22df35ddc3824d58e5e3419e9564c38bf92c7d86de0cb9081c2080658d9f2d88

Analysis

max time kernel
150s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/07/2026, 00:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DiscordCanarySetup.exe
Size 139.3MB
Sample260713-a6v7macv7x
SHA256 22df35ddc3824d58e5e3419e9564c38bf92c7d86de0cb9081c2080658d9f2d88
MD5 092286b6f391aca2032257f7d9003ecf
SHA1 100b3af0c9d3767e363230355108d985c385730a
SHA512 e3df022882f48a88ddc5a94085320840b782718fb1822a3326fff6e34f020b3d0e608e379cb9a105b65929068f234ec1cc5169cb201624aa8aab3459b208adae
SSDEEP 3145728:otJUXHtoRbltvYlzmvMo+AgiE8SOnO0yKYtC0PbFMAK:otKaRbHvYEvMZQHOo0PbFMN
TLSH
T1D168330A04B0428AEF61283A9AF3D255501F3DB96C260587177C3712BF7DDDAB8B6E1D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\DiscordCanary = "\"C:\\Users\\Admin\\AppData\\Local\\DiscordCanary\\Update.exe\" --processStart DiscordCanary.exe --process-start-args \"--start-inactive\""	reg.exe

Executes dropped EXE 12 IoCs

pid	Process
4608	Update.exe
6072	DiscordCanary.exe
4804	DiscordCanary.exe
1368	Update.exe
4292	DiscordCanary.exe
5568	DiscordCanary.exe
4308	Update.exe
2188	DiscordCanary.exe
4524	DiscordCanary.exe
1076	DiscordCanary.exe
2192	DiscordCanary.exe
4116	DiscordCanary.exe

Loads dropped DLL 12 IoCs

pid	Process
5568	DiscordCanary.exe
5568	DiscordCanary.exe
5568	DiscordCanary.exe
5568	DiscordCanary.exe
5568	DiscordCanary.exe
2192	DiscordCanary.exe
2192	DiscordCanary.exe
2192	DiscordCanary.exe
2192	DiscordCanary.exe
2192	DiscordCanary.exe
2188	DiscordCanary.exe
4116	DiscordCanary.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DiscordCanarySetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe

Checks processor information in registry 2 TTPs 48 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	DiscordCanary.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	DiscordCanary.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	DiscordCanary.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	DiscordCanary.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	DiscordCanary.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	DiscordCanary.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	DiscordCanary.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	DiscordCanary.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	DiscordCanary.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	DiscordCanary.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	DiscordCanary.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	DiscordCanary.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	DiscordCanary.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	DiscordCanary.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	DiscordCanary.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	DiscordCanary.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	DiscordCanary.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	DiscordCanary.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	DiscordCanary.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	DiscordCanary.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	DiscordCanary.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	DiscordCanary.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	DiscordCanary.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	DiscordCanary.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	DiscordCanary.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	DiscordCanary.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	DiscordCanary.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	DiscordCanary.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	DiscordCanary.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	DiscordCanary.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	DiscordCanary.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	DiscordCanary.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	DiscordCanary.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	DiscordCanary.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	DiscordCanary.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	DiscordCanary.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	DiscordCanary.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	DiscordCanary.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	DiscordCanary.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	DiscordCanary.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	DiscordCanary.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	DiscordCanary.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	DiscordCanary.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	DiscordCanary.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	DiscordCanary.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	DiscordCanary.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	DiscordCanary.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	DiscordCanary.exe

Modifies registry class 19 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Discord\URL Protocol	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Discord\shell\open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Discord\DefaultIcon	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Discord\ = "URL:Discord Protocol"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Discord	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Discord	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Discord\ = "URL:Discord Protocol"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Discord\URL Protocol	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Discord\shell\open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Discord\shell	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Discord\shell\open	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Discord	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Discord\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\DiscordCanary\\app-1.0.1037\\DiscordCanary.exe\",-1"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Discord\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\DiscordCanary\\app-1.0.1037\\DiscordCanary.exe\" --url -- \"%1\""	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Discord	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Discord\DefaultIcon	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Discord\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\DiscordCanary\\app-1.0.1037\\DiscordCanary.exe\",-1"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Discord\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\DiscordCanary\\app-1.0.1037\\DiscordCanary.exe\" --url -- \"%1\""	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Discord	reg.exe

Modifies registry key 1 TTPs 10 IoCs

Modify Registry

T1112

pid	Process
2164	reg.exe
944	reg.exe
5008	reg.exe
5212	reg.exe
4356	reg.exe
4492	reg.exe
5556	reg.exe
4368	reg.exe
5576	reg.exe
3300	reg.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6072	DiscordCanary.exe
Token: SeCreatePagefilePrivilege	6072	DiscordCanary.exe
Token: SeShutdownPrivilege	2188	DiscordCanary.exe
Token: SeCreatePagefilePrivilege	2188	DiscordCanary.exe
Token: SeShutdownPrivilege	2188	DiscordCanary.exe
Token: SeCreatePagefilePrivilege	2188	DiscordCanary.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4608	Update.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 4608	2428	DiscordCanarySetup.exe	87
PID 4608 wrote to memory of 6072	4608	Update.exe	88
PID 6072 wrote to memory of 4804	6072	DiscordCanary.exe	89
PID 6072 wrote to memory of 1368	6072	DiscordCanary.exe	90
PID 6072 wrote to memory of 4292	6072	DiscordCanary.exe	91
PID 6072 wrote to memory of 5568	6072	DiscordCanary.exe	92
PID 6072 wrote to memory of 5556	6072	DiscordCanary.exe	93
PID 6072 wrote to memory of 2164	6072	DiscordCanary.exe	95
PID 6072 wrote to memory of 4368	6072	DiscordCanary.exe	97
PID 6072 wrote to memory of 5576	6072	DiscordCanary.exe	99
PID 6072 wrote to memory of 944	6072	DiscordCanary.exe	101
PID 6072 wrote to memory of 3300	6072	DiscordCanary.exe	103
PID 4308 wrote to memory of 2188	4308	Update.exe	108
PID 2188 wrote to memory of 4524	2188	DiscordCanary.exe	109
PID 2188 wrote to memory of 2192	2188	DiscordCanary.exe	110
PID 2188 wrote to memory of 1076	2188	DiscordCanary.exe	111
PID 2188 wrote to memory of 5008	2188	DiscordCanary.exe	112
PID 2188 wrote to memory of 4116	2188	DiscordCanary.exe	114
PID 2188 wrote to memory of 5212	2188	DiscordCanary.exe	115
PID 2188 wrote to memory of 4356	2188	DiscordCanary.exe	117
PID 2188 wrote to memory of 4492	2188	DiscordCanary.exe	119

C:\Users\Admin\AppData\Local\Temp\DiscordCanarySetup.exe
"C:\Users\Admin\AppData\Local\Temp\DiscordCanarySetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\DiscordCanary.exe
    "C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\DiscordCanary.exe" --squirrel-install 1.0.1037
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:6072
  - - C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\DiscordCanary.exe
      C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\DiscordCanary.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discordcanary /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discordcanary\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.1037 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.3.3 --initial-client-data=0x4d8,0x4dc,0x4e0,0x4d4,0x4e4,0x7ff79c084e80,0x7ff79c084e90,0x7ff79c084ea0
      4⤵
      Executes dropped EXE
      PID:4804
  - - C:\Users\Admin\AppData\Local\DiscordCanary\Update.exe
      C:\Users\Admin\AppData\Local\DiscordCanary\Update.exe --createShortcut DiscordCanary.exe --setupIcon C:\Users\Admin\AppData\Local\DiscordCanary\app.ico
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1368
  - - C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\DiscordCanary.exe
      "C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\DiscordCanary.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discordcanary" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=1792,i,12879210682686462571,13708847272242767882,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1796,i,1474922268775611833,12670724101318477705,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1916 /prefetch:11
      4⤵
      Executes dropped EXE
      PID:4292
  - - C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\DiscordCanary.exe
      "C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\DiscordCanary.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discordcanary" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1792,i,12879210682686462571,13708847272242767882,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1796,i,1474922268775611833,12670724101318477705,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1788 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5568
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v DiscordCanary /f
      4⤵
      Modifies registry key
      PID:5556
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v DiscordCanary /d "\"C:\Users\Admin\AppData\Local\DiscordCanary\Update.exe\" --processStart DiscordCanary.exe --process-start-args \"--start-inactive\"" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:2164
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:4368
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:5576
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\DiscordCanary.exe\",-1" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:944
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\DiscordCanary.exe\" --url -- \"%1\"" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:3300

C:\Users\Admin\AppData\Local\DiscordCanary\Update.exe
"C:\Users\Admin\AppData\Local\DiscordCanary\Update.exe" --processStart DiscordCanary.exe --process-start-args "--start-inactive"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\DiscordCanary.exe
  "C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\DiscordCanary.exe" --start-inactive
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\DiscordCanary.exe
    C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\DiscordCanary.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discordcanary /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discordcanary\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.1037 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.3.3 --initial-client-data=0x4dc,0x4e0,0x4e4,0x4d8,0x4d0,0x7ff79c084e80,0x7ff79c084e90,0x7ff79c084ea0
    3⤵
    - Executes dropped EXE
    PID:4524
- - C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\DiscordCanary.exe
    "C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\DiscordCanary.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discordcanary" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1820,i,17958650000681551724,15033205514291832669,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1824,i,13547981129394104795,18319938628857573627,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1816 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2192
- - C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\DiscordCanary.exe
    "C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\DiscordCanary.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discordcanary" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1820,i,17958650000681551724,15033205514291832669,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1824,i,13547981129394104795,18319938628857573627,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1868 /prefetch:11
    3⤵
    - Executes dropped EXE
    PID:1076
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:5008
- - C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\DiscordCanary.exe
    "C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\DiscordCanary.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discordcanary" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.DiscordCanary.DiscordCanary --app-path="C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1783903265272748 --launch-time-ticks=596551845 --field-trial-handle=1820,i,17958650000681551724,15033205514291832669,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1824,i,13547981129394104795,18319938628857573627,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2844 --splash-media-format=webm /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4116
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:5212
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\DiscordCanary.exe\",-1" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:4356
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\DiscordCanary.exe\" --url -- \"%1\"" /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:4492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SquirrelSetup.log

Path C:\Users\Admin\AppData\Local\DiscordCanary\SquirrelSetup.log
Size 4KB
SHA256 cb5924e47e5b396271ed3f649c210a7ae106c961752d2e112a39dd5992997289
MD5 b3627991bde09ed3e55b3dd8d909b7e0
SHA1 b19363d742e9eb1064340fcec8d60090aba1f39d
SHA512 0ab3ce685c23524cdd8befa3be579b2933c482ef9fd5870a623e182c88b9831f14f37268885d69d4892b2b724ee9be3c8b3b1a9ab7f937e174f7d909780021f5
SSDEEP 96:wXO7vsuzunMzMAuCuKqO+CQuKWO+CQuK2rO+CQuKpO+CBLuLc:EO4O+CBO+CprO+CkO+Ch
TLSH
T150913482035B884D04D79193DBB7BA8FC3C3F98172553A2CE7B44A1D7A43519FAD68CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\D3DCompiler_47.dll
Size 4.5MB
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.ico

Path C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\app.ico
Size 278KB
SHA256 2dcb94cc54982584dd3137bf32c0757ae246757a66e8b45b9ac27829de729ea2
MD5 b1177cead91e65699122ca293f51c478
SHA1 d306c44b148f59d4da8d7f5dde7cb14117b9a21e
SHA512 1b71f11cb9c1cd0e38ac25abe4524d8a4785e0cc7d8e3b95258c4531255df362767e8bb685e84e0b9562838f047340ebb4fd5d692bb77618898348f07e9a480f
SSDEEP 384:t10pYNZONZZOZiZZONZuxcJ0JOQC6y+8CYcZtyDqulyKOl+e1266lyyz2X/uXTHQ:bxSxo/zCuO/OxZT0IVi
TLSH
T1A0547A011450824CCFB52936A7F6E2A0102F1F7B9CB6985921F4B752DB7EC8F7CB6269
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\chrome_100_percent.pak
Size 117KB
SHA256 15a5bcb49a5c02d6a4e736e8dfa11dabb0bac0589641a4e25f0c06472ccaae6d
MD5 750913d55e87def9108e55728ba67d00
SHA1 a5944bc170d1f6c3223195c043134566471dae1d
SHA512 f5663ae3c775e2ec12dda6255afea99291673b8586048b131ca657a10be88cca61e298bb56797bcc34723fc8bf0a3dd966ad8b9f0e77747f963d8dada4f25edf
SSDEEP 3072:7lj4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:7lcYWFUbGz8LI1TdjQBQCrC
TLSH
T1E9C3D0E773B0AD7DDA464BB743560070FCB31B2907C2160E4B9AE479652AB88D9C93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\chrome_200_percent.pak
Size 192KB
SHA256 b7acfb068fa681f4ecb8f782bd4e3926590076c61fd0de3de4a12dde227cf52b
MD5 d476c19d21b3c2861f08c1c82fffddcb
SHA1 6f61aab7b6fba4fed5a7c222bdb96aee11f23bd9
SHA512 36acefce9f4e6837609f801bb340380f8e3e0de3f01872ef1e9bfd769f61ec2804191b91cfd01d90fb874cc9f4e685de7f2d03c21cd7e0bc6c7d8907f41dc12a
SSDEEP 3072:y6FJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:y6IGQ+N6uSZQDQYakvyAk9jQBQNd4
TLSH
T1DE1401D323B4AD3DDA530BB3926600B0FD7A20291AB3511E569FED397925F8889C9343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\dxcompiler.dll
Size 24.5MB
SHA256 ff613f19b0453caa1ca3666047f95c14e9d66da208880006aaf8bc03437d05a6
MD5 7241ecf8944358244eb4a28ab9ef52a4
SHA1 effa6f013596f01774f617255cc3432a512c9938
SHA512 1804ecdb463ed16d234571bbb48ae166b739bf7e537833b3f2bd8a1b397326ed7cfd3c5b9628324095d0d010971f6515ab5f4c889ee12c7cccc8a373cc0fe6f6
SSDEEP 393216:ZKOs1524CttS0APLOIvNVNmZ8E086mIy1rEHdc5:6sSO4NpEX4y1kc5
TLSH
T157473A122646D49DC099C879C7678B268A6C30E73FA7B8DFC0F451212B79EBC5B39235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\dxil.dll
Size 1.4MB
SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
MD5 c9a7241ce83437d54a82522aa0b54575
SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
TLSH
T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\icudtl.dat
Size 10.4MB
SHA256 bd8c145abdf3f8383276ce01dfa4ae48709bef9fef1c0711eb7c3fab4f6eb7c2
MD5 0a7cbe8e902379fc03c5c6c7c08c7d3b
SHA1 18ff020331534d21f24d922d4da3c253668e44d8
SHA512 88b94c5d350c2022aa27481e3a5c6bc74dd13ed1f2157dec4219d9b847469f7191f6fdc7305f3d27533c69f146324da8fdefbd8acbd2081965e74e8926d1e9c9
SSDEEP 98304:1/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndPj89o:1/cBhORok2HiXUxO/RJk3IWhlYntjdOo
TLSH
T180B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\libEGL.dll
Size 479KB
SHA256 40ed3d934ade88371b08aef5a747ca80810668afdc10f4e584f727156a3a85cd
MD5 acc36570fcca744e302d5860acba230b
SHA1 beb7860b3f5bddd23a85ea8a80f2b8a25521fc8e
SHA512 86f427c0742e866dc598186e942d8ea812676db1df566ff36c7dc10c139b3dfdb23c1e2809bdd2ee1e16d136455c2eb43323812d2d9424a5d07980bc424b317d
SSDEEP 6144:1H4aYqIpV36sSDCsDmMSzN/pw/x1dc0LKjcgAPy+PJ0Ns0fK6nNOna:bYqIv6gsHUpw/x1dc0ujePy+ODSO
TLSH
T1EFA48C05B7E449B9E07AC138CA538647EB7178460B61F6DF03A0D2792F77BE45A3A321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\libglesv2.dll
Size 7.6MB
SHA256 3a252e5f116b400894627ff37afa61b7608bcfb7e54c8bacbb0bba73da2219bf
MD5 59b65ea32ec069e84e39aaf0b3649e16
SHA1 0af6172daf2552ec25bca62b7168ed7badbe3e94
SHA512 e8809397dff27f0fc473316f8016e93fd46152c304a23a1c27035f4bbc94065c1e66842bbe5ac7544e0b0a45d675cec53a5e718b3821019ce888fee78deeea71
SSDEEP 49152:9bGLADSLTUN02mIfn5WqZQOTjb0D+AS0J0psAdGMvlsGdTg1V1s14bxHiI0efele:UsDULqes/UKGcWCdSxvx7kgg6Wk/J
TLSH
T1D6866B03F69681D9C05DD2788B5BA223FA34B8450724B6CF2BA457152F6ABF0EB3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\locales\en-US.pak
Size 550KB
SHA256 a46e37e61c7cdedf5d407f2be6440a895decb42f408ebc4f0cd0575026214ec6
MD5 5ae2ae804d645924629018eb3ca804a1
SHA1 d61cdc8f5ce36bee2e1dc2db68ff941e01dfd931
SHA512 492a7fb03429912ef0901c5c0471dd4d849155e9bfbfca7a6ea703b67fbdd5f31939c0ed1174a0eaecb37428295062060c08d74b56f7b77bda448023b94efd15
SSDEEP 6144:nryUXUBrjTlnRxjhrjJHfBLOFcGfIzUMP99QKJUfaYQrpqwvGjnngsZ/8twj:nryPZRDJHfBVAMTQKJVcjWwj
TLSH
T1F5C44C1FF744122A05A352A27F0995A2FF32D06CB35112563CBD812C33B6B6693B76F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\resources.pak
Size 6.3MB
SHA256 871ce12a3b46304cd6be9dcbee43f300975905aefc74fb994ef2e3c220b1a62b
MD5 3473cbd5439f8a4e55fae82264c10ccb
SHA1 1e85407fbde25f99d240b75db5c148cee9e5c4ff
SHA512 28f94fe483ec94aa6ab81fa4a28eecb85327e0403b448fe33b74ab458cc1fab5da869dc3a832805f3821f109acb5d644df5b13eb1ca6de09dd82aa1aa7133213
SSDEEP 196608:XJBRzGfWiDTz9u4bkriACmZnC3gEL34tVrW:XJT6v/zlkrDntEoVrW
TLSH
T1706633D277E2681BCD5063BE44448E395A9CAF2926D0B1E348DC2119ED9CB6C0FC4A7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\resources\app.asar
Size 3.4MB
SHA256 ade897e4c4c25f65cd4315a13c0076007c7501a729ab9fd6630ab8fd552dd089
MD5 4b2211178d3303a79383e57d81a64d4c
SHA1 9dd8c4598874e421dcc971feddde4b1e6e2cec8d
SHA512 900224675e4dd3ff485e9a089d33114b4a32187bd40528ae3e61dbec775de91007b51ac2b5c67e97a38bef063943f1cc1dad65692b8ff479eff24cacd7e9977b
SSDEEP 98304:3Hkye5TDaKprumIhbE4UCCYv+UHhJEOnA7:3uK70CCYv+UHhJM
TLSH
T1C1F59EE5725269734FEB22EDE932550276B9C006B05460BAFA6CCECE15C8409B3B773D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

build_info.json

Path C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\resources\build_info.json
Size 175B
SHA256 6eb61a6f20bc6f4ba300a035cdacbd2aa312de43dd9fb8b2216a03a603e7abc0
MD5 6450ab4ae15718141f9e19fa950e0f5f
SHA1 5c5684f4946d2cafc14de9872fabb9bb53a2ebda
SHA512 d1755ecb26d5de5333441abe084a45042a7489da85ef325b510948905e3b41388b252211853f816b6453888c5ec6a9251d0b3948879105bc416a2f11b3c91f17
TLSH
T143C012AA6650153761F51FB387428061A694BF5E02604D6E70B6624865A28711682E11
MD5 SHA1 SHA512 TLSH

Submit Download

updater.node

Path C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\updater.node
Size 4.2MB
SHA256 f254ca830b8de283b79a50ff5a48a86d10842e348f0019a0c9083285499cecf2
MD5 bdac14cb80022dc71381b15d5f1b54ac
SHA1 565e291767b20c5499c370a6840c31d473429f2d
SHA512 26967cb1ea4a27cf0a463c59b528499111f8c09e2e0e0ef44599ee9de945c9b676e4088a45fd5e405712b03a086bed46365e625f84d65849cbe9d68cf1c7a623
SSDEEP 49152:vWEYWbO4TcuOvOg+aVzp4ZNXqxzQkPIREYO0aa1nQBa6KpT+cQnaJcGAQPk1rP50:AWbO4TAoaxwCxBaFN7HJkQAb5e4ps
TLSH
T128166B03FA9546AAC06EC178835B9637E772B8890720B7EB17D44A313E53FA11E7D358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1037\v8_context_snapshot.bin
Size 704KB
SHA256 bc75f706ce64e25785b54f468caaed24c9a47d4997ce040fde3567007bdc566b
MD5 a8541bf6807877e1f9154fbad6ea7610
SHA1 9247de68eae261ffc6025961091f563482b818b2
SHA512 ef651f5284586e38daa3f917eb7bb89c41053eb77582f3996825ac64ce2bb28d1c6b859645abb6138937e7ffcbcf6315dace6623e936f9ef6a09f2837e21d7cd
SSDEEP 12288:t15XrgAJ8ph2NdOeP8POqYUdEMH+jURWYS:t1pqP4H8POqYkEMH+AtS
TLSH
T164E49676FB0ACA26C8657A7D8DE74B063A34B2DD8EC6EB077011937CB4B86544D1E20D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RELEASES

Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
Size 87B
SHA256 0e74030e9c8245d3c216b799d228fd0897b79cad140650860f5d24fbf19fb60d
MD5 106ee7015a7e0ba49b4634f3775e72c1
SHA1 c98fbcbaaa85dc8f1ac7d15396b179ead43b657e
SHA512 6e6877e574d7e98c266e7149a6d06ffca39aa570561d725bea8cff56f26fc9a794d7b8b59278ca563e57ed0184ef112fa3e7daaaae6103e107b38f3f3dddabd0
TLSH
T1CEB012040852721565D5018B1C401A466F2021D4138911D08A0E55A31C54400448950C
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 1.5MB
SHA256 4a7444aa6076b4dde417975ce1bbafd304b7bb82beb0163ee7e6dc1e440318c1
MD5 5c6c1fcb0329ed3b8f75f7f6368877a4
SHA1 46ce907044ad974b19b78e0ae115f085b0a108ce
SHA512 d97ef8a6ccd2229d3e2c32937ded73a0b0a20f74d90d6d3685347c4235f7d1dc71e9acfa49d1345ac7039a3ccc8b9a78ff5d8305a0cdd3c1ea64eef395718e2d
SSDEEP 24576:/BJkrlr7AiOlwOpJeYOdTNK9RgIM/aR9Gl7MRHi:/BJkAlwO/X9GlmC
TLSH
T1FD753911B7E88A2BE4AE57BAB071016547F3E5866376F78F6A4CA1781FD37804C02367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Discord Canary.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Discord Inc\Discord Canary.lnk
Size 2KB
SHA256 37273039272231d55b85cf5de8e64702fcb270c98c57948363e7860d429ff44d
MD5 bf1577a9a23c5ee77985be78b13a3d31
SHA1 8434b7c1a6034122ee9c0bdbddd6f9950eaa9d13
SHA512 5298ca3686d5d6da68b0520b7c849e3478e486344309c4c90bfae11cc7037f819cf7cd1d37eb5e04492331ed3e5d9a9cc70f80a78dec342af8cea3474cb38494
TLSH
T1EF41CC0666D65B20F7F7997609EAA5199AB5BC31FE329B0D040081480C76F01DC64F2F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\discordcanary\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 7784a3533681673d5816e42d9a16ce1b08ed6ba53504e1bb3aeaffdaf1bbd561
MD5 7c467650357ffeaa3acd531370a95231
SHA1 093f138cdfaf69aba15d2671e548c5edb2fc9c0f
SHA512 2b9eb03f7dbcaf22f27fa593b6d9dcf9ff3b14f97dd17a3948f71d36349fdcd4cb0359a84d77b886293399436aa14ad8b3cc1ef0c4b283a9794a79c8ccdb719b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\discordcanary\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\discordcanary\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 ef32598bc1aadb9bcbb3ae97d468f8e54d10b31d0d2dfbaeda00747161496b01
MD5 fe74c874b41e1015b2fb2bd1ed28874f
SHA1 f72a596ebb1d8587329d67bc5ec6cba0a67600e4
SHA512 ac3fe53750fb78460830b2d82f6628b2d9a58d61cabe2207494adbb551f056b2e5fbd5ced0493abd379aa8cd1a846d95ea056b262ce4a75090edd6b7fa5d4357
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\discordcanary\Crashpad\settings.dat
Size 40B
SHA256 c6a0a5d1f81917401918aab3506ce6755cf4f8ef96e8a6d2f9f9d14fdbe8e506
MD5 5933320a598886c6e1c8ebdfefe0b9dc
SHA1 37233ecb8d67239c5a551dc7ed49d50b2a56374a
SHA512 8769d9d733379cf221be1f6b8b1d6e3b837d5d87103b351eef41538baf53aea3e40986ea22529023f846b3c069faceecfd89266776fdd566447320288ca70fb8
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\discordcanary\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\discordcanary\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\discordcanary\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\discordcanary\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\discordcanary\Local State
Size 490B
SHA256 2251b62e6177256c613d2f4261a7d496bb98aae8863f91d2676e579d96bd441f
MD5 7523bf1a4c32273e3b023e66555580fd
SHA1 6cc8d9cc74a9f86e902ec6a1a927c58975ef5e2b
SHA512 3fe0cef1ec69b35a6878b291414798596e7a6aa9c45b5fbbf9b43bf37218708223169e403cdc3d9d6fd082b0d72d717ac8c9fa78684276127a3a15bdd72eb440
TLSH
T103F0D4F105E1ADF0766563EDF11765030D14EAB78E448784AAFF512943F688A4717532
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Roaming\discordcanary\Local Storage\leveldb\000003.log
Size 30B
SHA256 8bd2ea70a0b70c91de138a5b87c7936c6a6fa7c4275c54b97f4ef0ccc5b79bb4
MD5 7e957d693bbab6ad7dec1d3aa28bd69b
SHA1 50369f74c280d83046d6b779ecbde129b8ac3b98
SHA512 0228357b6c4b73f3ef20a333b7afe71fb589efe438bc28a3e04df3fb64f367b7b463dc9c9792921c531124b7bde600524827b40f2cc5aeddbc1df8b3ed822cbf
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\discordcanary\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Roaming\discordcanary\Local Storage\leveldb\LOG
Size 257B
SHA256 91b6c59f2199a7953dbc83df212ef439824b5f955c22315337744d41cdb27476
MD5 1b69a946026b4ec3d5a76cc29df12db0
SHA1 ab5290e6a69d315b13c91b50cdbb00f84106e592
SHA512 8425944a1b29434b0a7f49c64dc66e25965a4b31a087b8d02766cdcca398fb42a76e4acc0a20c3badc1690674bb17171e869b6854d1168d01437fd67cafb76be
TLSH
T1ADD0C23200DAC9098245819B9632FB1DC77061906AAC26888EC2A08C7088009DB45883
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\discordcanary\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\discordcanary\Preferences
Size 57B
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a
TLSH
T101900297652634755E1F1D65400B889B5CF905704E0B5E0641D032969A2A45D088705F
MD5 SHA1 SHA512 TLSH

Submit Download

7_13_2026__1_50_52_AM_GMT_1-0-events.log

Path C:\Users\Admin\AppData\Roaming\discordcanary\module_data\crashlogs\7_13_2026__1_50_52_AM_GMT_1-0-events.log
Size 419B
SHA256 fc60e927da48ca16b6b5ae302ecce60b3e7e1348d782fd793d034572c2c97432
MD5 44f1d37d005ebfa217a06077ef79f1c7
SHA1 b42c0516b0134dc9c334e330de7a1cbb999b6346
SHA512 12cbdd42853f3466d79c9f8cdcf7b2b164c7a053d42de59cd5c4fe5d07cda952cce6c9ec80c2106e415c053a6ea7b73cd67784ac1e3675e3fcf826c30b5038cc
TLSH
T17DE068D50CECCDBB57B6DAE5CB52816DC3A430E5110846B0E08B328C008F4F3188EE03
MD5 SHA1 SHA512 TLSH

Submit Download

scope_v3.json

Path C:\Users\Admin\AppData\Roaming\discordcanary\sentry\scope_v3.json
Size 3KB
SHA256 20eac0b8d7cf98682154d451233e2665144a0438fb7026853de9c7154245a8d8
MD5 8fc5b65bda894154d5cd1d6e1f93cfdc
SHA1 c949594fff16f126ddd700af43573764e2e1513e
SHA512 6c0409d250a83a983a9321a9af92cd1d19d8070d6d679c44f9f433b2405f2b06cfaea9f6d444da89d60b2f610910526fca3f3e64f279efe8a0829bcc90cad845
TLSH
T1268183A52D2CDDBB6F99D69E35E23C0ADBF830C205885C8250E5DF4C868E8BA744D537
MD5 SHA1 SHA512 TLSH

Submit Download

Discord Canary.lnk

Path C:\Users\Admin\Desktop\Discord Canary.lnk
Size 2KB
SHA256 a7f257075e0d4761204228cea0a154809ed0ebe7c998b13699ed731a2feed685
MD5 e6792a6cfb78b36e5b2b145fe3dc95de
SHA1 56c5dc16fbcd3db7425697596efcbb8bfba3add4
SHA512 9849d7b5da75c49168bfdb0a4e2a5c43e2ed3a1ec04cb10a18141f5aae4689bdb47dd094f962890ea3a9e6e9c97d64d87083353a28f9496e6352a1799ce1f123
TLSH
T11C41A00266E64B24F7F79D7615EBE5159AB4BC31EE329A1D0410C1480C76F01DD64F6F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1368-245-0x00000000054E0000-0x0000000005500000-memory.dmp

Download

memory/4608-11-0x00000000008B0000-0x0000000000A3A000-memory.dmp

Download

memory/4608-190-0x0000000008A60000-0x0000000008A68000-memory.dmp

Download

memory/4608-192-0x00000000092D0000-0x00000000092DE000-memory.dmp

Download

memory/4608-191-0x0000000009300000-0x000000000933E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads