscord.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "FixDiscord.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "FixDiscord.exe") Found reference to API (Indicator: "SetEvent"; File: "FixDiscord.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "FixDiscord.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "FixDiscord.exe") Found reference to API (Indicator: "ResumeThread"; File: "FixDiscord.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "FixDiscord.exe") Found reference to API (Indicator: "GetThreadPriority"; File: "FixDiscord.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "FixDiscord.exe") Found reference to API (Indicator: "SetThreadPriority"; File: "FixDiscord.exe") Found reference to API (Indicator: "CreateEventA"; File: "FixDiscord.exe") Found reference to API (Indicator: "CreateSemaphoreA"; File: "FixDiscord.exe") Found reference to API (Indicator: "RemoveVectoredExceptionHandler"; File: "FixDiscord.exe") Found reference to API (Indicator: "TryEnterCriticalSection"; File: "FixDiscord.exe") Found reference to API (Indicator: "SetProcessAffinityMask"; File: "FixDiscord.exe") Found reference to API (Indicator: "ResetEvent"; File: "FixDiscord.exe") Found reference to API (Indicator: "SetThreadContext"; File: "FixDiscord.exe") Found reference to API (Indicator: "OutputDebugStringA"; File: "FixDiscord.exe") Found reference to API (Indicator: "VirtualQuery"; File: "FixDiscord.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "FixDiscord.exe") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "FixDiscord.exe") Found reference to API (Indicator: "OpenProcess"; File: "FixDiscord.exe") Found reference to API (Indicator: "GetHandleInformation"; File: "FixDiscord.exe") Found reference to API (Indicator: "RaiseException"; File: "FixDiscord.exe") Found reference to API (Indicator: "VirtualProtect"; File: "FixDiscord.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "FixDiscord.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "FixDiscord.exe") Found reference to API (Indicator: "CreateWaitableTimerExW"; File: "FixDiscord.exe") Found reference to API (Indicator: "GetLastError"; File: "FixDiscord.exe") Found reference to API (Indicator: "Module32FirstW"; File: "FixDiscord.exe") Found reference to API (Indicator: "CreateMutexA"; File: "FixDiscord.exe") Found reference to API (Indicator: "GetProcAddress"; File: "FixDiscord.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "FixDiscord.exe") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "FixDiscord.exe") Found reference to API (Indicator: "CloseHandle"; File: "FixDiscord.exe") Found reference to API (Indicator: "FlsFree"; File: "FixDiscord.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "FixDiscord.exe") Found reference to API (Indicator: "FreeLibrary"; File: "FixDiscord.exe") Found reference to API (Indicator: "CreateFileW"; File: "FixDiscord.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "FixDiscord.exe") Found reference to API (Indicator: "TlsSetValue"; File: "FixDiscord.exe") Found reference to API (Indicator: "GetFileInformationByHandleEx"; File: "FixDiscord.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "FixDiscord.exe") Found reference to API (Indicator: "TlsFree"; File: "FixDiscord.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "FixDiscord.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "FixDiscord.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "FixDiscord.exe") Found reference to API (Indicator: "HeapAlloc"; File: "FixDiscord.exe") Found reference to API (Indicator: "RtlCaptureContext"; File: "FixDiscord.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "FixDiscord.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "FixDiscord.exe") Found reference to API (Indicator: "ReleaseMutex"; File: "FixDiscord.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "FixDiscord.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "FixDiscord.exe") Found reference to API (Indicator: "SetLastError"; File: "FixDiscord.exe") Found reference to API (Indicator: "InitOnceBeginInitialize"; File: "FixDiscord.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "FixDiscord.exe") Found reference to API (Indicator: "TlsGetValue"; File: "FixDiscord.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "FixDiscord.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "FixDiscord.exe") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "FixDiscord.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "FixDiscord.exe") Found reference to API (Indicator: "TlsAlloc"; File: "FixDiscord.exe") Found reference to API (Indicator: "FlsSetValue"; File: "FixDiscord.exe") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "FixDiscord.exe") Found reference to API (Indicator: "InitOnceComplete"; File: "FixDiscord.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "FixDiscord.exe") Found reference to API (Indicator: "UnmapViewOfFile"; File: "FixDiscord.exe") Found reference to API (Indicator: "IsThreadAFiber"; File: "FixDiscord.exe") Found reference to API (Indicator: "SetFileTime"; File: "FixDiscord.exe") Found reference to API (Indicator: "GetCurrentThread"; File: "FixDiscord.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "FixDiscord.exe") Found reference to API (Indicator: "DuplicateHandle"; File: "FixDiscord.exe") Found reference to API (Indicator: "MapViewOfFile"; File: "FixDiscord.exe") Found reference to API (Indicator: "SetFileInformationByHandle"; File: "FixDiscord.exe") Found reference to API (Indicator: "CreateFileMappingA"; File: "FixDiscord.exe") Found reference to API (Indicator: "FormatMessageW"; File: "FixDiscord.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "FixDiscord.exe") Found reference to API (Indicator: "HeapFree"; File: "FixDiscord.exe") Found reference to API (Indicator: "SetThreadStackGuarantee"; File: "FixDiscord.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "FixDiscord.exe") Found reference to API (Indicator: "ExitProcess"; File: "FixDiscord.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "FixDiscord.exe") Found reference to API (Indicator: "SetWaitableTimer"; File: "FixDiscord.exe") Found reference to API (Indicator: "Sleep"; File: "FixDiscord.exe") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "FixDiscord.exe") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "FixDiscord.exe") Found reference to API (Indicator: "FlsAlloc"; File: "FixDiscord.exe") Found reference to API (Indicator: "GetStdHandle"; File: "FixDiscord.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "FixDiscord.exe") Found reference to API (Indicator: "lstrlenW"; File: "FixDiscord.exe") Found reference to API (Indicator: "Module32NextW"; File: "FixDiscord.exe") Found reference to API (Indicator: "NtReadFile"; File: "FixDiscord.exe") Found reference to API (Indicator: "NtWriteFile"; File: "FixDiscord.exe") Found reference to API (Indicator: "RtlNtStatusToDosError"; File: "FixDiscord.exe") Found reference to API (Indicator: "CoInitializeEx"; File: "FixDiscord.exe") Found reference to API (Indicator: "CoGetObject"; File: "FixDiscord.exe") Found reference to API (Indicator: "CoUninitialize"; File: "FixDiscord.exe") Found reference to API (Indicator: "RtlInitUnicodeString"; File: "FixDiscord.exe") Found reference to API (Indicator: "RtlAcquirePebLock"; File: "FixDiscord.exe") Found reference to API (Indicator: "RtlReleasePebLock"; File: "FixDiscord.exe") Found reference to API (Indicator: "SetThreadDescription"; File: "FixDiscord.exe") Found reference to API (Indicator: "RtlInitUnicodeString"; Source: "00000000-00005460.00000000.147487.0035B000.00000002.mdmp") Found reference to API (Indicator: "RtlAcquirePebLock"; Source: "00000000-00005460.00000000.147487.0035B000.00000002.mdmp") Found reference to API (Indicator: "RtlReleasePebLock"; Source: "00000000-00005460.00000000.147487.0035B000.00000002.mdmp") Found reference to API (Indicator: "SetThreadDescription"; Source: "00000000-00005460.00000000.147487.0035B000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "CreateSemaphoreA"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "GetHandleInformation"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "GetProcessAffinityMask"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "GetThreadPriority"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "RemoveVectoredExceptionHandler"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "SetProcessAffinityMask"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "SetThreadPriority"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "SuspendThread"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "AddVectoredExceptionHandler"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "CreateFileMappingA"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "CreateWaitableTimerExW"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "InitOnceBeginInitialize"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "InitOnceComplete"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "IsThreadAFiber"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "Module32FirstW"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "Module32NextW"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp")29:Tf33,Found reference string "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\alloc\src\wtf8\mod.rs" (Indicator: "/rustc/"; File: "FixDiscord.exe") Found reference string "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\alloc\src\raw_vec\mod.rs" (Indicator: "/rustc/"; File: "FixDiscord.exe") Found reference string "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\alloc\src\fmt.rs" (Indicator: "/rustc/"; File: "FixDiscord.exe") Found reference string "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\alloc\src\str.rs" (Indicator: "/rustc/"; File: "FixDiscord.exe") Found reference string "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\core\src\fmt\num.rs" (Indicator: "/rustc/"; File: "FixDiscord.exe") Found reference string "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\core\src\str\mod.rs" (Indicator: "/rustc/"; File: "FixDiscord.exe") Found reference string "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\core\src\wtf8.rs" (Indicator: "/rustc/"; File: "FixDiscord.exe") Found reference string "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\core\src\fmt\mod.rs" (Indicator: "/rustc/"; File: "FixDiscord.exe") Found reference string "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\core\src\panicking.rs" (Indicator: "/rustc/"; File: "FixDiscord.exe") Found reference string "user-provided comparison function does not correctly implement a total order/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\core\src\slice\sort\shared\smallsort.rs" (Indicator: "/rustc/"; File: "FixDiscord.exe") file/memory contains long string with (Indicator: "/rustc/"; File: "FixDiscord.exe") Found reference string "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\alloc\src\collections\btree\map\entry.rs" (Indicator: "/rustc/"; File: "FixDiscord.exe") Found reference string "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\panic_abort\src\lib.rs" (Indicator: "/rustc/"; File: "FixDiscord.exe") Found reference string "ParseIntErrorkind/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\core\src\ops\function.rs" (Indicator: "/rustc/"; File: "FixDiscord.exe") Found reference string "reentrant init/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\core\src\cell\once.rs" (Indicator: "/rustc/"; File: "FixDiscord.exe") Found reference string "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\std\src\sync\once.rs" (Indicator: "/rustc/"; File: "FixDiscord.exe") Found reference string "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\std\src\thread\local.rs" (Indicator: "/rustc/"; File: "FixDiscord.exe") Found reference string "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\core\src\num\wrapping.rs" (Indicator: "/rustc/"; File: "FixDiscord.exe") Found reference string "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\alloc\src\collections\btree\navigate.rs" (Indicator: "/rustc/"; File: "FixDiscord.exe") Found reference string "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\core\src\str\pattern.rs" (Indicator: "/rustc/"; File: "FixDiscord.exe") Found reference string "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\std\src\io\mod.rs" (Indicator: "/rustc/"; File: "FixDiscord.exe") Found reference string "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\std\src\io\stdio.rs" (Indicator: "/rustc/"; File: "FixDiscord.exe") Found reference string "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\std\src\sys\pal\windows\mod.rs" (Indicator: "/rustc/"; File: "FixDiscord.exe") Found reference string "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\core\src\slice\sort\stable\quicksort.rs" (Indicator: "/rustc/"; File: "FixDiscord.exe") Found reference string "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\std\src\panicking.rs" (Indicator: "/rustc/"; File: "FixDiscord.exe")2a:T557,"FixDiscord.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "FixDiscord.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "FixDiscord.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "FixDiscord.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "FixDiscord.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "FixDiscord.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "FixDiscord.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "FixDiscord.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "FixDiscord.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "FixDiscord.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "FixDiscord.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "")2b:T918,"FixDiscord.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "FixDiscord.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "FIXDISCORD.EXE"; Value: "") "FixDiscord.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "FixDiscord.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") "FixDiscord.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") "FixDiscord.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "FixDiscord.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "FixDiscord.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "FixDiscord.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "FixDiscord.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "FixDiscord.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "FixDiscord.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "FixDiscord.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "FixDiscord.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "FixDiscord.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "FixDiscord.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "FixDiscord.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "")2c:T1c1d,Heuristic match: "_fsrc\main.rs" Heuristic match: "/rust/deps\addr2line-0.25.1\src\line.rs" Heuristic match: "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\alloc\src\wtf8\mod.rs" Heuristic match: "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\alloc\src\raw_vec\mod.rs" Heuristic match: "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\alloc\src\fmt.rs" Heuristic match: "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\alloc\src\str.rs" Heuristic match: "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\core\src\fmt\num.rs" Heuristic match: "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\core\src\str\mod.rs" Heuristic match: "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\core\src\wtf8.rs" Heuristic match: "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\core\src\fmt\mod.rs" Heuristic match: "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\core\src\panicking.rs" Heuristic match: "user-provided comparison function does not correctly implement a total order/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\core\src\slice\sort\shared\smallsort.rs" Heuristic match: "notfoundpermissiondeniedconnectionrefusedconnectionresethostunreachablenetworkunreachableconnectionabortednotconnectedaddrinuseaddrnotavailablenetworkdownbrokenpipealreadyexistswouldblocknotadirectoryisadirectorydirectorynotemptyreadonlyfilesystemfilesyste" Heuristic match: "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\alloc\src\collections\btree\map\entry.rs" Heuristic match: "/rust/deps\gimli-0.32.3\src\read\abbrev.rs" Heuristic match: "invalid coff section name base-64 offsetinvalid coff section name base-10 offset/rust/deps\object-0.37.3\src\read\coff\section.rs" Heuristic match: "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\panic_abort\src\lib.rs" Heuristic match: "{invalid syntax}{recursion limit reached}?`fmt::error`s should be impossible without a `fmt::formatter`/rust/deps\rustc-demangle-0.1.27\src\v0.rs" Heuristic match: " -fn() -> + : punycode{}.llvm./rust/deps\rustc-demangle-0.1.27\src\lib.rs" Heuristic match: "/rust/deps\rustc-demangle-0.1.27\src\legacy.rs" Heuristic match: "parseinterrorkind/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\core\src\ops\function.rs" Heuristic match: "reentrant init/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\core\src\cell\once.rs" Heuristic match: "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\std\src\sync\once.rs" Heuristic match: "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\std\src\thread\local.rs" Heuristic match: "/rust/deps\gimli-0.32.3\src\read\line.rs" Heuristic match: "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\core\src\num\wrapping.rs" Heuristic match: "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\alloc\src\collections\btree\navigate.rs" Heuristic match: "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\core\src\str\pattern.rs" Heuristic match: "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\std\src\io\mod.rs" Heuristic match: "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\std\src\io\stdio.rs" Heuristic match: "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\std\src\sys\pal\windows\mod.rs" Heuristic match: "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\core\src\slice\sort\stable\quicksort.rs" Heuristic match: "/rust/deps\object-0.37.3\src\read\coff\symbol.rs" Heuristic match: "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\std\src\panicking.rs" Heuristic match: "/rust/deps\addr2line-0.25.1\src\unit.rs" Heuristic match: "overflow in duration::new/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\core\src\time.rs" Heuristic match: "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\std\src\thread\id.rs" Heuristic match: "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\std\src\sys\stdio\windows.rs" Heuristic match: "fatal runtime error: out of tls indexes, aborting/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\std\src\sys\thread_local\key\windows.rs" Heuristic match: "too many active read locks on rwlock/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\std\src\sys\sync\rwlock\futex.rs" Heuristic match: "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\std\src\..\..\backtrace\src\symbolize\gimli.rs" Heuristic match: "once instance has previously been poisoned/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\std\src\path.rs" Heuristic match: "/rust/deps\addr2line-0.25.1\src\function.rs" Heuristic match: "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\std\src\..\..\backtrace\src\dbghelp.rs" Heuristic match: "rust_backtrace.debug_abbrev.debug_addr.debug_aranges.debug_info.debug_line.debug_line_str.debug_loc.debug_loclists.debug_macinfo.debug_macro.debug_ranges.debug_rnglists.debug_str.debug_str_offsets.debug_typesfatal runtime error: i/o error: operation failed" Heuristic match: "advancing ioslice beyond its length/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\core\src\io\io_slice\repr_windows.rs" Heuristic match: "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\std\src\..\..\backtrace\src\symbolize\gimli\lru.rs" Heuristic match: "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\std\src\..\..\backtrace\src\symbolize\gimli\coff.rs" Heuristic match: "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\std\src\rt.rs" Heuristic match: "thread caused non-unwinding panic. aborting./rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\core\src\slice\index.rs" Heuristic match: "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\std\src\..\..\backtrace\src\symbolize\mod.rs" Heuristic match: "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\std\src\sys\io\error\windows.rs" Heuristic match: "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\std\src\sys\pal\windows\time.rs" Heuristic match: "dat.td" Heuristic match: "$b4sy.ad" Heuristic match: "&x.mv" Heuristic match: "refcell already borrowed/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\alloc\src\collections\btree\node.rs" Heuristic match: "{recursion limit reached}?`fmt::error`s should be impossible without a `fmt::formatter`/rust/deps\rustc-demangle-0.1.27\src\v0.rs" Heuristic match: "-fn() -> + : punycode{}.llvm./rust/deps\rustc-demangle-0.1.27\src\lib.rs" Heuristic match: ".debug_str.debug_str_offsets.debug_typesfatal runtime error: i/o error: operation failed to complete synchronously, abortingadvancing io slices beyond their length/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\core\src\io\io_slice.rs" Heuristic match: "kind/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\core\src\ops\function.rs" Heuristic match: "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\std\src\sys\thread_local\key\windows.rs" Heuristic match: "advancing io slices beyond their length/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\core\src\io\io_slice.rs" Heuristic match: "/rustc/48a229ceaefd4985c50990b14116b6d856af0985/library\core\src\slice\index.rs" Pattern match: "http://www.w3.org/2001/xmlschema-instance"2d:T553,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005460.00000001.147495.02F30000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005460.00000001.147495.02F30000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005460.00000001.147495.02F30000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005460.00000001.147495.02F30000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005460.00000001.147495.02F30000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005460.00000001.147495.02F30000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005460.00000001.147495.02F30000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005460.00000001.147495.02F30000.00000004.mdmp")2e:T7a0,Found reference to API "Module32FirstW" (Indicator: "Module32First"; File: "FixDiscord.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "FixDiscord.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "FixDiscord.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "FixDiscord.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "FixDiscord.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "FixDiscord.exe") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "FixDiscord.exe") Found reference to API "Module32NextW" (Indicator: "Module32Next"; File: "FixDiscord.exe") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API "Module32FirstW" (Indicator: "Module32First"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp") Found reference to API "Module32NextW" (Indicator: "Module32Next"; Source: "00000000-00005460.00000000.147487.0036A000.00000004.mdmp")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"08b33500f347d31f5bebd70147c2a7be6ee7fd43ed486c2e881a86ced5e1fb28","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":82,"unified_at_epoch_ms":1792004565721,"unified_at":"2026-10-14T19:02:45.721Z","metadata":{"hashes":{"sha256":"08b33500f347d31f5bebd70147c2a7be6ee7fd43ed486c2e881a86ced5e1fb28","sha1":"e4a2c62170eb8835a4b6844e07b8a2413f67373a","md5":"a43b91f9795db45441b902b57fbaeb84","sha512":"04ec650698ad0bff225da4aade2890e76ad2910d81ae19ab3b1fd20bd716fccd25af0cff11ff41570415293b29497744e61f0374ac06ea12c927d5d10d39526a","ssdeep":"196608:nxkcCJ7QLvuwbZ1GuW7lMslBDus1fnPSY+QSje4XR8+rcot+vTnFiR9fW7vRlu+m:xknJczuQGuWMwBqs1fn6YFob6vD0N3","ssdeep_chunks":["196608:nxkcCJ7","196608:xkcCJ7Q","196608:kcCJ7QL","196608:cCJ7QLv","196608:CJ7QLvu","196608:J7QLvuw","196608:7QLvuwb","196608:QLvuwbZ","196608:LvuwbZ1","196608:vuwbZ1G","196608:uwbZ1Gu","196608:wbZ1GuW","196608:bZ1GuW7","196608:Z1GuW7l","196608:1GuW7lM","196608:GuW7lMs","196608:uW7lMsl","196608:W7lMslB","196608:7lMslBD","196608:lMslBDu","196608:MslBDus","196608:slBDus1","196608:lBDus1f","196608:BDus1fn","196608:Dus1fnP","196608:us1fnPS","196608:s1fnPSY","196608:1fnPSY+","196608:fnPSY+Q","196608:nPSY+QS","196608:PSY+QSj","196608:SY+QSje","196608:Y+QSje4","196608:+QSje4X","196608:QSje4XR","196608:Sje4XR8","196608:je4XR8+","196608:e4XR8+r","196608:4XR8+rc","196608:XR8+rco","196608:R8+rcot","196608:8+rcot+","196608:+rcot+v","196608:rcot+vT","196608:cot+vTn","196608:ot+vTnF","196608:t+vTnFi","196608:+vTnFiR","196608:vTnFiR9","196608:TnFiR9f","196608:nFiR9fW","196608:FiR9fW7","196608:iR9fW7v","196608:R9fW7vR","196608:9fW7vRl","196608:fW7vRlu","196608:W7vRlu+","196608:7vRlu+m","393216:nxkcCJ7","393216:xkcCJ7Q","393216:kcCJ7QL","393216:cCJ7QLv","393216:CJ7QLvu","393216:J7QLvuw","393216:7QLvuwb","393216:QLvuwbZ","393216:LvuwbZ1","393216:vuwbZ1G","393216:uwbZ1Gu","393216:wbZ1GuW","393216:bZ1GuW7","393216:Z1GuW7l","393216:1GuW7lM","393216:GuW7lMs","393216:uW7lMsl","393216:W7lMslB","393216:7lMslBD","393216:lMslBDu","393216:MslBDus","393216:slBDus1","393216:lBDus1f","393216:BDus1fn","393216:Dus1fnP","393216:us1fnPS","393216:s1fnPSY","393216:1fnPSY+","393216:fnPSY+Q","393216:nPSY+QS","393216:PSY+QSj","393216:SY+QSje","393216:Y+QSje4","393216:+QSje4X","393216:QSje4XR","393216:Sje4XR8","393216:je4XR8+","393216:e4XR8+r","393216:4XR8+rc","393216:XR8+rco","393216:R8+rcot","393216:8+rcot+","393216:+rcot+v","393216:rcot+vT","393216:cot+vTn","393216:ot+vTnF","393216:t+vTnFi","393216:+vTnFiR","393216:vTnFiR9","393216:TnFiR9f","393216:nFiR9fW","393216:FiR9fW7","393216:iR9fW7v","393216:R9fW7vR","393216:9fW7vRl","393216:fW7vRlu","393216:W7vRlu+","393216:7vRlu+m","196608:xknJczu","196608:knJczuQ","196608:nJczuQG","196608:JczuQGu","196608:czuQGuW","196608:zuQGuWM","196608:uQGuWMw","196608:QGuWMwB","196608:GuWMwBq","196608:uWMwBqs","196608:WMwBqs1","196608:MwBqs1f","196608:wBqs1fn","196608:Bqs1fn6","196608:qs1fn6Y","196608:s1fn6YF","196608:1fn6YFo","196608:fn6YFob","196608:n6YFob6","196608:6YFob6v","196608:YFob6vD","196608:Fob6vD0","196608:ob6vD0N","196608:b6vD0N3"],"imphash":"c1cd8a80ccced7578649b17bd17831e6"},"file_info":{"file_name":"FixDiscord.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":15347724,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1792002645000,"last_seen":1792002935000,"last_multi_scan":1792002935000}},"detections":{"summary":{"verdict":"malicious","score":82,"tags":null},"stats":{"av":{"malicious_count":9,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":38},"sandbox_signatures":{"informative_count":71,"suspicious_count":12,"malicious_count":2,"total":85},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_100.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Draftor.27807","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Draftor.27807 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.HZKZ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"VHO:Trojan.Fsysna.gen.nrjt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Draftor.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"suspicious","value":"Contains native function calls"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Reference explorer.exe process"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"suspicious","value":"Opens a handle to the specified process"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"suspicious","value":"Attempts to retrieve the system language code"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Calls an API used to open a process handle"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Stealth","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"},{"type":"informative","value":"YARA signature match – PEB traversal"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Stealth","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"File exhibits characteristics of junk code obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"FixDiscord.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"FixDiscord.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"FixDiscord.exe\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"FixDiscord.exe\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00005460.00000000.147487.0036A000.00000004.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00005460.00000000.147487.0036A000.00000004.mdmp\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00005460.00000000.147487.0036A000.00000004.mdmp\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"00000000-00005460.00000000.147487.0036A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"FixDiscord.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005460.00000000.147487.0036A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"FixDiscord.exe\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"FixDiscord.exe\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00005460.00000000.147487.0036A000.00000004.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005460.00000000.147487.0036A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005460.00000001.147495.02F30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"FixDiscord.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"FixDiscord.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"FixDiscord.exe\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"FixDiscord.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"FixDiscord.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"FixDiscord.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"FixDiscord.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API RtlInitUnicodeString@NTDLL.DLL at 00000000-00005460-37135-365-003125E9","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$26","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"FixDiscord.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005460.00000000.147487.0036A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"RtlNtStatusToDosError\" in file \"FixDiscord.exe\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00005460.00000001.147495.02F30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"FixDiscord.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005460)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: FixDiscord.exe]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"FixDiscord.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"FixDiscord.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005460.00000000.147487.0036A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"$27","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"FixDiscord.exe\" queried token user identity (UID: 00000000-00005460)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineW\" (Source: \"00000000-00005460.00000000.147487.0036A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"FixDiscord.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"FixDiscord.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005460.00000000.147487.0036A000.00000004.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005460.00000000.147487.0036A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"FixDiscord.exe\")\n Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; File: \"FixDiscord.exe\")\n Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; Source: \"00000000-00005460.00000000.147487.0036A000.00000004.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005460.00000000.147487.0036A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForSingleObject@KERNEL32.DLL at 00000000-00005460-37135-81-00321480\n WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00005460-37135-352-00323192\n WaitForSingleObject@KERNEL32.DLL at 00000000-00005460-37135-353-0031400F\n WaitForSingleObject@KERNEL32.DLL at 00000000-00005460-37135-354-00348AC0\n WaitForSingleObject@KERNEL32.DLL at 00000000-00005460-37135-361-003489B0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: FixDiscord.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.DLL at 00000000-00005460-37135-352-00323192\n LoadLibraryA@KERNEL32.DLL at 00000000-00005460-37135-410-003114C0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$28","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"FixDiscord.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005460.00000000.147487.0036A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"FixDiscord.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"FixDiscord.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"FixDiscord.exe\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"FixDiscord.exe\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00005460.00000000.147487.0036A000.00000004.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00005460.00000000.147487.0036A000.00000004.mdmp\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00005460.00000000.147487.0036A000.00000004.mdmp\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"00000000-00005460.00000000.147487.0036A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"FixDiscord.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"FixDiscord.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005460.00000000.147487.0036A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"General","name":"Contains artifacts from Rust programming language","description":"$29","origin":"File/Memory","relevance":1,"id":"string-943","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"FixDiscord.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"FixDiscord.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75060000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"FixDiscord.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74FA0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"FixDiscord.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"FixDiscord.exe\" has an writable section named \".data\"\n \"FixDiscord.exe\" has an writable section named \".bss\"\n \"FixDiscord.exe\" has an writable section named \".idata\"\n \"FixDiscord.exe\" has an writable section named \".CRT\"\n \"FixDiscord.exe\" has an writable section named \".tls\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"FixDiscord.exe\" file has an entrypoint instructions - \"push\tebp,mov\tebp, esp,sub\tesp, 0x18,mov\tdword ptr [ebp - 0xc], 0xff,mov\tdword ptr [0x45a198], 1,call\t0x401102,mov\tdword ptr [ebp - 0xc], eax,mov\teax, dword ptr [ebp - 0xc],leave\t,ret\t,push\tebp,mov\tebp, esp,sub\tesp, 0x18,mov\tdword ptr [ebp - 0xc], 0xff,mov\tdword ptr [0x45a198], 0,call\t0x401102,mov\tdword ptr [ebp - 0xc], eax,mov\teax, dword ptr [ebp - 0xc],leave\t,ret\t,lea\tecx, [esp + 4],and\tesp, 0xfffffff0,push\tdword ptr [ecx - 4],push\tebp,mov\tebp, esp,push\tecx,sub\tesp, 0x44,mov\tdword ptr [ebp - 0x10], 0,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"FixDiscord.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"FixDiscord.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"FixDiscord.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005460.00000000.147487.0036A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Contains ability to delay the execution of current thread","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"FixDiscord.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"FixDiscord.exe\" trying to touch file \"C:\\WINDOWS\\system32\\wow64log.dll\"\n \"FixDiscord.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"FixDiscord.exe\" trying to touch file \"C:\\WINDOWS\\SysWOW64\\apphelp.dll\"\n \"FixDiscord.exe\" trying to touch file \"C:\\FixDiscord.exe\"\n \"FixDiscord.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"FixDiscord.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"FixDiscord.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"FixDiscord.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"FixDiscord.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"FixDiscord.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\wow64log.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – PEB traversal","description":"YARA signature for PEB traversal file \"sample.bin\"\n YARA signature for PEB traversal process \"00000000-00005460\"","origin":"YARA Signature","mitre_attack_id":"T1027.007","relevance":1,"id":"yara-166","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Rust-compiled binary","description":"YARA signature for Rust-compiled binary file \"sample.bin\"","origin":"YARA Signature","relevance":1,"id":"yara-185","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"FixDiscord.exe\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00005460.00000000.147487.0036A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"SymGetModuleBase64\" (Indicator: \"base64\"; File: \"FixDiscord.exe\")\n Found string \"SymGetModuleBase64\" (Indicator: \"base64\"; Source: \"00000000-00005460.00000000.147487.0035B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"NtReadFile\" (Indicator: \"NtReadFile\"; File: \"FixDiscord.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"FixDiscord.exe\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"FixDiscord.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"FixDiscord.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005460.00000000.147487.0036A000.00000004.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005460.00000000.147487.0036A000.00000004.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005460.00000000.147487.0036A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"FixDiscord.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005460.00000000.147487.0036A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; File: \"FixDiscord.exe\")\n Found reference to API \"GetFileInformationByHandle\" (Indicator: \"GetFileInformationByHandle\"; File: \"FixDiscord.exe\")\n Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; File: \"FixDiscord.exe\")\n Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; Source: \"00000000-00005460.00000000.147487.0036A000.00000004.mdmp\")\n Found reference to API \"GetFileInformationByHandle\" (Indicator: \"GetFileInformationByHandle\"; Source: \"00000000-00005460.00000000.147487.0036A000.00000004.mdmp\")\n Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; Source: \"00000000-00005460.00000000.147487.0036A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"FixDiscord.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005460.00000000.147487.0036A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"FixDiscord.exe\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00005460.00000000.147487.0036A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"FixDiscord.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005460.00000000.147487.0036A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: FixDiscord.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; File: \"FixDiscord.exe\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"FixDiscord.exe\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00005460.00000000.147487.0036A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"FixDiscord.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005460.00000000.147487.0036A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; File: \"FixDiscord.exe\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"GetTokenInformation\" which can \"retrieve a specified type of information about an access token\" [Source: FixDiscord.exe]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"FixDiscord.exe\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"FixDiscord.exe\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00005460.00000000.147487.0036A000.00000004.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00005460.00000000.147487.0036A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"RtlInitUnicodeString\" (Source: FixDiscord.exe, API is part of module: NTDLL.DLL)\n Found string \"RtlAcquirePebLock\" (Source: FixDiscord.exe, API is part of module: NTDLL.DLL)\n Found string \"RtlReleasePebLock\" (Source: FixDiscord.exe, API is part of module: NTDLL.DLL)\n Found string \"SetThreadDescription\" (Source: FixDiscord.exe, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"FixDiscord.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"C:\\Windows\\explorer.exe\" (Indicator: \"explorer.exe\"; File: \"FixDiscord.exe\")\n Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; File: \"FixDiscord.exe\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-481","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"Section \".data\" has very low entropy (0.51)\n indicating potential NOP sled","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; File: \"FixDiscord.exe\")\n Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00005460.00000000.147487.0035B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve the system language code","description":"\"FixDiscord.exe\" called \"NtQueryInstallUILanguage\" with parameters {\"LanguageId\": \"1033\"}","origin":"API Call","mitre_attack_id":"T1614.001","relevance":10,"id":"api-307","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleExW@KERNEL32.DLL at 00000000-00005460-37135-126-00320C90\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005460-37135-365-003125E9\n GetModuleHandleA@KERNEL32.DLL at 00000000-00005460-37135-410-003114C0\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005460-37135-488-00321C20\n GetModuleHandleA@KERNEL32.DLL at 00000000-00005460-37135-553-00347C00","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\FixDiscord.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"8/23 Antivirus vendors marked sample as malicious (34% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Opens a handle to the specified process","description":"\"FixDiscord.exe\" opens a process \"C:\\FixDiscord.exe\" (UID: 00000000-00005460)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-237","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid Timestamp of PE file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM\" matched file \"sample.bin\" as \"Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)\"","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtWriteFile@NTDLL.DLL at 00000000-00005460-37135-81-00321480\n NtWriteFile@NTDLL.DLL at 00000000-00005460-37135-109-00348D44\n NtReadFile@NTDLL.DLL at 00000000-00005460-37135-353-0031400F\n NtReadFile@NTDLL.DLL at 00000000-00005460-37135-354-00348AC0\n NtReadFile@NTDLL.DLL at 00000000-00005460-37135-355-00348D3C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetThreadContext\n GetTickCount\n IsDebuggerPresent\n OutputDebugStringA\n OpenProcess\n VirtualProtect\n OpenProcessToken\n GetProcAddress\n LoadLibraryA\n CreateFileW\n GetModuleHandleA\n GetModuleHandleExW\n GetModuleHandleW\n MapViewOfFile\n CreateFileMappingA\n GetModuleFileNameW\n Sleep\n CreateToolhelp32Snapshot\n GetCommandLineW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"FixDiscord.exe\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (D)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":22,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sandbox_reports":[{"id":"6acfcb75e71a374a6000dd8c","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":82,"malware_family":"Gen:Variant.Draftor","submit_name":"FixDiscord.exe","analysis_start_time":"2026-10-14T18:35:36+00:00","indicators_count":{"informative":71,"suspicious":22,"malicious":2},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6acfcb75e71a374a6000dd8c"}],"processes":[{"pid":5460,"ppid":0,"name":"FixDiscord.exe","command_line":"","sha256":"08b33500f347d31f5bebd70147c2a7be6ee7fd43ed486c2e881a86ced5e1fb28","normalized_path":"C:\\FixDiscord.exe","uid":"00000000-00005460","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="}],"all_imported_dlls":["wow64win.dll","apphelp.dll","sechost.dll","sspicli.dll","ntdll.dll","ucrtbase.dll","msvcrt.dll","rpcrt4.dll","cryptbase.dll","bcryptprimitives.dll","gdi32.dll","gdi32full.dll","wow64.dll","kernel32.dll","combase.dll","msvcp_win.dll","win32u.dll","user32.dll","wow64cpu.dll","KernelBase.dll","advapi32.dll","ole32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6acfcb75e71a374a6000dd8c"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Draftor.Generic Sample 08b33500f347… — Score 82/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 08b33500f347…. Malware family: Draftor.Generic. Threat score 82/100. 9/24 AV engines flagged this file. 2 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/08b33500f347d31f5bebd70147c2a7be6ee7fd43ed486c2e881a86ced5e1fb28"}],["$","meta","4",{"property":"og:title","content":"Malicious Draftor.Generic Sample 08b33500f347… — Score 82/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 08b33500f347…. Malware family: Draftor.Generic. Threat score 82/100. 9/24 AV engines flagged this file. 2 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/08b33500f347d31f5bebd70147c2a7be6ee7fd43ed486c2e881a86ced5e1fb28"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Draftor.Generic Sample 08b33500f347… — Score 82/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 08b33500f347…. Malware family: Draftor.Generic. Threat score 82/100. 9/24 AV engines flagged this file. 2 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2f","11",{}]]