68a77ea10a31620aff066f3cb4dbdf60e0dcd916dc95915e96cd349e21b8d7cd

Analysis

user interaction
yes
max time kernel
88s
max time network
119s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 15:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Stellar_2.0.8_x64_en-US.msi
Size 19.7MB
Sample260812-sgp87azcle
SHA256 68a77ea10a31620aff066f3cb4dbdf60e0dcd916dc95915e96cd349e21b8d7cd
MD5 dfd26f0241ca7ae42648a46a6898379a
SHA1 b5554dedee251a15a6a18ef542d1b2b071d25b16
SHA512 879685fd143bcb1cce9b3e29b65c3262925024002a0e9e6d0cdbbfceb64796f181984aad6a8ff29e267ebac8a4d28a8883d386854c9fa6aef636970b9147f3e2
SSDEEP 393216:GBe9kt2PdnzNICFijd3aQU1jLfVWpMcn8TGQf4vMdNyKH4C25:DTln+CFij1CLeMyi4vM/yS495
TLSH
T1302733173C42CB16C5562EF4CC7BA3F1095AAC00E9122C1321687E6DF9F29E7DDA19E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
984	stellar.exe

Loads dropped DLL 1 IoCs

pid	Process
2132	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	stellar.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
66	discord.com
77	discord.com
92	discord.com
65	discord.com

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Stellar\stellar.exe	msiexec.exe
File created	C:\Program Files\Stellar\Uninstall Stellar.lnk	msiexec.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI73A0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{4EE5FC77-AFE5-4313-BA36-414A05074D91}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{4EE5FC77-AFE5-4313-BA36-414A05074D91}	msiexec.exe
File created	C:\Windows\Installer\{4EE5FC77-AFE5-4313-BA36-414A05074D91}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0000AC47C780107E.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF713DB158201608E0.TMP	msiexec.exe
File created	C:\Windows\Installer\e596a1a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF042A7C7CD05EB35E.TMP	msiexec.exe
File created	C:\Windows\Installer\e596a1c.msi	msiexec.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_1260_1634296162\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File opened for modification	C:\Windows\Installer\e596a1a.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1E1C226696A05AE0.TMP	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2128	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
7224	msedge.exe
5720	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310208699434530"	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 39 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\77CF5EE45EFA3134AB6314A45070D419\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\812181F64B4B79A53877A752AA655852	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\stellarv2\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\shell\open	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\77CF5EE45EFA3134AB6314A45070D419\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\77CF5EE45EFA3134AB6314A45070D419\Version = "33554440"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\77CF5EE45EFA3134AB6314A45070D419\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\stellarv2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\ = "URL: protocol"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\77CF5EE45EFA3134AB6314A45070D419\ProductName = "Stellar"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\77CF5EE45EFA3134AB6314A45070D419\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\812181F64B4B79A53877A752AA655852\77CF5EE45EFA3134AB6314A45070D419	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\77CF5EE45EFA3134AB6314A45070D419\SourceList\PackageName = "Stellar_2.0.8_x64_en-US.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\77CF5EE45EFA3134AB6314A45070D419\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\77CF5EE45EFA3134AB6314A45070D419\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\77CF5EE45EFA3134AB6314A45070D419\External	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\77CF5EE45EFA3134AB6314A45070D419\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\77CF5EE45EFA3134AB6314A45070D419\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\shell\open\command\ = "\"C:\\PROGRA~1\\Stellar\\stellar.exe\" \"%1\""	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\77CF5EE45EFA3134AB6314A45070D419\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{6495A1EF-25B7-410E-8CF4-38593377F1B8}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\77CF5EE45EFA3134AB6314A45070D419	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\77CF5EE45EFA3134AB6314A45070D419\MainProgram	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\77CF5EE45EFA3134AB6314A45070D419	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\77CF5EE45EFA3134AB6314A45070D419\ProductIcon = "C:\\Windows\\Installer\\{4EE5FC77-AFE5-4313-BA36-414A05074D91}\\ProductIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{DB732A04-76E4-4EC3-A476-31107259CB97}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\stellarv2\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\77CF5EE45EFA3134AB6314A45070D419\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\77CF5EE45EFA3134AB6314A45070D419\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\DefaultIcon\ = "\"C:\\PROGRA~1\\Stellar\\stellar.exe\",0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\77CF5EE45EFA3134AB6314A45070D419\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\77CF5EE45EFA3134AB6314A45070D419\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\77CF5EE45EFA3134AB6314A45070D419\Environment = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\77CF5EE45EFA3134AB6314A45070D419\PackageCode = "E775EBA818EFDB84C81D50DFFA401BD4"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\77CF5EE45EFA3134AB6314A45070D419\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4452	msiexec.exe
4452	msiexec.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5092	msedgewebview2.exe
5092	msedgewebview2.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2128	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2128	msiexec.exe
Token: SeSecurityPrivilege	4452	msiexec.exe
Token: SeCreateTokenPrivilege	2128	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2128	msiexec.exe
Token: SeLockMemoryPrivilege	2128	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2128	msiexec.exe
Token: SeMachineAccountPrivilege	2128	msiexec.exe
Token: SeTcbPrivilege	2128	msiexec.exe
Token: SeSecurityPrivilege	2128	msiexec.exe
Token: SeTakeOwnershipPrivilege	2128	msiexec.exe
Token: SeLoadDriverPrivilege	2128	msiexec.exe
Token: SeSystemProfilePrivilege	2128	msiexec.exe
Token: SeSystemtimePrivilege	2128	msiexec.exe
Token: SeProfSingleProcessPrivilege	2128	msiexec.exe
Token: SeIncBasePriorityPrivilege	2128	msiexec.exe
Token: SeCreatePagefilePrivilege	2128	msiexec.exe
Token: SeCreatePermanentPrivilege	2128	msiexec.exe
Token: SeBackupPrivilege	2128	msiexec.exe
Token: SeRestorePrivilege	2128	msiexec.exe
Token: SeShutdownPrivilege	2128	msiexec.exe
Token: SeDebugPrivilege	2128	msiexec.exe
Token: SeAuditPrivilege	2128	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2128	msiexec.exe
Token: SeChangeNotifyPrivilege	2128	msiexec.exe
Token: SeRemoteShutdownPrivilege	2128	msiexec.exe
Token: SeUndockPrivilege	2128	msiexec.exe
Token: SeSyncAgentPrivilege	2128	msiexec.exe
Token: SeEnableDelegationPrivilege	2128	msiexec.exe
Token: SeManageVolumePrivilege	2128	msiexec.exe
Token: SeImpersonatePrivilege	2128	msiexec.exe
Token: SeCreateGlobalPrivilege	2128	msiexec.exe
Token: SeCreateTokenPrivilege	2128	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2128	msiexec.exe
Token: SeLockMemoryPrivilege	2128	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2128	msiexec.exe
Token: SeMachineAccountPrivilege	2128	msiexec.exe
Token: SeTcbPrivilege	2128	msiexec.exe
Token: SeSecurityPrivilege	2128	msiexec.exe
Token: SeTakeOwnershipPrivilege	2128	msiexec.exe
Token: SeLoadDriverPrivilege	2128	msiexec.exe
Token: SeSystemProfilePrivilege	2128	msiexec.exe
Token: SeSystemtimePrivilege	2128	msiexec.exe
Token: SeProfSingleProcessPrivilege	2128	msiexec.exe
Token: SeIncBasePriorityPrivilege	2128	msiexec.exe
Token: SeCreatePagefilePrivilege	2128	msiexec.exe
Token: SeCreatePermanentPrivilege	2128	msiexec.exe
Token: SeBackupPrivilege	2128	msiexec.exe
Token: SeRestorePrivilege	2128	msiexec.exe
Token: SeShutdownPrivilege	2128	msiexec.exe
Token: SeDebugPrivilege	2128	msiexec.exe
Token: SeAuditPrivilege	2128	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2128	msiexec.exe
Token: SeChangeNotifyPrivilege	2128	msiexec.exe
Token: SeRemoteShutdownPrivilege	2128	msiexec.exe
Token: SeUndockPrivilege	2128	msiexec.exe
Token: SeSyncAgentPrivilege	2128	msiexec.exe
Token: SeEnableDelegationPrivilege	2128	msiexec.exe
Token: SeManageVolumePrivilege	2128	msiexec.exe
Token: SeImpersonatePrivilege	2128	msiexec.exe
Token: SeCreateGlobalPrivilege	2128	msiexec.exe
Token: SeCreateTokenPrivilege	2128	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2128	msiexec.exe
Token: SeLockMemoryPrivilege	2128	msiexec.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2128	msiexec.exe
984	stellar.exe
2128	msiexec.exe
984	stellar.exe
1260	msedge.exe
1260	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2128	msiexec.exe
4452	msiexec.exe
2132	MsiExec.exe
1616	ShellHost.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 2132	4452	msiexec.exe	90
PID 4452 wrote to memory of 5724	4452	msiexec.exe	95
PID 2128 wrote to memory of 984	2128	msiexec.exe	99
PID 984 wrote to memory of 5092	984	stellar.exe	100
PID 5092 wrote to memory of 1064	5092	msedgewebview2.exe	101
PID 5092 wrote to memory of 1160	5092	msedgewebview2.exe	102
PID 5092 wrote to memory of 1160	5092	msedgewebview2.exe	102
PID 5092 wrote to memory of 1160	5092	msedgewebview2.exe	102
PID 5092 wrote to memory of 1160	5092	msedgewebview2.exe	102
PID 5092 wrote to memory of 4680	5092	msedgewebview2.exe	103
PID 5092 wrote to memory of 4248	5092	msedgewebview2.exe	104
PID 5092 wrote to memory of 4248	5092	msedgewebview2.exe	104
PID 5092 wrote to memory of 4248	5092	msedgewebview2.exe	104
PID 5092 wrote to memory of 2040	5092	msedgewebview2.exe	105
PID 5092 wrote to memory of 2040	5092	msedgewebview2.exe	105
PID 5092 wrote to memory of 2040	5092	msedgewebview2.exe	105
PID 5092 wrote to memory of 2040	5092	msedgewebview2.exe	105
PID 5092 wrote to memory of 2040	5092	msedgewebview2.exe	105
PID 5092 wrote to memory of 4564	5092	msedgewebview2.exe	106
PID 5092 wrote to memory of 4564	5092	msedgewebview2.exe	106
PID 5092 wrote to memory of 4564	5092	msedgewebview2.exe	106
PID 5092 wrote to memory of 4564	5092	msedgewebview2.exe	106
PID 5092 wrote to memory of 4564	5092	msedgewebview2.exe	106
PID 984 wrote to memory of 1260	984	stellar.exe	117
PID 1260 wrote to memory of 5876	1260	msedge.exe	118
PID 984 wrote to memory of 2716	984	stellar.exe	119
PID 1260 wrote to memory of 5720	1260	msedge.exe	120
PID 1260 wrote to memory of 472	1260	msedge.exe	121
PID 1260 wrote to memory of 472	1260	msedge.exe	121
PID 1260 wrote to memory of 472	1260	msedge.exe	121
PID 1260 wrote to memory of 568	1260	msedge.exe	122
PID 1260 wrote to memory of 568	1260	msedge.exe	122
PID 1260 wrote to memory of 3764	1260	msedge.exe	124
PID 1260 wrote to memory of 2888	1260	msedge.exe	125
PID 1260 wrote to memory of 3764	1260	msedge.exe	124
PID 1260 wrote to memory of 3764	1260	msedge.exe	124
PID 1260 wrote to memory of 2888	1260	msedge.exe	125
PID 1260 wrote to memory of 2888	1260	msedge.exe	125
PID 1260 wrote to memory of 6176	1260	msedge.exe	127
PID 1260 wrote to memory of 6168	1260	msedge.exe	126
PID 1260 wrote to memory of 6176	1260	msedge.exe	127
PID 1260 wrote to memory of 6176	1260	msedge.exe	127
PID 1260 wrote to memory of 6168	1260	msedge.exe	126
PID 1260 wrote to memory of 6168	1260	msedge.exe	126
PID 1260 wrote to memory of 6216	1260	msedge.exe	128
PID 1260 wrote to memory of 6216	1260	msedge.exe	128
PID 1260 wrote to memory of 6216	1260	msedge.exe	128
PID 1260 wrote to memory of 6536	1260	msedge.exe	129
PID 1260 wrote to memory of 6536	1260	msedge.exe	129
PID 1260 wrote to memory of 6704	1260	msedge.exe	132
PID 1260 wrote to memory of 6696	1260	msedge.exe	131
PID 1260 wrote to memory of 6704	1260	msedge.exe	132
PID 1260 wrote to memory of 6696	1260	msedge.exe	131
PID 1260 wrote to memory of 4620	1260	msedge.exe	133
PID 1260 wrote to memory of 3796	1260	msedge.exe	134
PID 1260 wrote to memory of 3796	1260	msedge.exe	134
PID 1260 wrote to memory of 7700	1260	msedge.exe	137
PID 7392 wrote to memory of 7724	7392	msedge.exe	138

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Stellar_2.0.8_x64_en-US.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Program Files\Stellar\stellar.exe
  "C:\Program Files\Stellar\stellar.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:984
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=stellar.exe --webview-exe-version=2.0.8 --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=984.2432.11513169816383203048 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:5092
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView /prefetch:4 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff9cd295fd8,0x7ff9cd295fe4,0x7ff9cd295ff0
      4⤵
      PID:1064
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1720 --field-trial-handle=1724,i,4550795996209162840,6861226565966826416,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
      4⤵
      PID:1160
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2004 --field-trial-handle=1724,i,4550795996209162840,6861226565966826416,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
      4⤵
      PID:4680
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2284 --field-trial-handle=1724,i,4550795996209162840,6861226565966826416,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
      4⤵
      PID:4248
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3420 --field-trial-handle=1724,i,4550795996209162840,6861226565966826416,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493 /prefetch:1
      4⤵
      PID:2040
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3848 --field-trial-handle=1724,i,4550795996209162840,6861226565966826416,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493 /prefetch:1
      4⤵
      PID:4564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/oauth2/authorize?client_id=1444890408306872466&response_type=code&redirect_uri=https%3A%2F%2Fprod-api-v1.stellarfn.dev%2Fstellar%2Flauncher%2Fv2%2Fdiscord%2Fcallback&scope=identify%20email%20guilds%20guilds.members.read
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x2cc,0x7ff9dc42c188,0x7ff9dc42c194,0x7ff9dc42c1a0
      4⤵
      PID:5876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1684,i,9925659507568093555,5400513941288273888,524288 --field-trial-handle=2552,i,12581711304026214577,14059404395476650825,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:11
      4⤵
      System Time Discovery
      PID:5720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,5949069212879538184,2534873680742171873,262144 --field-trial-handle=2552,i,12581711304026214577,14059404395476650825,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:2
      4⤵
      PID:472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,7217174622034237633,14128885082446194830,524288 --field-trial-handle=2552,i,12581711304026214577,14059404395476650825,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:13
      4⤵
      PID:568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3616,i,1086012955580265128,14421685339803145973,2097152 --field-trial-handle=2552,i,12581711304026214577,14059404395476650825,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:1
      4⤵
      PID:3764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,6463682128420086721,8212256825092643143,2097152 --field-trial-handle=2552,i,12581711304026214577,14059404395476650825,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:1
      4⤵
      PID:2888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4008,i,2873373642883736166,5379161213066687906,2097152 --field-trial-handle=2552,i,12581711304026214577,14059404395476650825,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
      4⤵
      PID:6168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4020,i,1674507388257501013,12486805872728316180,2097152 --field-trial-handle=2552,i,12581711304026214577,14059404395476650825,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:9
      4⤵
      PID:6176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4140,i,18385114060653688999,9241668905672873302,2097152 --field-trial-handle=2552,i,12581711304026214577,14059404395476650825,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
      4⤵
      PID:6216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,12911306992807518381,2843948151757977160,524288 --field-trial-handle=2552,i,12581711304026214577,14059404395476650825,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:14
      4⤵
      PID:6536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,15603233650896558867,16436847149723539473,524288 --field-trial-handle=2552,i,12581711304026214577,14059404395476650825,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
      4⤵
      PID:6696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,10390389654938915124,3796586030922036191,524288 --field-trial-handle=2552,i,12581711304026214577,14059404395476650825,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
      4⤵
      PID:6704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,16762286029449559639,13095756781074980434,524288 --field-trial-handle=2552,i,12581711304026214577,14059404395476650825,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      Modifies registry class
      PID:4620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,13144094822670114076,14493713620192180165,524288 --field-trial-handle=2552,i,12581711304026214577,14059404395476650825,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:12
      4⤵
      PID:3796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      PID:7700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/oauth2/authorize?client_id=1444890408306872466&response_type=code&redirect_uri=https%3A%2F%2Fprod-api-v1.stellarfn.dev%2Fstellar%2Flauncher%2Fv2%2Fdiscord%2Fcallback&scope=identify%20email%20guilds%20guilds.members.read
    3⤵
    PID:2716

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A01955C38FEF0B9D8945C8E21F9901E2 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2132
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5724

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4652

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004D8
1⤵
PID:2152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:2824

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1616

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:7392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x330,0x7ff9dc42c188,0x7ff9dc42c194,0x7ff9dc42c1a0
  2⤵
  PID:7724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,17987887473296579055,8706370315579902033,524288 --field-trial-handle=2740,i,1602973228320832411,8738450859327364321,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:11
  2⤵
  - System Time Discovery
  PID:7224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1848,i,18445435126684115915,4066780892422584378,262144 --field-trial-handle=2740,i,1602973228320832411,8738450859327364321,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:2
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2152,i,5518036549747297865,14082157561176566991,524288 --field-trial-handle=2740,i,1602973228320832411,8738450859327364321,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:13
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,10874545429192271460,7894317438178439821,524288 --field-trial-handle=2740,i,1602973228320832411,8738450859327364321,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:14
  2⤵
  PID:6680
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,10874545429192271460,7894317438178439821,524288 --field-trial-handle=2740,i,1602973228320832411,8738450859327364321,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:14
  2⤵
  PID:7008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4664,i,9130570410391397770,13240692625857742203,524288 --field-trial-handle=2740,i,1602973228320832411,8738450859327364321,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:14
  2⤵
  PID:7276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,14260828515035838365,9303132357948999508,524288 --field-trial-handle=2740,i,1602973228320832411,8738450859327364321,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:14
  2⤵
  PID:7488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,14181577400740159886,6228543040135265352,524288 --field-trial-handle=2740,i,1602973228320832411,8738450859327364321,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:14
  2⤵
  PID:7216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4692,i,5490505554124159653,12076934969139927039,524288 --field-trial-handle=2740,i,1602973228320832411,8738450859327364321,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
  2⤵
  PID:6328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,17758968212706260954,8972701918569879872,524288 --field-trial-handle=2740,i,1602973228320832411,8738450859327364321,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
  2⤵
  PID:7616

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:7120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6368

C:\Program Files\Stellar\stellar.exe
"C:\Program Files\Stellar\stellar.exe"
1⤵
PID:7376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e596a1b.rbs

Path C:\Config.Msi\e596a1b.rbs
Size 10KB
SHA256 e7bc705dddcb83b5fe4155276b50c16ef0ee80a526f5507f5e9a9263c014e5b2
MD5 f12f99b6c875195836bed1751ae48442
SHA1 8ad10c80d719c234eb695b69c9f061d57ecf9b6c
SHA512 26ba2e962603a3c519afcf6fcd76dceee45aec646cb7788b33482a06ab0afb5d691038ea5b804f3ba2d40ab1ea2c5af11a6908704cc96dbe9dd299730432dc39
SSDEEP 192:q9Ozv3Qes4V/FQOsJCdv8GOG98GOV4qFtmV5W0iREPps8:q9OzvA7q8Gr8Ga+kaq8
TLSH
T1FF22FF0AB70983D3FCD32F78C6132B9137A2D6C58311639B09ED60695F46B887FE558A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stellar.exe

Path C:\Program Files\Stellar\stellar.exe
Size 29.2MB
SHA256 46d799f0be0d31568252efe0c54236ad09d2a543991bc229be363a7ab3784edc
MD5 0fe08faca8d587275024bf34d0bb2361
SHA1 e28b4ec6cc5cb3425d989800525ac095bf4a3612
SHA512 e6911994f3da1f3cc66511d1863d32b31ef76e2fa263657298e921cd9fa7eb1716d161defb7683e21df80619c8f257c90cf38f6e67f103986ad4db1a35674d64
SSDEEP 393216:g0+VicQpsPaWms4CnLWz6SoXfj1u3wHyUBKUv9TRmrxRvYnNy:CVicQpsPajs4sSzh8j1IkQUv9Nm1NsN
TLSH
T1BE679E117B6B99ACD18BC87083474A634E2134DB1B36B9AF44C462393F7DBF46F29219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Stellar.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Stellar\Stellar.lnk
Size 1KB
SHA256 dab7dd155d8f4e1b17b46f417fa6b47367cde1e5158df87432edcc6e3911a3ca
MD5 15c5aa16b5f9d435999d5ff42fc8a47a
SHA1 ca1ad6a7f9f25bbe18b371e3581fa882e74953af
SHA512 0e3d7a7fc1ea2119a199b0c32c4206974bf66e1c9245e9463f44008d91f087e5d666dcc9aa2290ff0c09d88d410331012f45bf0a925e7d27b5c0470f2cd69b50
TLSH
T1DC41700057E6071AF3774B3B7DB18B568676BD11E9618F2B424A41C91C74100F6A9F6E
MD5 SHA1 SHA512 TLSH

Submit Download

Stellar.lnk~RFe5978b1.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Stellar\Stellar.lnk~RFe5978b1.TMP
Size 1KB
SHA256 565da0c44ab08a0723491daaf6a9245997fdc1a993c2ab7cb4b4a1fd53341aea
MD5 ab22659b6b4f35825fd10663c467fb02
SHA1 42a055e618a3f5073affe8f2715e83a69da0e01f
SHA512 aa985ff1afb78987bfd31640d5393e18990b1f0c07f78b9737786d74c745714951b4f463d662dfb4f07a7f44f57f56acf3b183fb93e6b46d3097aed2fd1769dc
TLSH
T13541911057E6071AF3734B3B7DB28B558A76FC11E6618F2B428A41CA1C74100F6A9F6F
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b73d1269710263f89147c3df740b27dd3688500b4f89702088f2f5c5d7dc1204
MD5 5c816483e5559cb5228e88d336becbe3
SHA1 7a17ded2bda3b923dc276750c1681ea347208c58
SHA512 45993b5f4012d33839ff4c5800d7c41ae9d6bfbec17aa5a850cb8d67f6d95968858d1a5575b3f7dfcde33c9d1c510d3ee911797754f16af36423dca1441372ca
TLSH
T1C1D023703AA5F995D644213596900310A1555D736967530E6200D41DDE3D1C357DF4EF
MD5 SHA1 SHA512 TLSH

Submit Download

46eec125-f5ff-4ca3-b51b-f76f62483187.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\46eec125-f5ff-4ca3-b51b-f76f62483187.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 16307af372bdea3f0615ca9f94db0d315493ec0b9b08fdbd7766cd64a81e2d22
MD5 3ac5c4f61abae2dda482a75b0971ee68
SHA1 fadcc1aec9abb466e03ea1b73c22b361a1e73d67
SHA512 9bd9e75f176b7a64d08c2bd468e2071525a0e876e1fda31efded1f7e3581d74a8b3a4f6930a6babb26773b78fcc409614ed5c673adcd79431200bbc2439665e3
SSDEEP 768:tsEuXNsL+V+uCoXzagagLaSOOMFM0FcD:tsjsL+V+DgagVkl6
TLSH
T12B13983C31905C67CDC7343C8A8F0EA42362F825C6A859972F25B2561692F6FB4DF687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 520KB
SHA256 46bda3cf22fd010a7af69c5d17d37251c9f3fd7e27c9da2206ac186253cf3599
MD5 ea892225ea5bcfab14e8b3fe120ba4fd
SHA1 bbea1b067b950c9fd581be158acee63f51b5f959
SHA512 5cda7e825b19403d3760fafabc6d8893e1fc98f4b689e5f20c6f5f080e2a1ca8f0ece77900bb35eea1b3ef0ec75a2fc6289e33ad8e7b033b24be2c874259a275
SSDEEP 6144:XL/UL/HINj8TflriuuCMMwD2TsMq0cUhQH4Dtszf:XL/UL/Hxwuj/fsMqMyYD6z
TLSH
T100B4B5F78500582ACB7C12F953033A7CC377518D6CDAE9DAE57A0C996829F32B1A4DD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 3.0MB
SHA256 e6d7fb1c15755555234a0628a4e27b828b10df54257fe919bfd819f62fb448ad
MD5 38961c513762e1267577b0299e1e16d4
SHA1 b317396f0200c11643f84750ee84b59f27a3e590
SHA512 905c7307051bc373c1caa4f7d734fa3a98d1374e6cc6c58c8bb19965242be4202548d2caf0474c5992086ca083cad58f8d87bf546181e199ee3fdf3f61fee5e5
SSDEEP 6144:QQ8u2FBF1LG596F/pY+apPCwQzCYxeezykQzgGVymZmh1YeIuagxsmY9X:QQ6FLo7i/q9PGCXmnQzg27IbvJ0
TLSH
T1F7E53ADB87787E92D7A6DE70FDC4EC5A3EB411C2AED6E0432402C67911837C23A9558E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 853bed6c83a953f7e731af527490b774d1db6272e913aded4c803fd53dbe78f2
MD5 4798cde6721bc5d75225ba657e13bd6a
SHA1 099eb60ed51355ad4383f12ad0fcd5789ab1b7d1
SHA512 616700fa3f66d3c1b24b8cc7adfc3119db445c9c6c7775fadbd3b80a6196b840f5482d42fb2ce80e7d74e88e712d7f33351f530af980b53eb67b6fb758d75439
SSDEEP 24576:WHNQZYfNbAojX3W7lB6KXxQeZ+FOApJiSK81s/NxcFtG/4iFk7daFDN:WtQyFb1jWD3XxoOApjxs/NxwtG/Xig
TLSH
T1F7169EEDCA789883CD639A30B4F0E9477C7413C3F595C1D68898C584026BBC5BFAB669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 a4bd0e06960e1848962e3220368d97bde186043f1bfb4d513bc632cf52fb06de
MD5 bc97bd388cd7794eb791fd78fc2f80e7
SHA1 d8df46912d9d72c7d3f93ad4313953bd49a57d8c
SHA512 03d1c841797f0b819aeb2baad4de5080349e92ba6de1d686dca77e9e2d02e561ae2492a0dd7b01aa3f91e2ab6d67f211178d273c802b2b6b92871b00932971bb
SSDEEP 96:m5zQZ3lMjnHTo6fAPR58Uj3roDzKkhD2MEqvyL9pyxHYGPPRhE4H2qNK2:mWcvhfugmoPpV8qqL9pYPJz71
TLSH
T10EE1864182709D80FB5FA9B0B2E948E1B8F2715E20BB1D092B161CF20B45F61F5F8B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a3c20.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a3c20.TMP
Size 3KB
SHA256 d86b2d59139df84f024da68d248563527f50cbd40ab6a2e6b904288151592e44
MD5 59040eb1ee1dbcf50b3418cbed330030
SHA1 8f15f524a4cde43d2fb1c1b9a15da1db50d326fb
SHA512 10f28f9f0e8f8cf086737a5c183fb437711b1fd1cdb23c9e1daddf1ace19a942cdb6e1289fa000bbbcd06e7bc1bb2302754a84ae06698bdcf4a80cffa04f0595
TLSH
T1A5613E10C32119D1FF67F5B0B6D1489931FA924A01F72E012CA82DF1400AF26FACC39B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 febc94d427ea4d08edc9c09f8b73160e73d6404630347b83939ba3fcfec9c223
MD5 b5febadf2f7fcaab1b8b6351c6d2c6d9
SHA1 90f8469851058b1732b3275395fe3c550796346b
SHA512 168adf5b830a4f7bd0e3dbdec0b0e872066a1e19af9e24b9be75b4605cc430a1c48929921c7a854e650f1df367d02bbae657f0701785d28aede967afdcce3791
TLSH
T120E0D89865CFC11D5D6474D76124AB58C29134D3D6D6BD131704CDC0FE47D01B352B46
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 6cd12a8fe182a0ab95bc79eee5e9de48cd26e4000cde8750336d7198e0c8639c
MD5 cdde50b738c0839a82358dc2e60407db
SHA1 39cfa3c2a7d17a854e174f23edfe19e3033a0d1b
SHA512 40e53c213b78071b6e8d729bb5d89513b16a36409a910b44029ec153c006ac1dde0e39a23c75a51718b57819334f59d7546f6daddcefe7311242cbdffd4235e9
SSDEEP 24:TLZHDDNzWjJ0npnyX7yNUs9vb7OkIbzXagfj2ZQN:TdD4jJ/0UC+lf5KY
TLSH
T11AE2A04C3E21F511C4ED733CA0D2C5D09EBC647C478DB67142386CA68D52AA2F49E55E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 285B
SHA256 fff9c841af450dfefe7f284f645d4a26b048e6bd5709ad766b308172bc260a53
MD5 785c71b68bf89a0e9973e06d76434ab1
SHA1 2eb96ed892a724f5f223fe37abbd075d448d45e3
SHA512 a84d94a4b22d325a41b84c193a2e279bc3969085d87eda3fad0dc1032989bd26e67aba7cefa085838590e5aef8958c40e22a000d158fd80782b614dcdbc55030
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 2d16bc302b8aba02c1b08981662fc067dbeb184cc3e0cb121fb61cd3d1e9b397
MD5 22279456d1a5ca3189a584f8c6adc22a
SHA1 7e6a768e2adb08dd1bf4e3c599aada100d23df1e
SHA512 aca1dee5412ba7f2518339e09205e72997ded5ed716eec59646c55546985ab5e707c07f07c7bd1178814e106f07cbf6984e7297fa80628d8d22f1354551c1edb
TLSH
T103E0865804CBC52DA856A9E7C668A70DC6E1754BA6C879075B4D8A40F106F86F29B280
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 56KB
SHA256 aeac5224187c731e80ba7bc8a2bf1655c443d7afaf7357c802018900d28921d6
MD5 fbd7cccfd6868b7411e2853953d13857
SHA1 8dee892398ee7b61c4b4cfe36b493698a3d624d6
SHA512 91d373afdf082e9653ff2bc4d7d9c914f3aefff65081af7a7306bc68ead89ba6c42cd0a20acd4eb1e8c08306b6801824d3ade960297611a7f1521428b736546b
SSDEEP 768:iQvcQSEbG+Q3wJMHTFcyg2Yte5pbEbGnP3w+MHTFcK+G2YEgJ5Es:iR8i4kTFcyg2EeTwiIpTFcKl2dgzE
TLSH
T1B143D0289F3230C3C3550BB6276B05B60F5843C7CCA84972744681BA8CED973B6AB75E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 e306b2f2b376c9ee8dae415a1f4eddec866732cf4e80d36afafcdc8132faf58c
MD5 861bb33be272f54f3c0929a336ce4e11
SHA1 3c2623a703b778c0afaf0764604c3810cecfea59
SHA512 f373089df129a264fa9a7e68c5a0063557f0f9c6416d35202287db356bbcb483375ff34a7c6bb1e711188b5ea83a97ff232e7a94141ddabd08353762200e60f8
SSDEEP 96:rZ8emtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/8s8zxbbEOVpZf24JkMfXSFRe:r+e5H+bF+UI3iWGVoWN3qL/uzRVVV63
TLSH
T1A8241F1F5F352722CDBD813669E744A35C6CF03F8B1366DA6C6114B5CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 10KB
SHA256 0196369864ea6a0b22f9fdf5d8faea50930c479a16516123a261881f93fc25f5
MD5 0e9ec63c2917f8ed019ba9675ebf3c51
SHA1 739095f625d0f39d14f87a330667d1874f88898c
SHA512 e2d339b9f62dc1428438368f2acec9f354d80e8065ab81b5f21bb6cecf10774f5ce0cdb7e5407201b07cb1b26bf4ec9019d86c39bafd40352975d693b8575a3e
SSDEEP 96:IO2nwejJYuYQ/GStZpZfsiADZXYAyKU3Q2mIAMuwnlOv3y/KPsKXl+CJF9o1uqNH:RGjJdhfuU3Rlnlyi/gMChWjv2Ol
TLSH
T13722323FD408847E47778327D28B391ACBBB397E184CF959D1C61D0C02AE6AE1215A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 e2b92c93434606100110b85200775bf0ce06cc33dd703bccb7e4db00b75c9e86
MD5 c730447e5ac6d2f66f626712c542d08b
SHA1 06af3a025de8d58f25b4e436410af8db83b07b8d
SHA512 81e732a4615424c9c382938be1ee8502f90039865d7e4f40c5d60da52c3c5235db91eaa382d602471a3807790d5ac65bcbf0545a5bed9c212a9354ae49c30067
TLSH
T1CAE0206845CEC11D7A446097D22C770CE7B03557D6C87E061F449A40F40E948A3876C3
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 7efffd1601a53b1ab7c1062e376d9b2839e33d882c76c063bc5957d0d9e48f1b
MD5 a542d43f3c185d63552116872be87ce1
SHA1 2e82ab5733358bdfd9440de26666f09f5c92e51f
SHA512 d5040478714b06d860c0a2a0a926ddd2a6bd2682c2d93ffbbf97a5c6b359ff24846287671d646f233cee3e44e035af1cba5de17a8649363952123c46417dbdd6
SSDEEP 48:Txk/LopFMaty423w/a9NUuTAs+wm8g9c2HNus0iHNCCtx1oFwCZWpReMBH:qDeMatha9V+Tfx0l+EHMpfH
TLSH
T15BB2B50E4F346610D2F9963ACDD781562FAC112C8B773952694920F38E6336BB6824D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9eef36b2fa6422b44977d344ff1bb37b733ad3c6ee660eebf42c31f045395a08
MD5 f359016a4b805432a7da57cc8286d6f0
SHA1 bcfc5f828cee5f1b36b3353fed7dc173fde506f9
SHA512 bf878ed4a7567065f026c9690bafe51eb4ce995772ec9ce1f95388b1c22f9cfb3fe8b86e8b5198298a9cfe0d7fc74bc51b08a0e9713ced0454de3f93f5cefd0d
TLSH
T17251AFF3C3E8862DC91156F0AA146E2FCE2C0954431C3C6AC9E4AE1BD3E3471E18199F
MD5 SHA1 SHA512 TLSH

Submit Download

e2dcb19b-2522-41b5-befb-c27c9ac6f37f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e2dcb19b-2522-41b5-befb-c27c9ac6f37f.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0d17d14397331a3333950cb4c6eb3b1f63a8b3e46ce4bbc6fb0b3f8568d29997
MD5 6878690da2cc00e53e531eed95824cbf
SHA1 9846d9673920812aa1d757fcbab653d9534afbbd
SHA512 efb443e639e9a6e8e2ed914d575386784944d7cf15c51a0ceaefa25f11d80ddc1734d917b09ae869e908c8e70752bd331e91f490e3e329b20efe82d0db57f503
SSDEEP 192:sxRyRaCA/frsjWpVqN47OZ21OcVAzoA8plP/g6+WNSj5m/YgxCYvGcjIgVwAoJ:sxRyXA/frsjWvqN47o21l5/5j/082
TLSH
T16742C9166D28A93B8CC7E21DFF55BF63D3F91022A1D56E44A6FC8A1C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 eb61d4f488683750992510f15f1b36b52872ab7122218ddf7b34c52a31e22895
MD5 9a1415b15c9026efa6e091354303e745
SHA1 887c55a7de69a54e1c119d95bb94c19cf5efc2db
SHA512 20a856612203e40051d575683f65b9f4564f311a5cedb6c0482dbd0c0518391a4d8a1b3293d10589a4d23e22a9c3988df8a1b1d678917ba8db870d61a3c24bc7
SSDEEP 192:sxRpRiCA/frsHNZ3wGIzoA8plP/g6+WNp5m/YoaCYDGcjIgVgJ:sxRpzA/frsHNZ3pR5/5G/ZU2
TLSH
T1B032B8166D28A93B8CD7E21DBB65BF53D3F95032A1D42E48A7FC861C04E7ADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6676d411b220e977c13b3587a4d4b2e5ddaa6990e333e02be5db2e63b2a41a26
MD5 cca31844bd8ff98b925756e0b5ac61f2
SHA1 c06207eed1fdaa434cb51f482483d8b714b4b2e1
SHA512 8e8e25def796b8c853c406efae005ad1711f2b64809ecfdf35f4ab5aa7d2a5711ea0e2c370118af1bc9e94134f4ba3b3c91f244bee559643019a181cfb824e47
SSDEEP 192:sxRyRaCA/frs5WpVqNZ3wGIzoA8plP/g6+WNSj5m/YgxCYdgcjIgVgJ:sxRyXA/frs5WvqNZ3pR5/5j/0w2
TLSH
T1CC42B9166928A93B8CD7E21DFB65BF63D3F91032A1D56E48A7FC861C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 9df9684f014d907f0bf24e225192e8e59f6cf204a5cacbf67812142165373c0d
MD5 ceb3a8572c15ff99b95ad223308ca109
SHA1 8775238fe1aa64d653facef463b2b65586e1aac6
SHA512 746f9402afabdcac35f47de82fbc4364303a1a9e24ceb7ed9bf801997d019f8e8d6df31f2c6e0f2b0c50623ecd9cbee865e2c4fc10e71ade95ceb50965db7581
SSDEEP 768:j26HWo7pLuL7MRWgs2fw28F1+UoAYDCx9Tuqh0VfUC9xbog/OVwVuw8ro9Ke0UrC:j26HWUE7MRWgs2fw2u1jaD4wnNC
TLSH
T1FBC2DA7B740DCEBE4F800ADDDC197E9F6D6802CB9A98CD8047FE951C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 325d1da4bbbbd34e4b7795615df1a6bfa51c5477c038e1a53fd4bf2fb2fa0f51
MD5 42c2c5c127d57744d62a59ce235e768d
SHA1 3f23b1973f7fd418e4097c0c2db5466660ea0883
SHA512 f28ecb6e977af5fc9ad0182f21ed824a7c7c09b76f4d55b6bf362411769c3ec2318345d578b02d6e96d808d3496d0e4d39c85a0f2f42e0e66ee40137382165d1
SSDEEP 768:j26HWo7pLuL7MRWgs2fw28F1+UoAYDCx9Tuqh0VfUC9xbog/OVvVuw8ro9de0Urb:j26HWUE7MRWgs2fw2u1jaO4wnQMO
TLSH
T15DC2DB7B740DCEBE4F800ADDDC19BE9F6D6802CB9698CD8047FE951C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\fecfb0f2-3897-49b3-9e50-90bb367b1e35\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 6b167047a279a7ca621050b92c0f8d196998b6dfb40f3b5b2593a573b5ce5aa5
MD5 76fda1b23a7ae4bd9c01ecfc432c064e
SHA1 79c167a67d31b5191a996a0565050cc3ba08b376
SHA512 8c6764ef67aeb4cc8b35ff8d456490eb22ce741a7391df8a7e23d454deec34af76f64118b1d6399e4e67b46212cc331a9d9316dade2cfdb0e38a08790996d80b
TLSH
T14DD0A79BA05601A2D77E8B531671946A47183C8C189990CCA502C5A65BD5F53AA13FA3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
Size 233B
SHA256 9034ae3e679caaf69a5be2a6c3b9374aeb0bd02a9907b8ead9ec8772092f521e
MD5 b24a9fbeba872c0a010a2271381ea8d3
SHA1 5ee609fe4005202033dc7537a8f31c56bab95b5a
SHA512 eb4cbf948ad1a5191b942c10d8f7f2f93de6cd306e8b226855ba61bb64688b46d1f95315e7eaa04d3a4faf4f0a2a6790a8a7e7206ca577f4d4f02ec67253269c
TLSH
T1D7D0A79BE1570092D77F8B531631589947183C8C189590CCD503A4AE57B5F43EA12FA3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a2a8c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5a2a8c.TMP
Size 138B
SHA256 36c484cf321072c10c0fdc679b51e05399ebf2223b28fa3c4784b9ee1f7caa77
MD5 a26baf93076dc0a48829c3bce256d387
SHA1 c795ea83cedf0d050a04bc0f48909e9692f41c73
SHA512 9105ad134e891f4c144fe01c46c601849ebb2fb9e104b00373adf45dea773c83191f3a8647e4fdccb14748985b2dba2b2b74e8ddc6ac033b48f6d979fcf4918d
TLSH
T1AEC02BA7B10201038B3507520332D04C43483CCC0CC1C4CDA013B8241772F133202FF2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 6e25e1737fdf1df2967e2bad1f96cbaee8f0ac065850584f87822d34c1867c95
MD5 5847e66f64dd00e11a226b7dbaf8a877
SHA1 11e554593ea34020ba6f221021c8472d6868d3c7
SHA512 e66744a47534e989da5c7fca62c7d0f4fd819afc2ad8ef97437f8080bebf5577efb2e07d337229ee4bfa452e87f868d9b9dcf242f37794d0ab3a27077933f6ac
TLSH
T15EE0865406CAC6BD699662C7026D9308D6E4761FE7C87D822FC4CF54E587F48B1931C1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 aa412e461e230b158920dd5c296e164eb9b57fa7f2704742934d0601cba3f546
MD5 0d5f68bec9f898304debd6278a7749fa
SHA1 ff03f7c24f23a9801086d71ad904cc28033d03f0
SHA512 cb62e05cd05d867498f664904e18e7db370baf3abb6acda27ab4c6119a0983dc80a0cbbbcced7af3d60a182fe1e1dbb5d79cf0ac71e28a5ca6a03133d87e28f8
TLSH
T1BFE0D8241ACBC63E6587A0CB6215F708D2B27603D7C979216B4C9B80E24BE40B257580
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 003e89443b4ad59cdc6459b34a128c0e7e89e569a1d475213dff87b55e841be1
MD5 5e321987393efbccc2841b3038e5ecf2
SHA1 da83b588ac090b2c0444254a3ad328978323e8ab
SHA512 1034dab37350d3d6fb8446410ed21137418c3e39549b2bdb183ded0483e6f0850d8117930074e827d3f684c7d223a372fa269f064d1aae6c08dae69a3ed2ddfa
TLSH
T16BE0267499CAC63D6940A1C34278A70DC2F07B4B93C93A029B4C45E0E102F80B2BB980
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 2KB
SHA256 3b1941a7ff4cd405d16174d1322d41579b37b9994faab8a4d8892497ed626a65
MD5 f417bb244be55508784f74d785877ce1
SHA1 fdd6a383ff249b574d9732d7ddbb24811b95fef0
SHA512 a3d8a5db343d4f08f5efbf7870863d72d34f7de461979fa8535f82dc7f768699f56985e47613a494b67cb9b314b621eae5906710e3eb1f345f4f8522e4566b87
TLSH
T17651B2123ABE02096EFFB51CA059952B994132B77078E57B37E901A50AA7F005DFCCCD
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 e82a516c3ae4e8ee50a094dc4929290ec337fc346a0531876d5b9d1eac54f963
MD5 016e4c43bd6f44d019db296c99dd78ba
SHA1 5d6e41a4997fa6bd40cb4e7cbb5d91e27f597727
SHA512 804a6bc076bb8936613bac5d8a2877a5e84b59489a689e14fe8f427fbced47e68477782681745069b7bd71043a57209e4e69acc4c0e27af384b8a444bf0eb67d
SSDEEP 48:K8yIPKHKw7yJ2IHKLaEbWI3KXKwvyJZgV5TLL+5bClIMZ+KrLD/+Hxuaqvj:K8y0KHK2a2QKLaQWkKXKq6WUK/qK
TLSH
T184B1BF123ABA06047DBFB51CA0599A2F568231777078E53B3BE945A50AABF005DFCCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 689aa7ca2fdf587ffd63d71df89465fe5717bf274df68a4c34ac4a1443e39f2c
MD5 98c5cf88a9283db3f0f48ed809ce3322
SHA1 074310f93dc1ad213e9851a2c28c2ed0b86fe0f9
SHA512 bc9ceb296d51e5db2f4226ac8e8ad481d21067b0e0f11525d223671a4fca853ffe714f3d465d83c26adfc111a544c28d960811446405eccef00a2371d3d3934d
SSDEEP 384:DNrRZyCSDnxTIClntgMEhIKyll7svbFKfk7:xFZJSDnigyI1l7svbF9
TLSH
T11444740A7B747001EDE6D9721CB080771E3CB16D8F62A6916DA254694DB3853A33D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 d74a8cea22134186502a56bfcf98929c38df954ef2c7372733e847e625747bc9
MD5 b9be38a06dc0aff562f66db1bbddf3d0
SHA1 29999f74f06dbfc1fa99c77e54c8e8f70552f0f4
SHA512 6f9bec1c6b5389a8bcbb6cd2a35d68300ccce84e3a1ad2a55c1117e0b1b07f0f8b53f0721c5aa94cb9fadc80a714df58067a3bf45f0a085b0142a084bfc1dd27
SSDEEP 48:zEK3tjkSI5IUltGhp22iSBgBd8VeigFaTSbkd8Vei4W:zEtSyGhp22iSC8EaYg8/
TLSH
T13052206FAB743112DDD4077ADA9006EABF6D813E4ECBD6A2A49000220EF9551731F58E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 497B
SHA256 984a417a4e2ffa3101fcb3886105d2cdd704894ef08ac59f35784f6b022da83c
MD5 d2cd44468403a51b916a3b23a1bbe886
SHA1 4a755208eb6599b1d96fd88c0440005770eaa8f8
SHA512 c3b3a8adb5b0b8246ff88d472be982396a92411b3757a7b433ecb69770aad7856f6dcb34420085d9d32be5f87a4f1975220908a0f3bc5247a83c453773ce4625
TLSH
T1F9F0C2CBAE030977DC02503151336782FF6189CB08246867438D246A2A1E1F1CACC1D1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 df6e684d6a00b965f80a986e6ea62a2ac96e25f877c311905d543d10831982f0
MD5 ee01be46571984602e6ed55d34a2497d
SHA1 5f42020944484d72382f88d00a6e89d2af1fcb63
SHA512 eeea379c9fd6401ff5d7e9bca3c95527061e9bc9a53be61c11dba45f4121d343b98242ca96d4f1c44163ad861cd43088c67168c27e0caecb26db5d8b4e96cba3
TLSH
T1DEE026B8E8CBC96FA8566ACB12249709CA823A23EAC839061F40C544F006E80B2CB191
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 97eae66f849a6e7c07efebef8b548b94cd9c2ab2b2b3ef6e60cb23540ca14695
MD5 58a6eba701d969d22b460ab15e019116
SHA1 7e91b8415e271e902b449a714abf0a003b23ea5e
SHA512 78afa03cef73b1097318a2c86f7968dc12edb40f72f108fe5e567bcc2614638a9780673dd235a29c623d9f9c8d5f0754b3f322e2bb3c2e9b213091789c27b12e
TLSH
T12F21B515F330D014E25A827A607F9B351738E8569FBCED0F857A20746E72A440D4B7E4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 8c85f2bd687bb51d8abf81859e3e005581c250b75119176fb8650675e29ccc38
MD5 746336d428dedd23557137422df23ef6
SHA1 d59eccf758a7fde8759792c77ef3084c4dd0f3d9
SHA512 b57069d125c408fd25f0d256eccade8e2a96f9a9eb809c05c6075123f633f8f0b187299c1725fb9c91093a03d236d5ec9628d8903c7bd8b7e4353691b4efc2ff
TLSH
T134E02614A9CBC1AF9C5262C74164F748E2B53903FAC83E425F01CF44E106A81F2AF1D1
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 46f74cee5d2e47a0869c05ed5227543987aea04fa2cb0278557c79aa6762eb66
MD5 c69cda79885a1ee5c315e1e5b2ca78e3
SHA1 cc13a426325eb0d353e6b1892206df0a1b9bc857
SHA512 4494b67ea9deb837446d559ec2082956589f0fed7045a001e07cca1d2dddfda7daeefa901f469e8d40e4da389f9e31cd996362b5633e89b4bbe209a8b3b8ff81
SSDEEP 3:MsEllllkEthXllkl2zEfls/t:/M/xT02zN
TLSH
T1524404047FC0040DC500113054D1C3743370D51005155F4374F10D33FCC75400C11000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 c0152b38b7f07179ca3e2ef852ba0dc646dfa78b9e3662d8d55124095d3023aa
MD5 893cdc0a0bd227277181fc1265f13ec0
SHA1 8cfc77921cae620e91fa0cad48f979b398739b61
SHA512 2497fe3a6e28fe538bbe9f0c56ffe1924db1f764f3bc082f84b336a3d7fae467a85a11466b589c07fcbd73b80c409ae02cd764bce2d0458535a8998017d48118
SSDEEP 3:MsEllllkEthXllkl2zEflmZRq:/M/xT02zXv
TLSH
T1B44404047FC41F0DC5011131C051C3703370D4101FD1775334D14433DCC75400C10000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 c196632a4019055c9635d4de548acf220e78ad00057d7cee688f9e9b73d0a5a0
MD5 963316c386dd224c430b9f0dcf34d8b6
SHA1 35c04db6674211fbcced43c647b15e034e860932
SHA512 b44c79a5d3c93966ec996832943a00ba766f028967ba61c60df37d9d3b48344fff2b7d240e5c21b96f71ea89eb2358de4d25d4b7bb16d7bb61e83f862291bd5d
SSDEEP 768:Krv+4UNbdz3fwo/TBOW+vAONXyer1IRCzni9ydMbGeTl:KbsbV3H7SIqnjdeGep
TLSH
T138139D3CEC149E3F8CAEB385710E26236EB8413BC1A40694DBD91B4D817786DF30B956
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 4d7a6b01589d922ca99e2e0caee56e86d91ef480bf69b99318ba452c8faac8ba
MD5 57ec48c346eb93306f69870ea04a7f3c
SHA1 a51e8d2b47206e4506af2ac257d4a7406f103951
SHA512 40c8e7654edd4463bd31f25b80543c8e469c0da430e7dc34cfb4b21557ee0c28100e04cdcba12fe94be91c666efe7c38ca3d34de2dab665fa9e0a31f404698a2
SSDEEP 768:Orv+4UNbdz3Kd/TBOW+v1ONXyer1IRCzniwceVH1SK7:ObsbV3kwSIqnwEH1l
TLSH
T14D03AF31E069DE338DE6A396B147B7537FB8205B89800B90EDDA1F4E0A9759E130F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 7a81f86a42bc25d02b5ee611eeb1cb8f74833edf2bcc13c2c8b885824244d894
MD5 1886cb277c04f25bcd2022d13fc11519
SHA1 bd39d30add88b384f860a3bf728977b4926332d0
SHA512 ad13cb7e805d68e1148dbec4fa80d6f454124981f531dfba6384bb3f2d8308d09fb4ce5dd5f922ffda4039c5b2581d659e033e96e93e652925b35ab2f3a2bda8
SSDEEP 768:Krv+4UNbdz3fwo/TBOW+vAONXyer1IRCzni90dMbGeTl:KbsbV3H7SIqn1deGep
TLSH
T1FF139D3CEC149E3F8CAEB386710E26236EB8413BC1A40694DBD91B4D817786DF30B956
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 5eb22f3d5d32a01a5e8c7254e6cdd5f3f43b03c54121f744c9b01d2757d9a82c
MD5 4ac7b270ae2b6f5e8e0156abef80439e
SHA1 dd337cae13fab6ccdf72a790ea25ad57b6ffd715
SHA512 b5783d0475d4405b6c842b1a1eed46d28a9420e4eb29657a8ba6fd12bba749e4dd7f7021116eb7715516051f11397dd3ce0967ad72606441abb4fa2b6086ed81
SSDEEP 384:nsZcIM38NAf8uVw2quhf3RTpXOVc3uXp5X2Fj3GrYGgAN8SyrCZr1IR0VhMxARE8:6M3fwo/TBOW+vQONXyer1IRCznie0Td0
TLSH
T113E2AF31D4659E378CE6E382B1063752AFF8911BD5C80B509EEE5F1D06D7A6E030B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 73de7b7b0730c00f041edfaf9dddfcf4a8ea432f579d83091b3c18479da9e2c7
MD5 f640e9e5c0ff0f1448366d989cf1fe55
SHA1 fbb9396dbdfc232c6628fd43f03f342c8a3bfbd8
SHA512 d53f8257f7dfdfd60ef96799d1a2223d23a03048f61460acb7b4c2a09dba1d737903b42bd998d9047ecec67174d876734b62a87806b5678fa4597d3ca37ca95a
SSDEEP 768:hrv+4UNbdz38V/TBOW+pONXyer1IRCzniBueVH1SK7:hbsbV36sSIqnJEH1l
TLSH
T17003CF32E4A89E338CE2A3D6B14776437FB86057D6800790EDDE1F4E069B59E130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 767699a3ee68b17eabc633f2fa4c8399ad19c160442fe8fe580d7ddf59d1be18
MD5 01167c450176c7943e08b1eb23b57e69
SHA1 0c587489462aaf262485b6c72e1b9ea363ab3f1e
SHA512 65a5016f432f42d368cb4c8769c539372b5f55952e2309fccde80e0afae0d20abe2f2db9224b941347d1c430d0d2966d7380a8393c5910d25e8acff2d30ffe44
SSDEEP 768:vrv+4UNbdz3wP/TBOW+v1ONXyer1IRCzniwceVH1SKk:vbsbV34wSIqnwEH1m
TLSH
T1B503BF31E069DE338DE6A396B14B76537FB8206B89800B50EDDA1F4D0A9759E130F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 2a4e15e68ec2d4cc3b3f1a4df8a0eebd06ce8229d9036f511df01eafa30726e0
MD5 9595a4224a98139ea9b90564535f4348
SHA1 d37612357528ee8b33a5845130077243090d209b
SHA512 f8178f5efbd27defc16f33c737a6761d96cbdb266a439ed521a69b885525c3eb5bbaf2b511619671c6fee78c2ad88204cccca469675386200d78536894adc395
SSDEEP 12:TLJYJiEZXiDiIF8izX4fhhdWeci2oesJahvGFUxOUDaa1i3isuQQtydXwSzbdXoy:TL+j0afDdWec9sJVUOyR+pe1jy
TLSH
T18C9221266D352433E8DE4776BC8349A00EBC039ECDA779548DD40D720DB1BC2A6852FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 7d5acd06d6a282e0d2b464be22bce1eb55b3e341187cd5f7182cde2b7debb62e
MD5 615b2c014121b90e63da08c5e2c60f7b
SHA1 7487c42b6e2856be1a82c2f475e2ac359ebe92e4
SHA512 eb23a4f2de35f212aa89878d9424ad233e479197add1fd63e1bcf1e4cc685bc632d9c7cd5ec6dd0928b93b81fd3edd87e1201dd7694d83f5c8cb905819a53e86
SSDEEP 3:MsEllllkEthXllkl2zEflhTRKX:/M/xT02zeI
TLSH
T1824404447FC00C1DD5101031C053C3707374D4100513574734D14433DDC75400C10014
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

09f72f69-d9db-4241-afef-179c240e7efe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\09f72f69-d9db-4241-afef-179c240e7efe.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

6747e0a0-1c9f-468e-b8f6-92211084c0f4.tmp

Path C:\Users\Admin\AppData\Local\Temp\6747e0a0-1c9f-468e-b8f6-92211084c0f4.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI1C29.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI1C29.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir7392_174737465\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0c66c856d657559df8a81dfe75a9702705d71648b26c830df01f36be7c4fe874
MD5 8086a5913c4669ac762572bca754d9d7
SHA1 b4d0064cf0a73bc6e9a5b1f48b91a8d32455e035
SHA512 da7f1868559b6941904914a03cd9a28717a90823ce50e0a99da61cea26a054be803e1ecc3e50f4f6760c49813eebbb15643f61adcb548444704a492cf4459438
TLSH
T1CBD0045151015001D1F0703110504500D3407701101343C404F557145F54501405D000
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9f4d2c26492d1f05c1761c037b79b356b965a3d15a5f4d62440ce20f88c81d84
MD5 cd1ed0e0aea49787f8b2b98e21e7ac77
SHA1 3a724111e35c00f4a8a7f06cabb0b8a13dfd1086
SHA512 9d3afe74cf0be0dd8675c670e144b6922ce36dc10895aa1dc87d2eaf8f99b8c2c5635d3eb0891ac51b5e45ef842ebb4d6178834407745dd04b0f81fc183ccf4c
TLSH
T1EFD0121332024134C0703033104265085540E30B40068184587DDB2D6F18450091A441
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

23d9aa94-578e-4ca0-a00e-ade392ca7431.tmp

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\23d9aa94-578e-4ca0-a00e-ade392ca7431.tmp
Size 6KB
SHA256 75e4dfed6e3ad404e8cfc6fd9e7e518fe471f0447f71b138199e4d33c1703d45
MD5 38ae8b1db3743e5a017b4f18c2b3e5a2
SHA1 82aa26201fcf25dff9df5e1257ae99bc80aa1e44
SHA512 9c14cc00c812bc6e45d39424e364dd278dccc7ae126951ad2a39ba93ba0065967acdf5aeca66bfed52176edca89db7e9499aec0eb9015371b7f15e030e1babee
SSDEEP 96:sta/dyaFs1Vb9h/kro5h16Z0ds7/x+6MhmuecJMDErjegK+gCOy28XM1C7K:stCLo/gondsV+FdMDqjcc9G6K
TLSH
T1A4D185026E24B97B8CC6F109BB35BA56E3F9606124D11E58EBFC462C08DA9DC631790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 e7d82b0f84eb4d61073438cdaf7b52ef23b15338cff37730fdd3c36fff394dff
MD5 336b70c68f4d25eaaa087beb5437fe3b
SHA1 99867f9ed54fe5f3abc5b822974a40d3cc269820
SHA512 13516edf669a6a492fc6d2f6f3ca6427bde3f5bdbd69d6ebf4858fca591558e3fcaf7dc5fde7241e8abe6669f562598e66b986a02d85fe6bfc50a0cb1f434364
TLSH
T1CDA00261025C1C22E55017B620C103913636D82443030B11D6E0456988A2BC4919B592
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f841.TMP

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59f841.TMP
Size 48B
SHA256 276188bfbc38cf7dcc0040223319a0a0a0eef6725881cdd44cbd24e1505a0533
MD5 141ce480853b738a7db75f72af1107ec
SHA1 11d1e318f0621c735995b7c94e1f8dc4a34a1dcd
SHA512 c087b85a019bdce977507613d1899f6fb5794b9e1dfbc9a1ca8564c04859f50dc19242de3bcaf4cb587271a29b756b702ea1ed4872f42a02045ef13740803e95
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 bfe1e68461111e19ef8eb71900a146cfc759d9e9b8070fce6666d5110d3e4997
MD5 b130ea3c36826ec328ec86546b177d6d
SHA1 628bdc04f1177a4245308df9b9de4bad957870e9
SHA512 987dc1720b7e0923821349a0dc8715202dabe551cd11bfec77c1e7f26374c8623018cf16bd546145b3cdde45020764ad2d4dca61801fd1b08c49e9c9dba50c72
TLSH
T13A41A0A2C2E4C67D89456AF827303817CC2E051DA1283D27CDEAEBDA6BD2471D22550B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5abb04.TMP

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Network\Network Persistent State~RFe5abb04.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 c30328101716dbf4c56b24b620796b3197d94ed7a0ca95c2f2afa2f2d583ce89
MD5 fca7b0bac962f666c2e63f82ad27a685
SHA1 6de8ff7e2214872de3f08cc9d190b4fcf7e95078
SHA512 59a6860de615a4df59c9ee33108ab9c547ecae0c53c91648fc5382a5b79e19365cc077621897626d36eb5f20f728db41d9faab73f63aaf09b6ea426caced7e98
TLSH
T150E0D8E240FFA9771038592A0E857C061E36B938119264EC9E92416DB0851F64A12431
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 fc8f541e8db3bf66fadc13840830031e9ed1bf30f8eea8cd0f367c3ebdd95a0d
MD5 ac7c20dfe4add702f72cd53dbf3b8dab
SHA1 c1d6c3c606b35404e6cfacdb3e81aa36809c1c71
SHA512 3d950c86c596b4e8381461ab1bb0a2dd21e5d1411e3e6e922c4b1f430a4238cc8b0f8fc53f086837decf6fa7b2ecc231d212c61662419955fd45768cb959dbfd
TLSH
T1A7E0D8F240BBE577103C592A0E857C1AAB36F638119264E8EEA240ADB0862E64E12431
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5a3f1d.TMP

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Network\TransportSecurity~RFe5a3f1d.TMP
Size 356B
SHA256 7514b907d4704c777c0073cac9e5ba6d54728f07918b732b009931fd2628f780
MD5 252d8cf9183e28d9757edebf48af51d8
SHA1 bc13bbc9937418a3286113076e19aa83985552b3
SHA512 44bd8ab1a5c606a4cbc47f4319db8693115495717fb49e04186024ec724ac59ba625531cf34712cf59ac4d6485ffbe7530d0a527fe66cf22e4a9e335f7988f07
TLSH
T16DE020F340BFA677507C997E0D867C061F3AB53851D264E8DE93416EB0861E74902471
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Local State
Size 15KB
SHA256 8409b800420adf465ee1fb1063d86482d0683a451f8837d6f0f185bcce34288a
MD5 fe13fbcf51e67579f95cdd7950c5129d
SHA1 16c2bbe8359b8f09b49fae5b9e3e36b05476f988
SHA512 99698a0c42a75f93c70cdab4b523da3d51911c51ae6cda06d467d2348b35eda7ccf97e757cc404bbf224fa7587931b99c5368d7c2d670200072734108f5ed27f
SSDEEP 384:W+aQikB+z/xvxjg/qhEPNBSzQvtnPh8/9zm:h/UxvxjgC+d5QFm
TLSH
T1D7728E3B9939BD37D5B3E5157E590B5BCFB8946290C26E784DFD5F0D06C72981302812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Local State
Size 2KB
SHA256 17b263d3cab1d1e6a3c5cfce22d1b3b49582fd2e6dce7dd48e8703221b4471aa
MD5 66d0844cc9bcfa92bc026e5373f269a1
SHA1 905a9306713a1a4be662e6bec442a4f626d5b1ba
SHA512 6ffc59a4212f21752f836db009b34450553432a0681b390f606f53688803d32115b7bb5b890893a6a3c4055aadaeda618bef3b270dc4415444c3e6b1ff223bd1
TLSH
T18E518473AC15EB7BD9B2D249BA4A2F23CF755166AA821F50A9DC0B1C04CB95C2302C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Local State
Size 3KB
SHA256 21e9a5f5b66daf014405cf36ed23fd112b38f6c23443a7af04659db139323267
MD5 830cdb77d9321bbe146047b319d5cba8
SHA1 28a72c32992dcd0cccfde3978ad263a8593f75f4
SHA512 7c25a9aa4b0ffd237673810644324d10597e804fd145657c014b08a922dd7415a88e72cfda91cbe36dd24d0458e68220c419199bac4e15e0345e10cc2bf531e7
TLSH
T1E4619477A935EA7B8DF2D605B9862B16EBA55027E5813F94D9EC0F0C01C76882342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Local State
Size 15KB
SHA256 7b292c4667add835589d853e4359f44ed0e7391810e86f73e14ea50184d6add9
MD5 28af30bea8e2e4119237bb92d7594029
SHA1 90bff10d2f949dd7312333d436323b13e2d618cd
SHA512 945f5f50af55f106cf07abebc17e5b1fdeea08203d0fe413266f02cc5a525fdd8e000ee7a38d84d966ee38375d35cad7c44b4d6d5aa561e58c3f90bcc886c81a
SSDEEP 384:r+aQikB+z/xvxjg/qhEFNBSzsvtnPh8/9zm:K/UxvxjgC+r5QFm
TLSH
T1A6728E3B9939BD37E5B3E1157A590B9BCFB89462A1C26EB84DFD5F0906C72D81302812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59a493.TMP

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Local State~RFe59a493.TMP
Size 1KB
SHA256 da1204b0da7446f5d0785056f33654887a2935861e6c53315279f46e0bf29870
MD5 33f240c5423d338f9c1e43d58cd625a1
SHA1 18c8712913724dc25ad94626a4ec51874c0de00f
SHA512 9f2e6566d97d6c6068dca45599b9b66477345a7d71bde92127ba17c8cb3800cf0cebc9d6a4187b481cec4f98740534e6328199dccb755fa82ab48122afc10109
TLSH
T1962142F3E925AB73ECA2E24A76166E979F20106B91810F44B5DC4B1C0AD758CA527932
MD5 SHA1 SHA512 TLSH

Submit Download

e596a1a.msi

Path C:\Windows\Installer\e596a1a.msi
Size 19.7MB
SHA256 68a77ea10a31620aff066f3cb4dbdf60e0dcd916dc95915e96cd349e21b8d7cd
MD5 dfd26f0241ca7ae42648a46a6898379a
SHA1 b5554dedee251a15a6a18ef542d1b2b071d25b16
SHA512 879685fd143bcb1cce9b3e29b65c3262925024002a0e9e6d0cdbbfceb64796f181984aad6a8ff29e267ebac8a4d28a8883d386854c9fa6aef636970b9147f3e2
SSDEEP 393216:GBe9kt2PdnzNICFijd3aQU1jLfVWpMcn8TGQf4vMdNyKH4C25:DTln+CFij1CLeMyi4vM/yS495
TLSH
T1302733173C42CB16C5562EF4CC7BA3F1095AAC00E9122C1321687E6DF9F29E7DDA19E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 bbf02456c87926d5c56eff4a1ab22c8a6e38d3ea994e7b00d2d1e67af8558c33
MD5 5f3c989e54b880b76be12d66555d1e4f
SHA1 0bdcc9d3a700d956595466ff380a1b598e8cdff6
SHA512 9c832f0eae288526b81858be67a6db2d7362407e135807f5a2931a8f8eb4f21430166ec9cced435b4caa3419b3ac0915c8160b97d2dd0dcaf0cb1dc31162cf66
SSDEEP 24576:1Fo3DMPudoO/vvTL/Sg88iFQvrumHb7P0BKudxSUKpyKpb9cMoRWclmd4+2:eHY
TLSH
T15157B42436F92200E7F79E3DA8F06A234D397D5BAC15DE8D45511B4E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{7f6a8de8-5451-4d26-b457-ce977cf84b98}_OnDiskSnapshotProp

Path \??\Volume{c61f3bad-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{7f6a8de8-5451-4d26-b457-ce977cf84b98}_OnDiskSnapshotProp
Size 6KB
SHA256 865b1b07c6a7ccaefc6879217da7844258c42243280fe7aff38531973115c0a2
MD5 3bee5fb88a4e935d68635320582bb624
SHA1 15ed67bb860abcdacfbaffccd94f35193f25f9e6
SHA512 beb212f2da346e9d928901b79ce860b2c26eb03c340a66f776e83eb5b68fc9bdf1534acf5052cd20f8ab695c6525cb2fa4e24ec5b0387ed612c60402b04991db
SSDEEP 96:Fhk7fCvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:X4eb++uVm
TLSH
T12DD189085AF54711E2F3AB3229F14557A877B911EF33CB8E0198238E2671A14F935F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1160-66-0x00007FF9F01B0000-0x00007FF9F01B1000-memory.dmp

Download

memory/2040-149-0x00007FF9F01B0000-0x00007FF9F01B1000-memory.dmp

Download

memory/4452-42-0x0000026B027F0000-0x0000026B03194000-memory.dmp

Download