ff52c2789b05e280709baf911bb2ca51d607c431205420a8641f204f581c925f

Analysis

max time kernel
899s
max time network
874s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 15:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Stellar_1.0.3_x64_en-US.msi
Size 14.1MB
Sample260712-s7tpasev2v
SHA256 ff52c2789b05e280709baf911bb2ca51d607c431205420a8641f204f581c925f
MD5 d48379de3fa90026eb36896f66f3813f
SHA1 41644a5336cac5956a4263c20efe7de583f8eb6f
SHA512 48649c4c8995016e251e0dd9fbb8013b6308968f38fe76111877e6c378c1708b3df8d400b2b49b607a32ab8497d873764a6c23b57f93ee0b1b0a9756918307d1
SSDEEP 393216:/nthtonKpnbQZFpYk/ud6vCHrgIXG/V2chak6i:/nthTpnb2QkWd6v4rOAKB
TLSH
T186E6331B3D1AC522C0143EF9C836EBF6A51CBC54E512A9933189BE5CF9F01C69DA05EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
6112	stellar.exe
4652	stellar.exe
1324	stellar.exe

Loads dropped DLL 1 IoCs

pid	Process
5836	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	stellar.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	stellar.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	stellar.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Stellar\stellar.exe	msiexec.exe
File created	C:\Program Files\Stellar\Uninstall Stellar.lnk	msiexec.exe
File opened for modification	C:\Program Files\Stellar\stellar.exe	msiexec.exe
File opened for modification	C:\Program Files\Stellar\Uninstall Stellar.lnk	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1668467648\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1668467648\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Windows\Installer\e59ff29.msi	msiexec.exe
File created	C:\Windows\Installer\{867BD684-226F-4F2F-8ED3-7C3E11FF150A}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1668467648\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1668467648\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1668467648\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1668467648\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1604424614\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_894196136\Mu\Analytics	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1653254394\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_259676474\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_259676474\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1668467648\hyph-af.hyb	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{79A1ACA1-E7F5-4D94-A5C0-EA79E0C6C60C}	msiexec.exe
File opened for modification	C:\Windows\Installer\e59ff29.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA7911E44DD81E928.TMP	msiexec.exe
File created	C:\Windows\Installer\{58FF284F-E3B4-4700-962B-038A17B9B5B5}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\SourceHash{867BD684-226F-4F2F-8ED3-7C3E11FF150A}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEA57AD90A3FB44B8.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_665206763\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_665206763\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1668467648\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1668467648\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1668467648\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1668467648\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_894196136\Sigma\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1380076139\protocols.json	msedgewebview2.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1668467648\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_894196136\Mu\TransparentAdvertisers	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_39120757\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\Installer\e59ff26.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD561FE920DBFEBD5.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI85CE.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_259676474\Part-IT	msedgewebview2.exe
File created	C:\Windows\Installer\e59ff28.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_665206763\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1668467648\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1668467648\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1702584686\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_894196136\Mu\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_894196136\Sigma\Content	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1653254394\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1668467648\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1668467648\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1668467648\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_894196136\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_894196136\Mu\Cryptomining	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1653254394\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_259676474\manifest.json	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\e59ff26.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB26E5AFA4A0A4D6E.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1668467648\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_2114672767\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_259676474\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\~DF9ED8A396B7403BC9.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1668467648\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1668467648\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_259676474\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_259676474\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_665206763\model.markov	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2160	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000cb7618cb91d4c6300000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801cb7618cb0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101cb7618cb000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3cb7618cb00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6cb7618cb00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F482FF854B3E007469B230A8719B5B5B\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F482FF854B3E007469B230A8719B5B5B\SourceList\Media\1 = ";"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\486DB768F622F2F4E83DC7E311FF51A0\Environment = "MainProgram"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\486DB768F622F2F4E83DC7E311FF51A0\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\486DB768F622F2F4E83DC7E311FF51A0\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1ACA1A975F7E49D45A0CAE970E6C6CC0\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F482FF854B3E007469B230A8719B5B5B\ProductIcon = "C:\\Windows\\Installer\\{58FF284F-E3B4-4700-962B-038A17B9B5B5}\\ProductIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\486DB768F622F2F4E83DC7E311FF51A0\External	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\486DB768F622F2F4E83DC7E311FF51A0\SourceList\PackageName = "Stellar-2.0.2-installer.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\stellar\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\stellar	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1ACA1A975F7E49D45A0CAE970E6C6CC0\AdvertiseFlags = "388"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1ACA1A975F7E49D45A0CAE970E6C6CC0\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\486DB768F622F2F4E83DC7E311FF51A0	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\486DB768F622F2F4E83DC7E311FF51A0\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\ = "URL: protocol"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F482FF854B3E007469B230A8719B5B5B\External	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F482FF854B3E007469B230A8719B5B5B\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F482FF854B3E007469B230A8719B5B5B\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\486DB768F622F2F4E83DC7E311FF51A0\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1ACA1A975F7E49D45A0CAE970E6C6CC0\SourceList\PackageName = "Stellar_1.0.3_x64_en-US.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F482FF854B3E007469B230A8719B5B5B\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\486DB768F622F2F4E83DC7E311FF51A0\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Stellar-2.0.2-updater-JPAUaz\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1ACA1A975F7E49D45A0CAE970E6C6CC0\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\486DB768F622F2F4E83DC7E311FF51A0\Version = "33554434"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\stellar\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\stellarv2\DefaultIcon	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F482FF854B3E007469B230A8719B5B5B\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\812181F64B4B79A53877A752AA655852\486DB768F622F2F4E83DC7E311FF51A0	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\stellar\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\shell\open\command\ = "\"C:\\PROGRA~1\\Stellar\\stellar.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F482FF854B3E007469B230A8719B5B5B	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F482FF854B3E007469B230A8719B5B5B	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\stellarv2\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1ACA1A975F7E49D45A0CAE970E6C6CC0\MainProgram	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1ACA1A975F7E49D45A0CAE970E6C6CC0\ProductIcon = "C:\\Windows\\Installer\\{79A1ACA1-E7F5-4D94-A5C0-EA79E0C6C60C}\\ProductIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\DefaultIcon\ = "\"C:\\PROGRA~1\\Stellar\\stellar.exe\",0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\stellar\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\stellar\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1ACA1A975F7E49D45A0CAE970E6C6CC0\PackageCode = "37FFBDD1CDB9F2D4991C340C628B71F1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F482FF854B3E007469B230A8719B5B5B\ProductName = "Stellar"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F482FF854B3E007469B230A8719B5B5B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\Stellar-2.0.0-updater-767SVX\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F482FF854B3E007469B230A8719B5B5B\Environment = "MainProgram"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\486DB768F622F2F4E83DC7E311FF51A0\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\stellar\ = "URL: protocol"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F482FF854B3E007469B230A8719B5B5B\Version = "33554432"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F482FF854B3E007469B230A8719B5B5B\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F482FF854B3E007469B230A8719B5B5B\PackageCode = "32E28A2948DEE4D43ADDA6059452435B"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F482FF854B3E007469B230A8719B5B5B\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\486DB768F622F2F4E83DC7E311FF51A0\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\486DB768F622F2F4E83DC7E311FF51A0\ProductIcon = "C:\\Windows\\Installer\\{867BD684-226F-4F2F-8ED3-7C3E11FF150A}\\ProductIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\486DB768F622F2F4E83DC7E311FF51A0\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\stellar\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\stellarv2	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\stellar	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1ACA1A975F7E49D45A0CAE970E6C6CC0\Version = "16777219"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\stellar	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F482FF854B3E007469B230A8719B5B5B\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F482FF854B3E007469B230A8719B5B5B\Clients = 3a0000000000	msiexec.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4700	msiexec.exe
4700	msiexec.exe
4700	msiexec.exe
4700	msiexec.exe
4700	msiexec.exe
4700	msiexec.exe
4700	msiexec.exe
4700	msiexec.exe
4700	msiexec.exe
4700	msiexec.exe
5960	msedgewebview2.exe
5960	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2468	msedgewebview2.exe
4768	msedgewebview2.exe
4540	msedgewebview2.exe
4540	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2160	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2160	msiexec.exe
Token: SeSecurityPrivilege	4700	msiexec.exe
Token: SeCreateTokenPrivilege	2160	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2160	msiexec.exe
Token: SeLockMemoryPrivilege	2160	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2160	msiexec.exe
Token: SeMachineAccountPrivilege	2160	msiexec.exe
Token: SeTcbPrivilege	2160	msiexec.exe
Token: SeSecurityPrivilege	2160	msiexec.exe
Token: SeTakeOwnershipPrivilege	2160	msiexec.exe
Token: SeLoadDriverPrivilege	2160	msiexec.exe
Token: SeSystemProfilePrivilege	2160	msiexec.exe
Token: SeSystemtimePrivilege	2160	msiexec.exe
Token: SeProfSingleProcessPrivilege	2160	msiexec.exe
Token: SeIncBasePriorityPrivilege	2160	msiexec.exe
Token: SeCreatePagefilePrivilege	2160	msiexec.exe
Token: SeCreatePermanentPrivilege	2160	msiexec.exe
Token: SeBackupPrivilege	2160	msiexec.exe
Token: SeRestorePrivilege	2160	msiexec.exe
Token: SeShutdownPrivilege	2160	msiexec.exe
Token: SeDebugPrivilege	2160	msiexec.exe
Token: SeAuditPrivilege	2160	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2160	msiexec.exe
Token: SeChangeNotifyPrivilege	2160	msiexec.exe
Token: SeRemoteShutdownPrivilege	2160	msiexec.exe
Token: SeUndockPrivilege	2160	msiexec.exe
Token: SeSyncAgentPrivilege	2160	msiexec.exe
Token: SeEnableDelegationPrivilege	2160	msiexec.exe
Token: SeManageVolumePrivilege	2160	msiexec.exe
Token: SeImpersonatePrivilege	2160	msiexec.exe
Token: SeCreateGlobalPrivilege	2160	msiexec.exe
Token: SeCreateTokenPrivilege	2160	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2160	msiexec.exe
Token: SeLockMemoryPrivilege	2160	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2160	msiexec.exe
Token: SeMachineAccountPrivilege	2160	msiexec.exe
Token: SeTcbPrivilege	2160	msiexec.exe
Token: SeSecurityPrivilege	2160	msiexec.exe
Token: SeTakeOwnershipPrivilege	2160	msiexec.exe
Token: SeLoadDriverPrivilege	2160	msiexec.exe
Token: SeSystemProfilePrivilege	2160	msiexec.exe
Token: SeSystemtimePrivilege	2160	msiexec.exe
Token: SeProfSingleProcessPrivilege	2160	msiexec.exe
Token: SeIncBasePriorityPrivilege	2160	msiexec.exe
Token: SeCreatePagefilePrivilege	2160	msiexec.exe
Token: SeCreatePermanentPrivilege	2160	msiexec.exe
Token: SeBackupPrivilege	2160	msiexec.exe
Token: SeRestorePrivilege	2160	msiexec.exe
Token: SeShutdownPrivilege	2160	msiexec.exe
Token: SeDebugPrivilege	2160	msiexec.exe
Token: SeAuditPrivilege	2160	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2160	msiexec.exe
Token: SeChangeNotifyPrivilege	2160	msiexec.exe
Token: SeRemoteShutdownPrivilege	2160	msiexec.exe
Token: SeUndockPrivilege	2160	msiexec.exe
Token: SeSyncAgentPrivilege	2160	msiexec.exe
Token: SeEnableDelegationPrivilege	2160	msiexec.exe
Token: SeManageVolumePrivilege	2160	msiexec.exe
Token: SeImpersonatePrivilege	2160	msiexec.exe
Token: SeCreateGlobalPrivilege	2160	msiexec.exe
Token: SeCreateTokenPrivilege	2160	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2160	msiexec.exe
Token: SeLockMemoryPrivilege	2160	msiexec.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
2160	msiexec.exe
2160	msiexec.exe
6112	stellar.exe
5672	msiexec.exe
5672	msiexec.exe
4652	stellar.exe
2384	msiexec.exe
1324	stellar.exe
2384	msiexec.exe
1324	stellar.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2160	msiexec.exe
4700	msiexec.exe
5836	MsiExec.exe
5672	msiexec.exe
2384	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 5836	4700	msiexec.exe	88
PID 4700 wrote to memory of 4496	4700	msiexec.exe	94
PID 2160 wrote to memory of 6112	2160	msiexec.exe	97
PID 6112 wrote to memory of 2468	6112	stellar.exe	98
PID 2468 wrote to memory of 936	2468	msedgewebview2.exe	99
PID 2468 wrote to memory of 5536	2468	msedgewebview2.exe	100
PID 2468 wrote to memory of 5536	2468	msedgewebview2.exe	100
PID 2468 wrote to memory of 5536	2468	msedgewebview2.exe	100
PID 2468 wrote to memory of 5536	2468	msedgewebview2.exe	100
PID 2468 wrote to memory of 5896	2468	msedgewebview2.exe	101
PID 2468 wrote to memory of 2856	2468	msedgewebview2.exe	102
PID 2468 wrote to memory of 2856	2468	msedgewebview2.exe	102
PID 2468 wrote to memory of 2856	2468	msedgewebview2.exe	102
PID 2468 wrote to memory of 3388	2468	msedgewebview2.exe	103
PID 2468 wrote to memory of 3388	2468	msedgewebview2.exe	103
PID 2468 wrote to memory of 3388	2468	msedgewebview2.exe	103
PID 2468 wrote to memory of 3388	2468	msedgewebview2.exe	103
PID 2468 wrote to memory of 3388	2468	msedgewebview2.exe	103
PID 6112 wrote to memory of 5672	6112	stellar.exe	104
PID 4700 wrote to memory of 4652	4700	msiexec.exe	106
PID 4652 wrote to memory of 4768	4652	stellar.exe	107
PID 4768 wrote to memory of 5328	4768	msedgewebview2.exe	108
PID 4768 wrote to memory of 4580	4768	msedgewebview2.exe	109
PID 4768 wrote to memory of 4580	4768	msedgewebview2.exe	109
PID 4768 wrote to memory of 4580	4768	msedgewebview2.exe	109
PID 4768 wrote to memory of 4580	4768	msedgewebview2.exe	109
PID 4768 wrote to memory of 4084	4768	msedgewebview2.exe	110
PID 4768 wrote to memory of 3480	4768	msedgewebview2.exe	111
PID 4768 wrote to memory of 3480	4768	msedgewebview2.exe	111
PID 4768 wrote to memory of 3480	4768	msedgewebview2.exe	111
PID 4768 wrote to memory of 2224	4768	msedgewebview2.exe	112
PID 4768 wrote to memory of 2224	4768	msedgewebview2.exe	112
PID 4768 wrote to memory of 2224	4768	msedgewebview2.exe	112
PID 4768 wrote to memory of 2224	4768	msedgewebview2.exe	112
PID 4768 wrote to memory of 2224	4768	msedgewebview2.exe	112
PID 4652 wrote to memory of 2384	4652	stellar.exe	113
PID 4700 wrote to memory of 1324	4700	msiexec.exe	115
PID 1324 wrote to memory of 4540	1324	stellar.exe	116
PID 4540 wrote to memory of 756	4540	msedgewebview2.exe	117
PID 4540 wrote to memory of 4288	4540	msedgewebview2.exe	118
PID 4540 wrote to memory of 4288	4540	msedgewebview2.exe	118
PID 4540 wrote to memory of 4288	4540	msedgewebview2.exe	118
PID 4540 wrote to memory of 4288	4540	msedgewebview2.exe	118
PID 4540 wrote to memory of 1768	4540	msedgewebview2.exe	119
PID 4540 wrote to memory of 2304	4540	msedgewebview2.exe	120
PID 4540 wrote to memory of 2304	4540	msedgewebview2.exe	120
PID 4540 wrote to memory of 2304	4540	msedgewebview2.exe	120
PID 4540 wrote to memory of 4276	4540	msedgewebview2.exe	121
PID 4540 wrote to memory of 4276	4540	msedgewebview2.exe	121
PID 4540 wrote to memory of 4276	4540	msedgewebview2.exe	121
PID 4540 wrote to memory of 4276	4540	msedgewebview2.exe	121
PID 4540 wrote to memory of 4276	4540	msedgewebview2.exe	121
PID 4540 wrote to memory of 1488	4540	msedgewebview2.exe	122
PID 4540 wrote to memory of 1488	4540	msedgewebview2.exe	122
PID 4540 wrote to memory of 1488	4540	msedgewebview2.exe	122
PID 4540 wrote to memory of 1488	4540	msedgewebview2.exe	122
PID 4540 wrote to memory of 1488	4540	msedgewebview2.exe	122
PID 4540 wrote to memory of 1424	4540	msedgewebview2.exe	125
PID 4540 wrote to memory of 1424	4540	msedgewebview2.exe	125
PID 4540 wrote to memory of 1424	4540	msedgewebview2.exe	125
PID 4540 wrote to memory of 1548	4540	msedgewebview2.exe	126
PID 4540 wrote to memory of 1548	4540	msedgewebview2.exe	126
PID 4540 wrote to memory of 1548	4540	msedgewebview2.exe	126
PID 4540 wrote to memory of 5960	4540	msedgewebview2.exe	127

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Stellar_1.0.3_x64_en-US.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Program Files\Stellar\stellar.exe
  "C:\Program Files\Stellar\stellar.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6112
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=stellar.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.stellar.dev\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=6112.3292.10042358551400013422 /pfhostedapp:5bfc62033e270888616f5f96d4d5a28a81010096
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:2468
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.stellar.dev\EBWebView /prefetch:4 /pfhostedapp:5bfc62033e270888616f5f96d4d5a28a81010096 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.stellar.dev\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x198,0x19c,0x1a0,0x174,0x1a8,0x7ffda3985fd8,0x7ffda3985fe4,0x7ffda3985ff0
      4⤵
      PID:936
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.stellar.dev\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1872 --field-trial-handle=1876,i,10475413224933179956,14410767210299025203,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:5bfc62033e270888616f5f96d4d5a28a81010096
      4⤵
      PID:5536
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.stellar.dev\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2168 --field-trial-handle=1876,i,10475413224933179956,14410767210299025203,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:5bfc62033e270888616f5f96d4d5a28a81010096
      4⤵
      PID:5896
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.stellar.dev\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2292 --field-trial-handle=1876,i,10475413224933179956,14410767210299025203,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:5bfc62033e270888616f5f96d4d5a28a81010096
      4⤵
      PID:2856
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.stellar.dev\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3288 --field-trial-handle=1876,i,10475413224933179956,14410767210299025203,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:5bfc62033e270888616f5f96d4d5a28a81010096 /prefetch:1
      4⤵
      PID:3388
- - C:\Windows\System32\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Stellar-2.0.0-updater-767SVX\Stellar-2.0.0-installer.msi" /passive /promptrestart AUTOLAUNCHAPP=True LAUNCHAPPARGS=""
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:5672

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 74756EE5248FB68124AAF46D787501C6 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5836
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4496
- C:\Program Files\Stellar\stellar.exe
  "C:\Program Files\Stellar\stellar.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=stellar.exe --webview-exe-version=2.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4652.3464.2270626949612187008 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4768
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView /prefetch:4 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x1c8,0x7ffda3985fd8,0x7ffda3985fe4,0x7ffda3985ff0
      4⤵
      PID:5328
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1940 --field-trial-handle=1944,i,2591735037793866194,8462741706455592771,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
      4⤵
      PID:4580
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2952 --field-trial-handle=1944,i,2591735037793866194,8462741706455592771,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
      4⤵
      PID:4084
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3652 --field-trial-handle=1944,i,2591735037793866194,8462741706455592771,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
      4⤵
      PID:3480
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3808 --field-trial-handle=1944,i,2591735037793866194,8462741706455592771,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493 /prefetch:1
      4⤵
      PID:2224
- - C:\Windows\System32\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Stellar-2.0.2-updater-JPAUaz\Stellar-2.0.2-installer.msi" /passive /promptrestart AUTOLAUNCHAPP=True LAUNCHAPPARGS=""
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2384
- C:\Program Files\Stellar\stellar.exe
  "C:\Program Files\Stellar\stellar.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1324
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=stellar.exe --webview-exe-version=2.0.2 --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1324.3492.10991372457646213165 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4540
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView /prefetch:4 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x19c,0x7ffda3985fd8,0x7ffda3985fe4,0x7ffda3985ff0
      4⤵
      PID:756
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1732 --field-trial-handle=1736,i,17301699378562041352,6343377915976891309,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
      4⤵
      PID:4288
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2464 --field-trial-handle=1736,i,17301699378562041352,6343377915976891309,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
      4⤵
      PID:1768
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2548 --field-trial-handle=1736,i,17301699378562041352,6343377915976891309,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
      4⤵
      PID:2304
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3516 --field-trial-handle=1736,i,17301699378562041352,6343377915976891309,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493 /prefetch:1
      4⤵
      PID:4276
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3864 --field-trial-handle=1736,i,17301699378562041352,6343377915976891309,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493 /prefetch:1
      4⤵
      PID:1488
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4640 --field-trial-handle=1736,i,17301699378562041352,6343377915976891309,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
      4⤵
      PID:1424
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4632 --field-trial-handle=1736,i,17301699378562041352,6343377915976891309,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
      4⤵
      PID:1548
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4728 --field-trial-handle=1736,i,17301699378562041352,6343377915976891309,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5960
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4628 --field-trial-handle=1736,i,17301699378562041352,6343377915976891309,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
      4⤵
      PID:3240
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4724 --field-trial-handle=1736,i,17301699378562041352,6343377915976891309,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
      4⤵
      PID:2764
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2024 --field-trial-handle=1736,i,17301699378562041352,6343377915976891309,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
      4⤵
      PID:5856
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4708 --field-trial-handle=1736,i,17301699378562041352,6343377915976891309,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
      4⤵
      PID:5524
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2024 --field-trial-handle=1736,i,17301699378562041352,6343377915976891309,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
      4⤵
      PID:244
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4744 --field-trial-handle=1736,i,17301699378562041352,6343377915976891309,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
      4⤵
      PID:3496
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2852 --field-trial-handle=1736,i,17301699378562041352,6343377915976891309,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
      4⤵
      PID:4164
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4632 --field-trial-handle=1736,i,17301699378562041352,6343377915976891309,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
      4⤵
      PID:2140
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4620 --field-trial-handle=1736,i,17301699378562041352,6343377915976891309,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
      4⤵
      PID:1260
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1040 --field-trial-handle=1736,i,17301699378562041352,6343377915976891309,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
      4⤵
      PID:5684

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3012

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59ff27.rbs

Path C:\Config.Msi\e59ff27.rbs
Size 10KB
SHA256 a09ef5e20c36152d8359eb0e0129f2fbd0c6ae4fc51fa6b10a802b1bdb938b59
MD5 ab19dc74e98b4204397be136f15e493e
SHA1 aae7f7cd37699929e97a672cf780ef7a304daa93
SHA512 5ff0c224202b7c10f3f06595210836f13f555d8984500a726d5e5c37aea9be52d2ceb4858d80de9a03d9b8d535281f8f2d5a17706ba6adc5acb402606a213805
SSDEEP 192:ZDBf6o6/6f63K6ecs4VQynU84JCiX8+o1GeT8+o1peLJW6no9W/iUKlRpK:ZDF6o6/6f6665shH8+oTT8+oeJE5+
TLSH
T1A1225301771292D2EA972B39D71727563BB2DADDC389139B058C63205E933898FE81DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59ff2e.rbs

Path C:\Config.Msi\e59ff2e.rbs
Size 11KB
SHA256 e4d230734192a72c21f78b1b8b68c768164695abce6ad5d3180f1e16cef6af37
MD5 b638241c1c07cee3785242a2092857c3
SHA1 94946572ffe6ec4dedd560e6995ff4e6dac9e0dd
SHA512 22301d64d017707f4ec5fe0929bdbafaadf53a7abe4c8fc66da69c634bb46730d9898893d99d81e7f3fa1ff53e1d98d562d37838f1a55bc62907819cacd0fa7d
SSDEEP 192:YDBrRDGYFcARIGYF5fmFHsS8aNFUMQQ817w78BW+bir51Fy2huO8nLoJgoCtDjM:YDVRDGYeARIGYfuMSLAoE8u4hJgPtDjM
TLSH
T1933213426701C3D3DEA75F39DA2327623BB3CADDC38A4397118C26605E823855EE959F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59ff30.rbs

Path C:\Config.Msi\e59ff30.rbs
Size 10KB
SHA256 3ecc8c02bd7e34d2d21b49221ff52a33bf69dcd7f8c004f96bc9d3ccb79befc5
MD5 b605063c81d7d17c166a1af9d84676cb
SHA1 20f74e2f92cfb180af8d36ee49be5868d4d7bf82
SHA512 a0a1bb4fdde69d01f4d95bef9ce636929e48aec7d4a7e11f63afecc295e1f0ff9c6ca7ea00b2ac7b870d34c65b767937f320ec3b1ee67f0cea4bada48c45cdc1
SSDEEP 192:YJ89x3ee43gph/FQOsJCnXNGhG7NGhI+Xv4n1Wyip8E8po:YJ89xujCNGENGuApvD
TLSH
T1C9323141620491D3F85A2739D6272B6037ABC7DD5329435B48ECA0391E2738E6EAD7CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59ff3a.rbs

Path C:\Config.Msi\e59ff3a.rbs
Size 11KB
SHA256 b02cd52e140982238b1896559ed35c7cfb4a4caae924769b9d61cc4cdab82ff4
MD5 aea748cc24b2d0c8695684a14f4d2349
SHA1 f7a1684e0ffbd9a73e6e9d74379e921403804b1f
SHA512 9020c78a607a1e27fb1119b97c578700837e52c28e52f7b05603188db6af0b5a0dc891e2e3005e6f232c305ec280cacda5b9fda6d737f52a0ee2833f7ef4107f
SSDEEP 192:e4RZi9aRfi9F4gMA7RF6QqSwMnx0tjq1ii/SOO7L/oEtDjv:e4RZigRfijHp2LZtDjv
TLSH
T159423342620492D3E96E2739DA27277137A7C3DC932A835740AC61341E437CA6EAD79F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59ff3c.rbs

Path C:\Config.Msi\e59ff3c.rbs
Size 10KB
SHA256 9264a84411d3870d2d84df4c3255caab348f92b37581a8dc63c9adb9bc94a083
MD5 8c215e1056d96b6d33cb45541f871020
SHA1 6a71e744cde351f7dc9b07949ebdaa6f844f698a
SHA512 c552abc6f11f4d6927f51532997dee54b960f491b9c8236f23abef5af28d86d519627777ad4e152752674825d09963bc57c5faff11ecdc9337d4984b5e85355f
SSDEEP 192:erbIxF36eS3gXf/FQOsJC6RAGrGJAGr+oVl2lZWkiED8eEqpk:erbIxFKVnAGsAGWAED8Vp
TLSH
T1C9322F436B04C3D2E8932778C70B2F117BE3C7D68225533B189E61755F1BB992EA52CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall Stellar.lnk

Path C:\Program Files\Stellar\Uninstall Stellar.lnk
Size 954B
SHA256 6ea689dfbe425ab9faa9123e8c12f54158f5a05303bd1c29480e8eb5c7b63090
MD5 bd9aa0dee0c44e1174e7f5b9ee216004
SHA1 87df0ec150c475472d49535697f0c922eb9b5f9d
SHA512 561379bacf0cfebd1d4c4aca6bca35b969ddf558b9f215062ad8bb657f445fd0894a2cd723f37002949cbb28cd24eb3c6ab4f0ed7413b88f500170799dfae989
TLSH
T17811B1050AE30B61D2B64A7D08ABDB018370FD5AAAA34F5F034576DB8D21481BC69E7D
MD5 SHA1 SHA512 TLSH

Submit Download

Uninstall Stellar.lnk

Path C:\Program Files\Stellar\Uninstall Stellar.lnk
Size 954B
SHA256 11a797d6adba4a24b7507592d5068d80597c2f0fc21912d28e8be6e098e61eb0
MD5 5041bcba8974d015ac9c5f3ab80ba323
SHA1 ec3c6ac84b01886e35886d8261bb7ce3b026aed0
SHA512 ae842547a1d3bbe5bc2dcec863211874393d176c7a4254b66e8c1c9c8d630f68839bf73ba0e03aa5544b0a56377a826ec6e84c2bb7a8718f349c27afad14b929
TLSH
T11711F1450AF30A62D2B28E3D48FF8B1087B5BC469A534F6F034566DB8922041BC69E7D
MD5 SHA1 SHA512 TLSH

Submit Download

stellar.exe

Path C:\Program Files\Stellar\stellar.exe
Size 25.9MB
SHA256 d9ea9d2ea4f0dbe9402b8e052f6ea9217c4644d91ea636f7ea53c24be79db260
MD5 206e583980ed4ea436f1fde5c990f469
SHA1 39c0c5dde537fd7ef0cfb457685a2bc1ccee520a
SHA512 ccaeedc6e1d2666968b5c9a0d4abe8f6dc5456c3c04bcd64c896e823e758c1b1342150cf0ab38b3ac3ed649cfefbeaa847af12e796dfae394435f078e35b3026
SSDEEP 393216:26Hvz3IvMkVH00ovAAkEBl0XBXtBumsRh20:26Hv7rIHduAAkslkdIx
TLSH
T11B574A207B5A996DD09AC470834B4A721E3134DB0B35BAFF4494A2792F7DBF42F38259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stellar.exe

Path C:\Program Files\Stellar\stellar.exe
Size 29.1MB
SHA256 5ec26a6ce4d2d7828bc1c27351f4ddf429c39f13a9f53f0439b5dca2b9908763
MD5 9cf6699018760dab0832830c2c67b53b
SHA1 92d6da9ea9037a3c7b803364ea0d96f50b7cd7f9
SHA512 d3b23a2b298d79943c0add48855fa1fdc89676ba1fec83a2f8257bea118ba8b7a3a3352f0be8a38f101fd2e3680a044548184127e9dc45fdf060a75b23acbc92
SSDEEP 786432:8pr2wS7TyKDIJpSlzsvhLQUv9Nm1XVwC:Hr6pqzqhLQUVkXVw
TLSH
T1A3679D117A5B99ACD59AC8B083474A730E2174DB0A36B9BF41C466383F7DBF46F28319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stellar.exe

Path C:\Program Files\Stellar\stellar.exe
Size 29.2MB
SHA256 c8cee6e49e26452d2de3269e1d1401640a1d4089d3069aedc8c414edacc42ded
MD5 158522ca12342d39901cd501c7c1d72e
SHA1 f3246399ea08e368298c324fc2e458189dd441dc
SHA512 1f2d2db579867c08af22c9ca26f8229402cd31a8248185f421a68a35a5710dd8fdffd0fe2c787cbad87c8c5ed06db42e2d805cfc7543e7dd48c161797cbbc76d
SSDEEP 393216:2dMSf5kb6bzB+nyVkeIs8fHyUBKUv9TRmrxYlGQ2vNuX1u7xkW+:FSf5kbgBeyVkzs8xQUv9Nm1YlGPNoT
TLSH
T11F679D117A5B99ACD19AC8B083464A734E2178DB0A36B9BF45C462383F7DBF45F38319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Stellar.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Stellar\Stellar.lnk
Size 1KB
SHA256 79798ba259e9603b1cad2012c5df1f3de4bc1d29d8053134fd9de82a95971b9a
MD5 ac9324f019ac094876ae0c8b3c2d78bc
SHA1 374861a9ddfc7bf9c9b4eb4fdbfa63f1a99dcdd4
SHA512 c11c344222a02117b8d4ab57bfd26409fbbdfc0ccb0b644601f13247f551a5481cdf437324114fde7a6bd393084da99426265c333664060060060dfa41ec77b0
TLSH
T15741B11457E11626F2728B397CF28B718B26BC11B5654F3F428A41CA0975044B56DF2A
MD5 SHA1 SHA512 TLSH

Submit Download

Stellar.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Stellar\Stellar.lnk
Size 1KB
SHA256 5232acee4939bf0082d4b0785a996ee7c9eaefd22bf03e47344ef1d4e6959d31
MD5 5cd0e57c80f83dfb160ad2501220a25d
SHA1 a3c095ed7464c4abca21572e94d8fad826d87dce
SHA512 02825abb394e6e0e3309213e2ed64b1dd96dea2598f9aac32e2455a22baf0f54b255fd3d2f82986fd60925d712c4959f96f501813645ddfa8d5f1b072a4db3cc
TLSH
T14141BB0057F11719F2B3DA7A7D728A618B21BC16B1658F2F43C981CA0835052B66EF6B
MD5 SHA1 SHA512 TLSH

Submit Download

Stellar.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Stellar\Stellar.lnk
Size 1KB
SHA256 730d2561d09bbfdcc76a80334956257e0a323d7c68443e434f378cfbfa796806
MD5 9155c3e564e38ac57e891f54f2ba45ad
SHA1 598b25d99a63091185b82306df204051b50c56b5
SHA512 324eb8aed20e133e79e559de5f47283807678385ebb55515a1fc34d5199759cd4e1a89d4dafeb3df615c77f2c96c3b7c05e8a7967c3b5d1a9f926c3e3189223f
TLSH
T1F841681057E60B6AF37246797EB29B928B31FC26B5668B2F024941C60D74044A6B9F3F
MD5 SHA1 SHA512 TLSH

Submit Download

Stellar.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Stellar\Stellar.lnk
Size 1KB
SHA256 73e5d4dfbdfb275c77d466c97884edd949315f17881d1fc2afa459263e35d22a
MD5 0e8f5e5ad7d656e33b2a97c12e468c4d
SHA1 1d52a4556d0c23d12b07308bb8a08bcf3b73a85a
SHA512 0bbcd676ea52c985278147996a1298e577148724c3de96fe7e09bf848a6bdc2d83b7e9eb75cfdee64b04216f9b4ea3530417d22c560ce9f42f384b3a9c9a49f1
TLSH
T1C9419D1417F10676F3728B3ABCF38B718B36BC01A2655F3B428A41CA0975144B969F3B
MD5 SHA1 SHA512 TLSH

Submit Download

Stellar.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Stellar\Stellar.lnk
Size 1KB
SHA256 4e857916eb18375be1cf262cd81e9a8014e323875740e5f6526dc2f5df689c10
MD5 b6eae8f16bc56b1945377358dce72ffc
SHA1 ad9a3ee4373a6137f8a8a7d42ab0313f12d33f9d
SHA512 3e2c2e5bce40dd5915b94a7c6b81dfed96b19ff9ffb56a39fea4b966454058a5b8e23e167dd783dcb94cefea2660379c29d2fc6369b8d9fa89a325c6a431506a
TLSH
T1F241CA0457F11619F2B3DA7ABDB28A618B31BC05B2658F2F43C941CA0835062B65AF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Stellar.lnk~RFe5a09e4.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Stellar\Stellar.lnk~RFe5a09e4.TMP
Size 1KB
SHA256 716f1bb67660feefcb3241133bd9bfa41b645aab39ced0e4e123e879065c800e
MD5 e6741f4216e20201644d494b686000e9
SHA1 a29d3f1101be82fbfa0fa5312e0c5aa2b3433e66
SHA512 1fe7901a7910ebe4f06e78a0bf5c294a1c09e7984298eeff9f5b3a5a6dd973b8928d4e927389ca44573e39d26713966d1490d3870717cea2be49d32149e8e46e
TLSH
T16E416A1017E20B26E372477D7EA39B929B31FC26A5668F2B024941C60974044A5A9F3F
MD5 SHA1 SHA512 TLSH

Submit Download

MSI9F34.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI9F34.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Stellar-2.0.0-installer.msi

Path C:\Users\Admin\AppData\Local\Temp\Stellar-2.0.0-updater-767SVX\Stellar-2.0.0-installer.msi
Size 19.5MB
SHA256 d6203368a156ad9d3139e839f24d3dd85543c23767a18c0d04ab9e3b9871cd6e
MD5 fd252dc2cb8e96ecb53768a2bef52d7e
SHA1 358cc67590c80dcd6693919a9ab2b60290d1e9e7
SHA512 61534e57ac3ba08b053dc7036bd92cbd3c66eb84bc52ab9e9301f0bc80830185483c20757644e3b2585d6816671d60f79a702bfc2e8807d2243b4727ffdf0f13
SSDEEP 393216:UPtp2YeM7wMbng+ah2Lfjbczy3vi7/e9O1KjvYSyKtn/w4lzi8OFSF:U1p2YeMtnDah2LfXczOi7VYjvYTK5Y2/
TLSH
T1D627330B7D46C626C0563EF8C8BAE7F9441AAC54E8122C1322687F59F8F09D3DEE15D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Stellar-2.0.2-installer.msi

Path C:\Users\Admin\AppData\Local\Temp\Stellar-2.0.2-updater-JPAUaz\Stellar-2.0.2-installer.msi
Size 19.6MB
SHA256 beebb96c7bb8affdb24cc00dddb2876535fcf2ec07672ba651ca8c80f9596f76
MD5 464a39219e369f032a4ae8e066328d33
SHA1 11af4787e20551c39a265078443016a41dc9949f
SHA512 6ce957eef3967f32cfa639938cabc15648353af958ee672a04a6d4a993172a683cf1bcf90a4c30645911ad412650453d8f43a5e28e670c96083882e3edbbb06a
SSDEEP 393216:ga9ecV18vZs8u7TkNSd94a3JRtso61vZ0hVN6OO2qfmYMXiuI7ERDfl6:ga4zbGTkwd94A6R1vZaVEOjymYMxIwBg
TLSH
T17827331B7D46CA16C42A3FB4C87BE3F54519AC60E9422C0362687E5DF8F05D3DD628EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.stellar.dev\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e2b18faf9ad2cd162baac185b3398516ea1b2dc1b4c8d66ed36d2176023a5c0b
MD5 0360f15e3132d7e9d55466be0e851bbb
SHA1 1e686453507dcf7c0c87dc270968b38ae976b9a9
SHA512 294780d649035dde99c2468979b0043899d9212dcfc7fed2a9d489852a546d7c789644f87385c08ef776408607d2424b126b181d1a1340d32e260e1b4a248e84
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.stellar.dev\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1fabc0e633926904bf38d47880cb10df8da708a1dcb0a9a9605c92980edfca6f
MD5 18fdb9d667568e6953f3118948787289
SHA1 ab3ee53827d91d8e49c1343273c7d1225a59277f
SHA512 a3e4b5aa3071513fc4c7ffe0761418782a8d3e2179cda617b88e29237cfa63473f697792171547d4342e2f77f309e9db697298a7a4638f24bb6f4c9b6858ee14
TLSH
T1BBD0121337020174C5103433100266481404D50B400A5C055C288E6D1A490A00A03451
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.stellar.dev\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.stellar.dev\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 105cfb0e932c0f154ebaa6c4dd41a020557dff09052bc998e42de53038e2b01d
MD5 461cd13bcba9874be666f2cdac28cdb1
SHA1 350f1444727dcb6d825798da22aacdca6afc9838
SHA512 8f5992f4d12615e392199233afb77788fae4cdd7dee2ab3c1e650da50da11769e26131fa5feb00450a4621b1d9bf825c3e866dd768ae3863958d8d4ee7cd7bd7
TLSH
T17AA0029555810465C744DBF250D597503230BDB1DD76160295D12078C9922B49505559
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a475b.TMP

Path C:\Users\Admin\AppData\Local\com.stellar.dev\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a475b.TMP
Size 48B
SHA256 a060b950bc7906fc177c8477c0eccec964203968887d8a32abb41122f40a232e
MD5 bcb845f6633aedd2c3a5ed08732b7fa3
SHA1 b372604fe00ad84d0692568e5b8aa32d1c5d0b00
SHA512 4e511f3feda79937417256c7ce79cd678f9081a701440b00a1614d93fb6e7747b03873d0a68a348489ba8f173ccce6112d637cf488ba2ac7614413776fa1602c
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.stellar.dev\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.stellar.dev\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.stellar.dev\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.stellar.dev\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.stellar.dev\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.stellar.dev\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.stellar.dev\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.stellar.dev\EBWebView\Local State
Size 15KB
SHA256 cb938bb15c9e436417a402a26dfb3f86685800d532e2f004dfb2a9aeda67bc48
MD5 50ad57e29d085892aa80f6e398f6d301
SHA1 fddf48cd9117ae21736e8434111bdd1473f1c950
SHA512 d973e01c4396c3e32c73d0fdbb2a2dd46c15815b127e8b21b3a4d11794459bed10b33c217858ac7eff1d4876067ff1a5ed1898f3c44391b47e862750a48e6bfd
SSDEEP 384:Csrv+89zHqlDNP9oidr3NBS9/qKzbf34YCND:Nrv+4UNbdrs/p3f34pND
TLSH
T14C729E33E57C96379DB38949B446AE0B7FB860A762C20FA0DA995B4D418B4E92307D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.stellar.dev\EBWebView\Local State
Size 2KB
SHA256 8e35be70d38db2f0ffe36e4ce8303b77eb407a367723eb27e3c719a1f094c157
MD5 89d0f98b1540dd254c47f845cd079d35
SHA1 d7c741aaabdfb89defa2c27704904ababbe43504
SHA512 3839bba49bfff3c18ebd529d0790669616e093610cd74b9ecdf8b34162beb8725651f7b9d2fa74c8c4ab552a1de72e14c2a3761084660facb5812c0df814f818
TLSH
T14351A833AA24563AC9E286897D46BF53DF7560766B921F505EDC4B0C01C761C1313C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.stellar.dev\EBWebView\Local State
Size 3KB
SHA256 73f896576fc5e23fb6a8b3f46c64f43290550fe7bff9c50a0affe74d888e14c1
MD5 185398992c46ca4306c7730a51750ac7
SHA1 5d7f229cd16f3a01a1f7ae074db05438a5a0c354
SHA512 ac58356e2d91b4e49182577b75312d9aee4f8092b079dbfe6ed289d49266ce2a8bb5979b7227e69b7d7c686d3628fd06ffdbd268d1298142f23ccf05cb04b209
TLSH
T14E71967BAA74953B8DE2DA497C866F56A7A15037A6C52F94DAEC0F0C01C735C1313C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5a3385.TMP

Path C:\Users\Admin\AppData\Local\com.stellar.dev\EBWebView\Local State~RFe5a3385.TMP
Size 1KB
SHA256 76bfb501df8127366fcb58e061c8b903107fe77602e744981ef5e0dcd7d2d643
MD5 7e4942674770baec575d81d3b5fdd3fa
SHA1 0b408d02c04096fe0df01e8d79ab22ca30f1adde
SHA512 5be0c6ca82c530af4abca8efb1fdea537ee27608f5812ad1aba5bd0d07a8d2cb99a2254df1260d0dac34995adb0cc57c60f26f31b3761eaff53964f8961dbbdf
TLSH
T1363196B7D5600635DC96A68A3982EED79F72147B53814F0429CDCB0D02C760D993B832
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 54f8597a46b034bf4f10a68248996e46b8b5335fdb8394e01678fe684c937c2a
MD5 f0a10cfeae27167fcc6aa37b7b863b00
SHA1 37fdaebdff06bb68eda621a457d24fbdf9e1b46b
SHA512 62f3e0231b24044c6d93911b98e9f514b3094e7ebb1b613c6a405d1c190eac615a7cf96a32b5965e60dd81a7c995a7884653d8b4293979e6a8a78ed41bf9d9d4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 430d6497bcb8702feade1e121f070fb5041a10d4a97b3f53de8bfb39d6c0891c
MD5 713a22b0ce4f28b067a3b4adde6949f1
SHA1 39144882fa960854fa4acf8671ca5f8d5a4c1f80
SHA512 5487ed9303f8c8537c658e68113c9014b4247e0c079b8f67ad05259bc85059cd162f388b566677ceb99becfbce5684b1fa72b46eff2e7d44c658f33070668555
TLSH
T1CED0241733011534C41033334113731D1540CD0F50454451F43DCF5D1F55CD07D47441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 bf5e224dc4074dbf4dce789dd4a0644ef5d857356bab76e5846a26746aa16316
MD5 170e2f02f91e076bad6d5f5212bce881
SHA1 8638d6282dd4aee2e20adbe97e80dc3d365a8e2c
SHA512 993d1e7363b9f9c070a27fa39a809ef4d55f08321d755d90f224259fea8ad353d1c95bb9ffa83f46171ae89bc13eec99239e1437aaab3e670e99df4a2e12e472
TLSH
T1FCD0121737012134C41023334112621D1640C80B51454551A439CA6D1E56890A986441
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 51194fad3a4a189650568de728ebc655243934cdfe0a7750e311a5093fd746bc
MD5 bf42cb071b2dbbc61f1eacc1342263c7
SHA1 522afe7da6017c0d89889f222111ffe03929caa3
SHA512 1b4c05eeff6d9a0703e38d51b77578342999a2c4464acd94319b5d4bbadf3e6b6fc79b1ec5cceccb90d0d49579699a50d48fec127e82fbcc4f35c06cc6cad49c
SSDEEP 3:MsFl9tlGall0sBftv/1+fl93qLnNtfUyNnl8MMx+9KyvUkMt0:/F3XGufvMNALnXpv8koyvUkMt0
TLSH
T1631392AF75E10E1FDB6204F810435BB872B3E843EE52135320757B22254DBB1080B11F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 a0dea554f6561732230f3a1b567d6ca542df0a819ec65ec302aa4f2177d8d86d
MD5 621880b83c903e5b9f09f93972650641
SHA1 962f82780bc3a52407af0be459d5b58b78c6280a
SHA512 5cc8c921641358f6ab19ebc695c687588dda198a773a07569589719b762db8467a7c183de40a3c0f2d1c7a0ef66a206c5738161dba0a1d042e3ee05cb77ce49f
SSDEEP 24:GwLXsZSWOb1f8AnVI9on//9ugMY76UpBvU+NZ1DdbfTJ:ON67i9OFugMehf1FJ
TLSH
T1BA44448F2F02E744D35498BD64F9483FE62B00A961E5FB5AB974CCA88976358296024C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 7b83a86554045e1febd79a14d5c9106c0f646d9a5fa61b47aa0c552586c02c4c
MD5 54b7c67f6c1c590e3a20a7c15bcd3c48
SHA1 af7e876c1b7a48ed94ef846543cb85ed44e40739
SHA512 7f3474c061ceee78322a079bf619445a43dab3d018c717dc11c71338d63b492ffdfd63366518f25de57064fe472f6e35e43ecb95b909c0ff1bf6ae986bfc6744
SSDEEP 384:YAA456Qu+JEYjQQu+JEYbIx3LztI3cNnT:Y/Lg4gbSNnT
TLSH
T176164DD74F38E612EF63EEB0BAC4FE2D7D707691F9D19883901640A915D07D12B8A09E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Cache\Cache_Data\f_000001
Size 75KB
SHA256 a79fdb52d4a5c76552452f69202add96e287401fff03d3e8c0e38b4dcb5a99cd
MD5 ad33cbc6d23292050f1f2010848ab619
SHA1 11f6ab2d0f982a89303f6b41beb2563344d3171d
SHA512 e0cf51f1e892fd91d953a04d7c60dc89c6d26142ea4cbd79e3f60a5d5ecba2ffb34f3136899d0895db0956b644fd8263c46512a1daabf2cfb4e18f2125f9d53d
SSDEEP 1536:zLFyoO/zcGVSYM304bHgRoa8amVWxSeaWtxPaEJyKYBQpC6:0jrnSYM304bASJ/VWoqtYrKJI6
TLSH
T1C9730237028D79E0F7E9883672992C7BAD849473F95794E3184B4E4034067BA39BF947
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Cache\Cache_Data\f_000002
Size 162KB
SHA256 cd0274f9da3868d950a8f2f4ad5cfb6175796b1c62b32dc7e9c1d02e06fe8092
MD5 eb51f072230aef7e85cfb5bda2a4b734
SHA1 8e3661cded83bfd6c3e2873fad2cb05e82d8bc8f
SHA512 d1d9b6ac33eb2ede86e64b79a1349a03bafd6371a032d54fd5e1319776b0dca7523e6ec8cf7d91281cce28ece6ac99aa5e73f4207053db057f7293e5e7eacc9b
SSDEEP 3072:yfNCeLI/QaRd8bL+Y+M8y2G50lcY87PBQQiyWBIv0TbbqUx6v6ys:yfceLda0x7EG5JZcbBJ/ISR
TLSH
T101F3121D45604FA7D904A37A0E0BD3DD529808FC9ACC93458A8F5FE40E6AC764F72EAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Cache\Cache_Data\f_000003
Size 683KB
SHA256 83ae56bee1833fd3190fa5d49098759520dcbca48fb9b358c88c6d1ef4f14acc
MD5 a4e733292c70b0bc1071417a1a6d629e
SHA1 fbdcc285657affd7aa56117041bb597271830f1f
SHA512 f45be5bfd54dc86500eb70e9d293b7d23182b073d4c7061ce523270649eac472e42d14fa03bc7198910d35f837b0c9956188aab6bf5548bd657516a0b940db5b
SSDEEP 12288:G4w22UCsoeIx8ocXJJrLMglZnSgI5eSXt7gN2TrFuJWZf08YUv56:nw2bseItcXrLMgMUSXVS2gMzJ56
TLSH
T133E433362614C4BC7298F4B522FFA15969BC64B01F3764F3E669A08C5F4B411DB28CF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Cache\Cache_Data\f_000004
Size 314KB
SHA256 ed79a04c5ea00f1063ef7ec7e9858f38811e437229fa92608096a47a409b841b
MD5 e57b46111243862f892bbcf5d9f73f7c
SHA1 d56bcfd994589f147a9080819edda29ef7712b5f
SHA512 4cf6cfc8e8f0183211d1ae433fba984e9a8588a5a79bb258cf921c36b0e8c3fc8f0269488a0d0b0cbbbbf88f3eaececbdacc65434d58559cfbcdbfcb880e685b
SSDEEP 6144:n1tt3Sm+SdnNJ7tgIZBcgxTb/oDAxiUSiEjNEvllktpYz6noKUNbb3Cb86f7:n1td3+S5N7RugxTb/oE8jSqy6op3cp
TLSH
T1866423D7278073B22756042ECF2A8AEED19B328C52D1B0CA150B6DC25E4DFED9D918DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Cache\Cache_Data\f_000005
Size 538KB
SHA256 53c7b1d6f3e52f2c3f4d604908a899957f57dd59e5121fa8c2d2ee9dffa6a4b6
MD5 d3d0031e1e2ad5e53c42bcf7726e9221
SHA1 c9e584bb103ee069d052886cecec7093f1a14103
SHA512 596be7296772c99bf8b8865af68f176ad98411b3d52cf288174569cb073424de711e66988f90e17af1c7eab5ed3cecd62db2c48a8b216148ef9d5217d724cc8a
SSDEEP 12288:89FC5NQXK/quPoj40JMHDapZL+02ki2avKfWQFZdFN9G:8DeG6/p+XZ+0Y2agjZhU
TLSH
T1F4C423DAC3E7A078C996FDAC9AE50C410EF3735407A08B26E16BD062E9458345FE4F98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Cache\Cache_Data\f_000006
Size 536KB
SHA256 b04ba884bb48a983d859d5d929e18dff53afa6c72fd9b52e030a03259785372d
MD5 d5c6c81a4150ce4370bae41c9f384195
SHA1 38ae62399f57656fc1df27bf21e0bc12097d39a7
SHA512 b4e9703c2d850ed39670285e1e3bb8e5a7d4b584c48e09649c63f29c09dfc0a41f341a8dfda062b21efa7c5699863861c40fb6b22a4e1025ea71323d39b2afbd
SSDEEP 12288:hjTkoox6rQvKpP/uxwTlPDCh+VE25Pc37sC:hnNoEQCBEwTlL6+Vt5Pc3z
TLSH
T1CAC423C0E5C56BFA08659B25B9CF0F841FA8C6F07781FD7A953F8067F84469A185348B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Cache\Cache_Data\f_000007
Size 57KB
SHA256 6a239b6cd82b9e19dbf907fbaf2b15dd1126197f9522bc42c28c9d91948ba773
MD5 b6e1d1b3c30aa36ada12ad943e5c5d2d
SHA1 a05621d2989da0f71a425576f67a954444ee5a08
SHA512 b7271d0f047daadb0fb716144a1f64d7101045320f679f452eb7a629f37f2d8c1a5ccc06ef3f387141ba6c3127798a4f647aa4471cc53eec48b5d021f4a6f39d
SSDEEP 1536:C1gsrC/vm9b4pC8heE4wmG5nhGvER9CWSYMD:UgsrmmNuC8h0G5hVR8WjMD
TLSH
T17E438C035D16AE83A53583ECBF039CAC9BA4371CFA9235DA1A63DED33C20115AC9D579
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 25204eaa47f975385816a306ab95467d912aaa74d953906eb489f738c30816b6
MD5 10bfd9e558100683a491f5b7280b941f
SHA1 43fd037a535e36130e49e4d1575a3d926c37b3d4
SHA512 befd833ea3b5269d35adbad3aa19239785d3458198b0d77496ef9a6f6573b8d1e7112e59676fef4b7fe891a5fe38f3c1541778760ae4becd2cb102e17c0ceefd
SSDEEP 3:LsFlklNllkll/loyeh/lfltnPlXl2Ntl8E/:Lsk3lEtoyeh//8NME
TLSH
T16044026A23C30C0EDF8006FD444297F62339D000CE4FD363039D121908977D24F9A085
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0be5bbeccb87ef32_0

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Code Cache\js\0be5bbeccb87ef32_0
Size 256B
SHA256 c69b259100b315ffa22b6e91d66cdc0fdf8d29e0a7283d757bc726245f2dce36
MD5 961414995ff59a367260ea3d5fdfa797
SHA1 4b5d10f3fdf30aa69f107d5d08498dc65b8d6599
SHA512 b09355e374078259bbf2ed76e8e8f730ebd21b1115b6640e613d01414cbeea54ab3e23d550931763f369f003f4c02efa0f41c0b2c78bce5a5e35e2691d8c6402
TLSH
T171D0979F05222D08C380F9F8CFFA881F833317E6042A86180024E8B314C0F1C3538B28
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 d3a93bffcd4a99fb3f044df52038e200a61736c722f8e51ff1aed3d957d0cb3c
MD5 0ca01a360a5f91dec97d68da7591d6d5
SHA1 de7c1bbb0d29d29a12ffde0b36981b59a4a8c465
SHA512 d300a14274b20092bd38757cf8a7d576f8969500b5a96d8e475761256cd85ef7042852515f43e6c51b81bea81f8dd0ea5ee3dc1c89b278398abe7432ef65af3f
TLSH
T162A0022657512241C3041FF011890BA273254C35D3166717A1F154B4C9922504142918
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 55e3031d022f25c4d7b69eeed38dfca728691912bc9ee1421ff0b47044c739aa
MD5 4a4d887b0cad1cd6e992f94fe232dd0e
SHA1 5190b8adbd4e22b965db77b1e67405965087d858
SHA512 d23025e13cdd833e1f6df8985290f217a8cb582d1d95fbe88d5a30d104b029a0727a84e96de8e53d207ec2194b5130a2884a05f6d459123859128cf237fab41b
TLSH
T14FB0017591A02656C6189BF462CE66A032710C29E31B6E06A2F145B4DAA13A46AA6C58
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a80da.TMP

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a80da.TMP
Size 48B
SHA256 780066108852eb6ddc72f7c6d1bfb91abb1241b40c5d92b6603f97465d21e7f7
MD5 03d829d3d6ccc552de1deb88e8d425cb
SHA1 45fab2d88ae11f481922e81601a1ea2e15296dd6
SHA512 6114a063d34e6886ac4c6f80e954a3c66c319b76fc438498ed6f159656d3ca4f664402b53989fc822e14cf23d608c0cf3620bc4055bab7466d54c42575329f4e
MD5 SHA1 SHA512

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Favicons
Size 20KB
SHA256 2db221a44885c046a4b116717721b688f9a026c4cae3a17cf61ba9bef3ad97f4
MD5 b40e1be3d7543b6678720c3aeaf3dec3
SHA1 7758593d371b07423ba7cb84f99ebe3416624f56
SHA512 fb0664c1c83043f7c41fd0f1cc0714d81ecd71a07041233fb16fefeb25a3e182a77ac8af9910eff81716b1cceee8a7ee84158a564143b0e0d99e00923106cc16
SSDEEP 24:LLiXxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:iBmw6fU1zBmI
TLSH
T1AA92EE075E383407DBA10E7D266B187A8E3FE26C5FA29C94347410618CF9482D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\History
Size 164KB
SHA256 0f601bd466e91318400ab2c2017334ee9b0ff2a3b4d359f391492c86675aea74
MD5 9f18c68e15d36cd4d23b7ea86f8f7b46
SHA1 4dc63bdd4c9851a381fef329372a9c7a6f5c7f40
SHA512 1b4a7aa7b479d7438463d46dee45436574fffdfd0717c65901ede10afcbb509cb65886dfb8123f82c3705bd2ca390e66553853d62696dcdd3ee5bb3d18b8b78f
SSDEEP 96:8BwcTD5LqL/uejzH+bF+UIYysX0fxQp97yEHt/DfLVVVN6zRk/E0dSV:8B/D5qL/tH+bF+UI3iWGVyWNVVV63vV
TLSH
T133F3FB5E5F243312CDBD923A68E749B3587DF03F872366C56C6104B1CEE2656A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Network\Cookies
Size 20KB
SHA256 0628922305d2478ba75a48efadf932d439616eaf1ff908be334793f7bde28107
MD5 91dbaf73c1a8c55254d90272f998e412
SHA1 2b86b31c8c00c937291e5ac3b1d134a5df959acf
SHA512 109f4f59616cc1d1682b4d9468804f7668c77ce1878afec06a57037193f31a9c1c39f5d269277462936373b129d26488cddcc34d455c27185534e7754baaa988
SSDEEP 24:TLWr6bXYFpFNYJqH1kwIY6UwpQ9YH8rwZ6HfB:T+6LopFS+awWUOh8B
TLSH
T126926B4E5F346221C0F48B36EDE1855B2F7C201CD3B32655DA5860F3DE9299BF10956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 8ced4b4e8a572791a30f1ebf63a4619ddfa418e82f7ccd07ecf5e3ab8e567702
MD5 bbc0357ce121d40f3a7264bca33a8878
SHA1 4a2225f951088f10e1e4b2b23895e7aa13fbbd1e
SHA512 da2c624da1bdeccf23d5a7e26f9d825f540a9a42b40eef4c9468268ae15f957737943798434580981acdb33a79636e09c49119665b74676d42c9d9ada3a61858
TLSH
T14E1180A2C3E4C67D8A5166E477343817CD2D0919A2283D2BCDEAEBDA57E1471E11050F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 4d54c8c47da1c200ba9ba1eea86ddea61b5d4678f1945f4c8fb51032020f0a5c
MD5 52d3140a9cac1b0970852bd33f3bf254
SHA1 c9b4a883ca556709758ecba86989687334d2cd61
SHA512 5a7f75042f4acabe5cdccad8ef52fc1213a84cbec8af00967f5541501c4b331a025a540604b9536d9bc5e00e98a7bf40979e53bbf70c296edbcb1295d32283f3
TLSH
T13C41B4A3C3E4C67D89516AE87734381BCC2D0919A2283D27CEDAEBDA6BD1471D22550F
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 cc074544cbfbad0b19b5756d6bb6a391d15863360feb8f90e4692f70efa0413b
MD5 adea12b1588c5abd5a6d44b91e37c6eb
SHA1 1121f637179b91019c293e9c0f16f2095fa83fb0
SHA512 35d9b3519f67a1d4c18c902e1800afdf511414def1c70a3c296d1827588932a5fed42b20f00f9d08a1a6a3c965b86d54f4dfcb369d8db7f646e36638b12dc7be
TLSH
T132E0DFE2A47AE02B10A88A3E19807C412A3BB9358291A9E8D95241ACA0816EA5E12476
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 c2c4d300654162228fe8caada8ad99b096b3a179a53b60b7c7d405e69172eb8c
MD5 bd3a977b9c76f9d78b2d1bfbf20d9d1c
SHA1 16ecdd6568779c17e0904b98e43ef945d6057538
SHA512 8065d1430e005f017c29f172f80b0f9ba84747bcc904442200c729c1649458503b841def255b3d6bf85a34648461e09d90a3bfb0a52760e632c9f82e33c90745
SSDEEP 96:rU/dYPHgb9jk+mLdo616Z0UCs7/x+6MhmuecJUIkS1ejePK+gXZ8rI8XM1C7K:rYaKUo6hsV+FdFLQjVgg6K
TLSH
T133D1A6079E28A97F4CC7E108BA35BA57E2F5502176D52E48E7F88A1C05DB6DC6317C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 e2bfd41ca3bd988faf086c630f599b705331c329fcd8d1261464b57f701b7624
MD5 d472df73dd6a78f8650f3687e4a54575
SHA1 5d468d333c20e73a4861f0eeabb9d3203ccedeba
SHA512 e2160e566eabb245e165aa6a5abba032a0ef1812b3b13d5834215cc90ccaf5b6e800914179b2ff245c827cdbc27d920c977676f30f425039c530eac10faec127
SSDEEP 96:stU/dyaPHExbDjk+mLdo5h16Z060s7/x+6MhmuecJ6qGVOdjePK+gXzz8028XM15:stYLMlUonfsV+FdrA2jVxG6K
TLSH
T145D1B40B9E24A97F4CC7E108BA35BA42D2F9502236D12E58E7F8861C05DB6DC230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 28bba080b048fe9ec5b5e00563faf8d6e8dc4cd4a13b06b80bd476c5b9f8ec17
MD5 5da1bebb07996942c5d158031c27db8e
SHA1 c67fa8ffe400eb94eaa10009d9a23e5bd2bd21fd
SHA512 467ed834329fb376bfecf28039e8485bc86deaad0da4bef4af87084260fcc10b556892bd0b3bcd6bb1edb546b22285bba28ad0f2bd617dc591c5be34fd5eade7
SSDEEP 96:stU/dyaPWGExbDjk+mLdo5h16Z060s7/x+6MhmuecJ6qGVOdjePK+gXzB8v28XMz:stYLGlUonfsV+FdrA2jVEG6K
TLSH
T1FDE1B5079E24A97F4CC7E508BE75BB53D3F9602276912E58E7F88A1C05DB6DC220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 944c2a46307e973b756c7386bdfea3cc6e67493d4a164a50591437f23af87419
MD5 22a1af0e9f6c071e68afc5ee4a7a5092
SHA1 5275698cb714b8d08ec926e57fe601818da4ff89
SHA512 48fa93dee36406a172a14506349705795395e9a39775441c68a47d97b8bfd34b1737f444e6b59d5cba537a1175148a20269f0d40a40027226c024686937c1bab
SSDEEP 96:vNiLPlf/ROo1pkF5d1odiVz7VaTEv9V5h5pg5+e01X0V9+cGQUEjg+:MjvcD9lVEEEjg+
TLSH
T141C1C6A7862DC175BF414AEBEC387ECA89A601CF88C50C0697D2C54807C2EFD21DE495
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 ae2fca95e3c15498c1d09755cd470e0cb345ad0bc6c3fec2e97313dccb3ba479
MD5 8b7c5a91104f0dd28db0ac708a40048a
SHA1 805a3d2142200f470548e7be7a43f9443701e9d1
SHA512 6c60af8fffe4ecad94d85109cbd6a8f88a012a59c1936217bf9d17cdee1723f2c48ed1ce215a589cac900fbe1517a8410bb247de92d72dde4803260077fb5d26
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 79b107307408e5ad9a145c87533316174fd13f4ad943497d079522fbe325b3b1
MD5 71ccdda9f3186c8e729bb559f93bb992
SHA1 3712c11bb21b8e2a74bb879d47b2819ed1ac14a8
SHA512 19f8134fcd1211964111b07884b52878b1649644b6ec623bb586df1a9b7dabc7f8c8a755d2a52c908b563bdd968135f4f703cc35103696e40d0ab0020c8dc4bd
SSDEEP 24:TL6iuaJhPwMuz6G0ZestjteXUSQeCl7ZIeNa6+6Uwg8hPq81fBG:T2TaOk17ZfnUdoqSB
TLSH
T1B0139A0F2E587564D1BD0635E9A34E6B2B7E30489B8329D125F02AF24DE251C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Site Characteristics Database\LOG
Size 321B
SHA256 bb04aed986ff48d51208445b06cb9bb7ecdd0027507ce351e510b4b7ec607032
MD5 a15cf08abcaead998cf10c6fcf5c2825
SHA1 ceef7e075ce7f48e7addfd4d3c3dc3b4baf53369
SHA512 516178f39c265e04fa23de1b295ea806ff2b9178a024d334f5d6ad26166a2ddfdd57316625502847e8c18968efe4095ae545703ba0b8cd7e304c0097c9422a6e
TLSH
T1A9E0202119C6893F41C545DF4671F32DC393F015FAD927256E6CE614150F4087101700
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Sync Data\LevelDB\LOG
Size 297B
SHA256 9c524905748020df8ed4fa10eef2b548845338953500c85c749ce8aba10529f1
MD5 12fb4086d790a5ce4d91cd12b9711044
SHA1 30a7e0446dacd5606748c43fa89647d72d1c6e78
SHA512 6fe5388310cf539597890c183d1d4f6e7dd63c60ad30ef14d94c14448648ca5d46dd83595cc2b3d02e1c888c94bad8105521126a583c16c8f4d03125afea5b4c
TLSH
T1EBE07D30A8C681394988C5DF8674F73DC3B5F409EBC63B096F5C9C14280B50C7210241
MD5 SHA1 SHA512 TLSH

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Visited Links
Size 128KB
SHA256 a3a30d53a29098bd0322f84a74c1d660cab528ccdc33fb623bf5815a3c0fa1cf
MD5 dc1f821682edcd4dc621b3a7c823d0af
SHA1 d0818dc84e94b27851b07d23f2694e8c36b8d305
SHA512 de129b0babeae7d630bd7138064185e0363848c1b63ba72ad7b28135661de153514dad9f48f7b3ffd93220fa54f8a0635b4f741fea1c2f69cd1144317d235de7
SSDEEP 3:ImtVuM/ZhlINwtcltl:IiVuMeau1
TLSH
T164D304070133040CC07445355CC1150DD513D001CC11005303F415D7F5D40750307411
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Last Version
Size 14B
SHA256 d75607a88bb0f572f8863a3ea4737b635664178e97e0b7cb057887f2736fe3fe
MD5 3b746b6e8b8e101ee7cd41df1bb565d0
SHA1 ff5ff645ada097814fb4890d00dba8a309e1a506
SHA512 71d487cff7f744f046d993889c770a877075378b8d47d6c2f80fd94a5c1150a627f4a69d9e55f272f3aa4257e5dbb5296643591d5d23804a95550a3f2d91e2d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Local State
Size 2KB
SHA256 cf717983820a3d0700e0379e665373f91ddf6b5911788dbee4f8e9b2b63885df
MD5 b3202bb851ad55a32c37d3e9a45c502b
SHA1 7d028516a2dfe99f5260e8e0b8b42b8bf7d954dd
SHA512 22c4b8e5525c76ac3c7b05d40c9720d8f8d928c07f999dade4ef2788b3fa15c5feae2a2734bc69e3c6db4602c9a725376f4914d9f8456edd74385af2b312197b
TLSH
T121519333B9106E7A99E382847D46BFA3DE7650A9AF421F54AAEC070C01DB12D1313C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Local State
Size 3KB
SHA256 d6ebd644d2f6f665556c3e4c872233c8d546159b156b760dba798bd741d64ec8
MD5 fd62d415518f7767b3d0546e767ddb06
SHA1 3b608042697288ed41832177bdb7db07a3fda11a
SHA512 603690c3ab0c1becc46bdb914189d37931ea7df7e7c4717b812a2d7ef52c555d15bfcc4c7aa811163841e1e85d3fd9ba320395059e0795f093c8da46cdac2241
TLSH
T1BE71943BA960A93B4DF386457D867F56EBA1103AEA857F98DAEC0B0C01D725C1313C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Local State
Size 16KB
SHA256 ac2aee1741a1d3d14f854827ecc59ffd8e11e8aa4dbf2eda32b3685a43c51dbe
MD5 a7061f30d9a0da732a079cdc00cbf845
SHA1 5a2482842416318922c211a81fee390608df7594
SHA512 f98c5cde0285c9c774ffa7a7438e108173919b2a2938dda2278d521ab0c5551d7f8d6cab6c046431230fcdc592b3eca3d39edaf2898307fc816fa0e7bc44b72b
SSDEEP 384:asrv+89zHqlDNP9oid+3NBSVWfo4U5r3oN2:lrv+4UNbd+CWwB5r3oN2
TLSH
T1F872AF33E538AA379CF38449B446AE077B7860A652C24F60D9D95F4C428F0ED2307D53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Local State
Size 4KB
SHA256 25ab3ddc92e25412638de31833449e15963fdcc7f637518260d71b344a2e47e7
MD5 4d513188d54cb747f2b370f7098fb2c9
SHA1 0582f03f5e0d4c29cb7ce58893a9fc2add8cd032
SHA512 794b87656e991f59ac050eaef6ea4be4caa8c505d2ee6452033d4ae1c83c5cde6e3fe31b06bbb311e5743caa4925133b930b2ff2dc500db63fa107467ab887b6
SSDEEP 96:EB3NkGSCmvyfXAryKgy8kh/cI9URLl8DotoN5eZBdZe6cBZaui5gJea:A3NBSsAryYeiDUaudZZH5M
TLSH
T1E791933BA9A0AD3B48F3C54979427F47A7B550279A856F98DAEC0F0C01D729D1353C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Local State
Size 4KB
SHA256 e6326e32309fb7c42f45efe4b5859765d6429be9da1d44734d8475d89a47626a
MD5 9433651eeadf19d8c1f18956df6f8f64
SHA1 3f4fd237450014d7d8619907cda1cbfa614be79c
SHA512 f4350dcfc5d817c10855e8d20e305020543d91975c2e43fac7254ae85ba69fd74588f032bb66abe90378f187b3fd1dc77638688fa0a16c13786b5b8852aa99c5
SSDEEP 96:EB3NkGSCmvyfXAryKgy8kh/cI9URoDotoN5epBdZe6cBZauTaJea:A3NBSsAryYeoDUa2dZZmm
TLSH
T1F691843BA9A0A93749F3C5097D457F52A7B550279A856F98DAEC0B0C01DB29D1342C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5a6d42.TMP

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Local State~RFe5a6d42.TMP
Size 1KB
SHA256 c0328f784b54dd49dc0f99a57314f402d7cc8876bd295b8504c3248187586654
MD5 cc0a11a73fe90c086d25340b54a61c0e
SHA1 de8becf386fc56ccfe015cc344082ee989c49315
SHA512 8f583a1e2077301ef55dc60edecbf10643513fbb3839dbf5155a5599e973c0a874833e3816d6fae6061c6a93a54f0411a22e0fce369c8058eb3a72f38d475445
TLSH
T1FF3162B7A9502A369C9342863502FE979E22147E9A424F0866DC460C01EB01D513BC32
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\ShaderCache\index
Size 256KB
SHA256 37e1e19a842cfa12f2f8e2e0d6d78faf5feb9c0fe454e2b70d3e8f220c97bd01
MD5 e9bfd9876264baea61c70a674d306bac
SHA1 727ca27483e2e4163d6b153ac5b254ac22178f24
SHA512 77fb22d4724899c25877e04a4d5f8072917740913de2f7d3354ae357ab4f4f61ee2797c2ea223dbf594bd5c7a46f27856769db79fa074c1eff964d4e3f3ba205
SSDEEP 3:LsOllllklkXl8y/:LsUlP8y/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

Stellar.lnk

Path C:\Users\Public\Desktop\Stellar.lnk
Size 981B
SHA256 2cae6b53dc8695ec81f9985864ff615d73b1bf5fe98487ec17d8a56db3eac794
MD5 085b06cce6be55e6bb13951b0d66f39e
SHA1 18053e73574bce5b878fe5fb7aee62dc138cf89e
SHA512 86817ad3aa82218858a0112931a38a695c717009d9784bf7a9840f92200c64031dd10e8e29b187b636e32b28ffabad0a74d23f7e18086550b05d28709eef5f0b
TLSH
T1EC11AB0003D20B26F2B38639BCB39BA18725BC12A256073F03CA41C91C35055656DF67
MD5 SHA1 SHA512 TLSH

Submit Download

Stellar.lnk

Path C:\Users\Public\Desktop\Stellar.lnk
Size 981B
SHA256 82b29fc34565646313cb1261e360ad3bea940a92ff122d5c48fc2325db3c3a48
MD5 4e3584e5306d6fd48011d938cf6bdb6b
SHA1 38a68cc880bcb440dadedd432cfc0822c00221b2
SHA512 53eedf04bbef498f56ef292a5d9edf64037791871a554b284d7895c02179f02a47529ffc0d1e8d292dcda0d9039cf5a814437735dc0c1bd6f61fa1254cdde370
TLSH
T15411CE0407D30B25F2B38B3E7CB39B918B26FC15A6650B3F02CA41CA5C75194695DF67
MD5 SHA1 SHA512 TLSH

Submit Download

e59ff26.msi

Path C:\Windows\Installer\e59ff26.msi
Size 14.1MB
SHA256 ff52c2789b05e280709baf911bb2ca51d607c431205420a8641f204f581c925f
MD5 d48379de3fa90026eb36896f66f3813f
SHA1 41644a5336cac5956a4263c20efe7de583f8eb6f
SHA512 48649c4c8995016e251e0dd9fbb8013b6308968f38fe76111877e6c378c1708b3df8d400b2b49b607a32ab8497d873764a6c23b57f93ee0b1b0a9756918307d1
SSDEEP 393216:/nthtonKpnbQZFpYk/ud6vCHrgIXG/V2chak6i:/nthTpnb2QkWd6v4rOAKB
TLSH
T186E6331B3D1AC522C0143EF9C836EBF6A51CBC54E512A9933189BE5CF9F01C69DA05EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductIcon

Path C:\Windows\Installer\{79A1ACA1-E7F5-4D94-A5C0-EA79E0C6C60C}\ProductIcon
Size 189KB
SHA256 9c47bc7359b76345ebfdcd24ceaacd452f2b8664fa826bb33ff56363d52a7efd
MD5 7fa9fc12827290722f3fe163621e1f38
SHA1 41ab879a37abfdabc00fb5f663df1debcbe931d3
SHA512 9efbfdb4c20247e156e43c6347f81642715023383a18a57079b5320a38d862fd6f5953a22370634431e9e04862109e9b230a6e4ef27c9b9659d8ec01a71e2277
SSDEEP 3072:QQuRPZLJdnmavL0zZlfyeWa/m/ijaU3qqR:2cZlKeWae6jaU9
TLSH
T111140A69B117C006C40837F8CD1BEAF9545DAE90F8919E6331B9BE4D7A3592FCC848AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1668467648\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1668467648\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_1668467648\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4540_894196136\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 7465723450eae9820a7feae6f321227cd5bb15fb5c1afd7d93ca61ccea3f536e
MD5 59619746742b7440feb124e84d797311
SHA1 2fd0ebc59e5694bf0ca90ff8234806948dfdc976
SHA512 5439ba5a676cbe714c1f0f9f22204a83f6fe26cb17fe056b5e6546b212a17c011642f40195d66f6ad971c7957d739f0bfcf2923b47d2dbe041c5c355346d1ac3
SSDEEP 24576:0Fo3DMP5doO/vvTL/SAiCiVQ/LeIpbFREf0AdfMqUXsa5lzScYRWSrYj2+Y:AH0
TLSH
T14F57E32432F92100E7B79E3CACF46A634D397D5BAC19DE8D45411B4E0822F71E972F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{9a39aab0-04ef-4604-8de5-d3e4016727bd}_OnDiskSnapshotProp

Path \??\Volume{cb1876cb-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{9a39aab0-04ef-4604-8de5-d3e4016727bd}_OnDiskSnapshotProp
Size 6KB
SHA256 84768b79fb76f0f27e6cf753d8ef5c05df27c3eacec8130eb982e58a4c648e54
MD5 99f60918ee598c066fd293cdcc08bcfa
SHA1 bd0f4d50d708d97f7df214d07becbaf3ba04fbbb
SHA512 3f86618dc2817e67970bdf8dddb16e7a74b912beb2d54510648de1447df4b55519a43330e4c9a36ecc10a78e4023e603d1914623b55982c2fdc2206067c137d8
SSDEEP 96:F0MkQyOvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:n1b++uVm
TLSH
T1C1D187085AF54711E2F3AB3128F58557A877B811EF33CB8E0298238E6631910F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1424-1034-0x00007FFDC73C0000-0x00007FFDC73C1000-memory.dmp

Download

memory/1424-1035-0x00007FFDC7C10000-0x00007FFDC7C11000-memory.dmp

Download

memory/3388-98-0x00007FFDC6660000-0x00007FFDC6661000-memory.dmp

Download

memory/5536-73-0x00007FFDC6660000-0x00007FFDC6661000-memory.dmp

Download

memory/5960-1135-0x000001D3D8C70000-0x000001D3D8C71000-memory.dmp

Download

memory/5960-1134-0x000001D3D8C70000-0x000001D3D8C71000-memory.dmp

Download

memory/5960-1133-0x000001D3D8C70000-0x000001D3D8C71000-memory.dmp

Download

memory/5960-1132-0x000001D3D8C70000-0x000001D3D8C71000-memory.dmp

Download

memory/5960-1131-0x000001D3D8C70000-0x000001D3D8C71000-memory.dmp

Download

memory/5960-1130-0x000001D3D8C70000-0x000001D3D8C71000-memory.dmp

Download

memory/5960-1124-0x000001D3D8C70000-0x000001D3D8C71000-memory.dmp

Download

memory/5960-1126-0x000001D3D8C70000-0x000001D3D8C71000-memory.dmp

Download