Overview

overview

7

Static

static

1

DiscordCan...up.exe

windows10-2004-x64

7

DiscordCan...up.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    900s
  • max time network
    553s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 00:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    DiscordCanarySetup.exe
  • Size 139.3MB
  • Sample260808-ayymsawfka
  • SHA256 70ea39fdbae660bee895665fca7515c786356b766c9547d0e7bd5b3d216c9cd4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwarediscoverypersistenceransomwarespywarestealer

Malware Config

Signatures

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads ssh keys stored on the system 2 TTPs

    Tries to access SSH used by SSH programs.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 48 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 59 IoCs
  • Modifies registry key 1 TTPs 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 54 IoCs
  • Suspicious use of FindShellTrayWindow 55 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\DiscordCanarySetup.exe
    "C:\Users\Admin\AppData\Local\Temp\DiscordCanarySetup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4116
    • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
      "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1132
      • C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\DiscordCanary.exe
        "C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\DiscordCanary.exe" --squirrel-install 1.0.1096
        3⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5532
        • C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\DiscordCanary.exe
          C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\DiscordCanary.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discordcanary /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discordcanary\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.1096 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.7.1 --initial-client-data=0x4d8,0x4dc,0x4e0,0x4d4,0x4e4,0x7ff7bad609d8,0x7ff7bad609e8,0x7ff7bad609f8
          4⤵
          • Executes dropped EXE
          PID:2740
        • C:\Users\Admin\AppData\Local\DiscordCanary\Update.exe
          C:\Users\Admin\AppData\Local\DiscordCanary\Update.exe --createShortcut DiscordCanary.exe --setupIcon C:\Users\Admin\AppData\Local\DiscordCanary\app.ico
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1320
        • C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\DiscordCanary.exe
          "C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\DiscordCanary.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discordcanary" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2032,i,14206489185484066755,7429700616937765977,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=2036,i,6174018422338348477,6837967615487463961,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2028 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3292
        • C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\DiscordCanary.exe
          "C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\DiscordCanary.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discordcanary" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=2032,i,14206489185484066755,7429700616937765977,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=2036,i,6174018422338348477,6837967615487463961,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2068 /prefetch:11
          4⤵
          • Executes dropped EXE
          PID:4776
        • C:\Windows\System32\reg.exe
          C:\Windows\System32\reg.exe delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v DiscordCanary /f
          4⤵
          • Modifies registry key
          PID:1300
        • C:\Windows\System32\reg.exe
          C:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v DiscordCanary /d "\"C:\Users\Admin\AppData\Local\DiscordCanary\Update.exe\" --processStart DiscordCanary.exe --process-start-args \"--start-inactive\"" /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:2600
        • C:\Windows\System32\reg.exe
          C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
          4⤵
          • Modifies registry class
          • Modifies registry key
          PID:5208
        • C:\Windows\System32\reg.exe
          C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
          4⤵
          • Modifies registry class
          • Modifies registry key
          PID:4880
        • C:\Windows\System32\reg.exe
          C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\DiscordCanary.exe\",-1" /f
          4⤵
          • Modifies registry class
          • Modifies registry key
          PID:5652
        • C:\Windows\System32\reg.exe
          C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\DiscordCanary.exe\" --url -- \"%1\"" /f
          4⤵
          • Modifies registry class
          • Modifies registry key
          PID:1360
  • C:\Users\Admin\AppData\Local\DiscordCanary\Update.exe
    "C:\Users\Admin\AppData\Local\DiscordCanary\Update.exe" --processStart DiscordCanary.exe --process-start-args "--start-inactive"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4860
    • C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\DiscordCanary.exe
      "C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\DiscordCanary.exe" --start-inactive
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3772
      • C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\DiscordCanary.exe
        C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\DiscordCanary.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discordcanary /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discordcanary\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.1096 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.7.1 --initial-client-data=0x4d8,0x4dc,0x4e0,0x4d4,0x4e4,0x7ff7bad609d8,0x7ff7bad609e8,0x7ff7bad609f8
        3⤵
        • Executes dropped EXE
        PID:5996
      • C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\DiscordCanary.exe
        "C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\DiscordCanary.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discordcanary" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1832,i,3709071593784984631,11970381823865440427,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1836,i,13890741178477853187,15508927683895188971,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1828 /prefetch:2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4168
      • C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\DiscordCanary.exe
        "C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\DiscordCanary.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discordcanary" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1832,i,3709071593784984631,11970381823865440427,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1836,i,13890741178477853187,15508927683895188971,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2016 /prefetch:11
        3⤵
        • Executes dropped EXE
        PID:1868
      • C:\Windows\System32\reg.exe
        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
        3⤵
        • Modifies registry class
        • Modifies registry key
        PID:4148
      • C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\DiscordCanary.exe
        "C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\DiscordCanary.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discordcanary" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.DiscordCanary.DiscordCanary --app-path="C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1832,i,3709071593784984631,11970381823865440427,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1836,i,13890741178477853187,15508927683895188971,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2800 --splash-media-format=webm /prefetch:1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1600
      • C:\Windows\System32\reg.exe
        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
        3⤵
        • Modifies registry class
        • Modifies registry key
        PID:3660
      • C:\Windows\System32\reg.exe
        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\DiscordCanary.exe\",-1" /f
        3⤵
        • Modifies registry class
        • Modifies registry key
        PID:2716
      • C:\Windows\System32\reg.exe
        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\DiscordCanary.exe\" --url -- \"%1\"" /f
        3⤵
        • Modifies registry class
        • Modifies registry key
        PID:3968
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:4784
    • C:\Windows\system32\sihost.exe
      sihost.exe
      1⤵
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5868
      • C:\Windows\explorer.exe
        explorer.exe /LOADSAVEDWINDOWS
        2⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:3540
    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4036
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4016
    • C:\Windows\System32\SecurityHealthHost.exe
      \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
      1⤵
        PID:4476

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            SquirrelSetup.log
            • Path C:\Users\Admin\AppData\Local\DiscordCanary\SquirrelSetup.log
            • Size 4KB
            • SHA256 f83eb932f0b6a7273f5f446a592686a8dc6d0710df62821846ecde03539e9d1f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            D3DCompiler_47.dll
            • Path C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\D3DCompiler_47.dll
            • Size 4.5MB
            • SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            app.ico
            • Path C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\app.ico
            • Size 278KB
            • SHA256 2dcb94cc54982584dd3137bf32c0757ae246757a66e8b45b9ac27829de729ea2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_100_percent.pak
            • Path C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\chrome_100_percent.pak
            • Size 117KB
            • SHA256 15a5bcb49a5c02d6a4e736e8dfa11dabb0bac0589641a4e25f0c06472ccaae6d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            chrome_200_percent.pak
            • Path C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\chrome_200_percent.pak
            • Size 192KB
            • SHA256 b7acfb068fa681f4ecb8f782bd4e3926590076c61fd0de3de4a12dde227cf52b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dxcompiler.dll
            • Path C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\dxcompiler.dll
            • Size 24.5MB
            • SHA256 40c1db297fda04edd3b79157a2592678204113ce7ca1c6adc9654429648ea953
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dxil.dll
            • Path C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\dxil.dll
            • Size 1.4MB
            • SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            icudtl.dat
            • Path C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\icudtl.dat
            • Size 10.4MB
            • SHA256 bd8c145abdf3f8383276ce01dfa4ae48709bef9fef1c0711eb7c3fab4f6eb7c2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libegl.dll
            • Path C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\libegl.dll
            • Size 479KB
            • SHA256 63280f3833edec326c6c480d3fd9a224272bffeacb7b3af7b7235cd7df4d1e0b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libglesv2.dll
            • Path C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\libglesv2.dll
            • Size 7.6MB
            • SHA256 c32ce319e3294345a130a1a558a44232e411a17c1a344b884779f724e0774df4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            en-US.pak
            • Path C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\locales\en-US.pak
            • Size 550KB
            • SHA256 a46e37e61c7cdedf5d407f2be6440a895decb42f408ebc4f0cd0575026214ec6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            resources.pak
            • Path C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\resources.pak
            • Size 6.3MB
            • SHA256 c0061855e2714674043841c3db83ddffb764890c2e6c03894a4a537f126af701
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            app.asar
            • Path C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\resources\app.asar
            • Size 3.4MB
            • SHA256 588ff3698c31828d3d357607dfc74b811bb5307c28e53fd555e388031199692d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            build_info.json
            • Path C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\resources\build_info.json
            • Size 175B
            • SHA256 09fa8439b85df015f0a89d7cd987709f2542caf42c99f6f4ac4d8a863f977bdc
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            updater.node
            • Path C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\updater.node
            • Size 4.2MB
            • SHA256 bf610037fc217b30c2b5a58cc9354144314e71f8d5456a4bb663aa35dd3f5e9c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            v8_context_snapshot.bin
            • Path C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.1096\v8_context_snapshot.bin
            • Size 704KB
            • SHA256 47efa82a5cbdce5a4810e9e62e9dc04c52cbce5c7afeb38bb2b331f4243fa9d9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            prep_Activatable Class_Hermes_perf.cache
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
            • Size 595B
            • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            RELEASES
            • Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
            • Size 87B
            • SHA256 bb5076b520d1a00ede08c01c92cd9a0293e1bbdcc7c2d507e61be9732d08ab77
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Update.exe
            • Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
            • Size 1.5MB
            • SHA256 eec62ba9171c1a507f076666433656efffb41860a2307118d99cc48974ed6d9d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            default.exc
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
            • Size 2B
            • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
            • MD5 SHA1 SHA512
            Submit Download

            Discord Canary.lnk
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Discord Inc\Discord Canary.lnk
            • Size 2KB
            • SHA256 f8132b93f87962904009e57eacf16fbd960c67a9ea060142f4da0091d9ceb8ae
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Roaming\discordcanary\Code Cache\js\index-dir\the-real-index
            • Size 48B
            • SHA256 4201fb37319cfd537f1c48c30115eb82ee6063b374000129847c41447e0ac81e
            • MD5 SHA1 SHA512
            Submit Download

            index
            • Path C:\Users\Admin\AppData\Roaming\discordcanary\Code Cache\wasm\index
            • Size 24B
            • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
            • MD5 SHA1 SHA512
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Roaming\discordcanary\Code Cache\wasm\index-dir\the-real-index
            • Size 48B
            • SHA256 7530e7ae692517b39673c2877b1a1fb9f798e7c7a2cd56a79d81d555f4a95ac0
            • MD5 SHA1 SHA512
            Submit Download

            data_1
            • Path C:\Users\Admin\AppData\Roaming\discordcanary\DawnWebGPUCache\data_1
            • Size 264KB
            • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_0
            • Path C:\Users\Admin\AppData\Roaming\discordcanary\GPUCache\data_0
            • Size 8KB
            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_2
            • Path C:\Users\Admin\AppData\Roaming\discordcanary\GPUCache\data_2
            • Size 8KB
            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_3
            • Path C:\Users\Admin\AppData\Roaming\discordcanary\GPUCache\data_3
            • Size 8KB
            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Roaming\discordcanary\Local State
            • Size 490B
            • SHA256 fc5a20ab79c6917360e0ec8f1d96b3fcba764e873ccb9a4de0618a69c79ad122
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            000003.log
            • Path C:\Users\Admin\AppData\Roaming\discordcanary\Local Storage\leveldb\000003.log
            • Size 30B
            • SHA256 8bd2ea70a0b70c91de138a5b87c7936c6a6fa7c4275c54b97f4ef0ccc5b79bb4
            • MD5 SHA1 SHA512
            Submit Download

            CURRENT
            • Path C:\Users\Admin\AppData\Roaming\discordcanary\Local Storage\leveldb\CURRENT
            • Size 16B
            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
            • MD5 SHA1 SHA512
            Submit Download

            LOG
            • Path C:\Users\Admin\AppData\Roaming\discordcanary\Local Storage\leveldb\LOG
            • Size 257B
            • SHA256 bbb9c321fff6144bc93043af4d23efd3aae75917c31f199cf4c53b5ee4ed3b43
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            MANIFEST-000001
            • Path C:\Users\Admin\AppData\Roaming\discordcanary\Local Storage\leveldb\MANIFEST-000001
            • Size 41B
            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
            • MD5 SHA1 SHA512
            Submit Download

            Preferences
            • Path C:\Users\Admin\AppData\Roaming\discordcanary\Preferences
            • Size 57B
            • SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            db
            • Path C:\Users\Admin\AppData\Roaming\discordcanary\Shared Dictionary\db
            • Size 44KB
            • SHA256 b87da9786c3fb75b92ca41e78f7a8cacba24040a26ad85674782ad2cbf5ad814
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            8_8_2026__1_41_43_AM_GMT_1-0-events.log
            • Path C:\Users\Admin\AppData\Roaming\discordcanary\module_data\crashlogs\8_8_2026__1_41_43_AM_GMT_1-0-events.log
            • Size 416B
            • SHA256 fea78889e3344569a6e4173161efa73c17932335f4b8b395bbb476ecd2ff29cd
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            scope_v3.json
            • Path C:\Users\Admin\AppData\Roaming\discordcanary\sentry\scope_v3.json
            • Size 4KB
            • SHA256 ca252ad49fbfac82ee36f61f9be06686de64e2476dca47c2741e7e4d3bf44f22
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Discord Canary.lnk
            • Path C:\Users\Admin\Desktop\Discord Canary.lnk
            • Size 2KB
            • SHA256 8976a15bf4a04e56acbc106dd7457a5e7b137e1e9cf3add33786d34dd67c1ef9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/1132-138-0x0000000009390000-0x000000000939E000-memory.dmp
            Download

            memory/1132-137-0x00000000093C0000-0x00000000093FE000-memory.dmp
            Download

            memory/1132-110-0x0000000008B20000-0x0000000008B28000-memory.dmp
            Download

            memory/1132-11-0x0000000000AB0000-0x0000000000C3A000-memory.dmp
            Download

            memory/1320-245-0x0000000005830000-0x0000000005850000-memory.dmp
            Download

            memory/4036-461-0x000001B7801E0000-0x000001B7802E0000-memory.dmp
            Download

            memory/4036-506-0x000001B794840000-0x000001B794860000-memory.dmp
            Download

            memory/4036-492-0x000001B782D00000-0x000001B782D20000-memory.dmp
            Download

            memory/4036-477-0x000001B782920000-0x000001B782940000-memory.dmp
            Download

            memory/4036-478-0x000001B782D80000-0x000001B782E80000-memory.dmp
            Download