Analysis
- max time kernel
149s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 09:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Stellar_2.0.1_x64_en-US.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
Stellar_2.0.1_x64_en-US.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
General
- Target Stellar_2.0.1_x64_en-US.msi
- Size 19.6MB
- Sample260723-lzag5abe24
- SHA256 c1c9da4c27fa3787e9418576fe4e54bad5c49bb07f15e3426a958d6250af6bf4
- MD5 e14c45e116d77933d17ae038ca92c3e1
- SHA1 09f3852c07121bec9db2214dfce252dfae77e277
- SHA512 ba893555220eda7fc3fc916d6770b15ad11d35ea20dd7b71a02c1c4368cd04c55da2e0045899037b5963fb68ab57c3efd65215ea75b55a7ef096ab873aa4a1af
- SSDEEP 393216:s/Zk8znM6WDMvjF2v/NuQnzSSmR5Q38zFjBbwoyh6ojtL3oLwZ9MTcV:s/zQvDCEtnzSDR2MjbFyh6ojtcpwV
- TLSH T1402733077D02CA27C0162EB9C8BBEBF1142AAD04ED515C1363687D29F9F18E3EDA15D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2452 stellar.exe - Loads dropped DLL 1 IoCs
pid Process 2520 MsiExec.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA stellar.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Stellar\stellar.exe msiexec.exe File created C:\Program Files\Stellar\Uninstall Stellar.lnk msiexec.exe - Drops file in Windows directory 33 IoCs
description ioc Process File created C:\Windows\Installer\e5971bb.msi msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_273943731\Part-ES msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_273943731\Part-NL msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_273943731\manifest.fingerprint msedgewebview2.exe File opened for modification C:\Windows\Installer\e5971bb.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF3532B741D41CDF1A.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_2039606660\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_273943731\adblock_snippet.js msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_273943731\Filtering Rules-CA msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_273943731\Part-IT msedgewebview2.exe File created C:\Windows\Installer\{58799B11-5D8F-4FCF-835B-D70460332A22}\ProductIcon msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_2039606660\_metadata\verified_contents.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_273943731\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_273943731\Part-FR msedgewebview2.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DFF0D4DFB3A07A3D07.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI7C2B.tmp msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_273943731\Part-DE msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_273943731\Part-RU msedgewebview2.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\SourceHash{58799B11-5D8F-4FCF-835B-D70460332A22} msiexec.exe File created C:\Windows\SystemTemp\~DF487BE19D2F54FA60.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF6FFCFE969AE88AF0.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_2039606660\keys.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_2039606660\LICENSE msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_273943731\LICENSE msedgewebview2.exe File created C:\Windows\Installer\e5971bd.msi msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_2039606660\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_273943731\Filtering Rules msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_273943731\Filtering Rules-AA msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3376_273943731\Part-ZH msedgewebview2.exe File opened for modification C:\Windows\Installer\{58799B11-5D8F-4FCF-835B-D70460332A22}\ProductIcon msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4816 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000002fab76c52da068360000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838012fab76c50000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841012fab76c5000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e32fab76c500000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e62fab76c500000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe - Modifies registry class 37 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\stellarv2 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\URL Protocol msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\DefaultIcon\ = "\"C:\\PROGRA~1\\Stellar\\stellar.exe\",0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\shell\open\command\ = "\"C:\\PROGRA~1\\Stellar\\stellar.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\11B99785F8D5FCF438B57D400633A222\Environment = "MainProgram" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11B99785F8D5FCF438B57D400633A222\ProductName = "Stellar" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11B99785F8D5FCF438B57D400633A222\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11B99785F8D5FCF438B57D400633A222\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11B99785F8D5FCF438B57D400633A222\PackageCode = "336CE0A84A12EC04BBB04A62648AB83A" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11B99785F8D5FCF438B57D400633A222\Version = "33554433" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11B99785F8D5FCF438B57D400633A222\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11B99785F8D5FCF438B57D400633A222\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\stellarv2\DefaultIcon msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\11B99785F8D5FCF438B57D400633A222\External msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11B99785F8D5FCF438B57D400633A222\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11B99785F8D5FCF438B57D400633A222\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\stellarv2\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\11B99785F8D5FCF438B57D400633A222\MainProgram msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11B99785F8D5FCF438B57D400633A222 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11B99785F8D5FCF438B57D400633A222\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\812181F64B4B79A53877A752AA655852 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11B99785F8D5FCF438B57D400633A222\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\shell msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\11B99785F8D5FCF438B57D400633A222 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11B99785F8D5FCF438B57D400633A222\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11B99785F8D5FCF438B57D400633A222\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11B99785F8D5FCF438B57D400633A222\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\11B99785F8D5FCF438B57D400633A222\ShortcutsFeature = "MainProgram" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11B99785F8D5FCF438B57D400633A222\Language = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11B99785F8D5FCF438B57D400633A222\ProductIcon = "C:\\Windows\\Installer\\{58799B11-5D8F-4FCF-835B-D70460332A22}\\ProductIcon" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\ = "URL: protocol" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\812181F64B4B79A53877A752AA655852\11B99785F8D5FCF438B57D400633A222 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11B99785F8D5FCF438B57D400633A222\SourceList\PackageName = "Stellar_2.0.1_x64_en-US.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\11B99785F8D5FCF438B57D400633A222\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4160 msiexec.exe 4160 msiexec.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 3376 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4816 msiexec.exe Token: SeIncreaseQuotaPrivilege 4816 msiexec.exe Token: SeSecurityPrivilege 4160 msiexec.exe Token: SeCreateTokenPrivilege 4816 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4816 msiexec.exe Token: SeLockMemoryPrivilege 4816 msiexec.exe Token: SeIncreaseQuotaPrivilege 4816 msiexec.exe Token: SeMachineAccountPrivilege 4816 msiexec.exe Token: SeTcbPrivilege 4816 msiexec.exe Token: SeSecurityPrivilege 4816 msiexec.exe Token: SeTakeOwnershipPrivilege 4816 msiexec.exe Token: SeLoadDriverPrivilege 4816 msiexec.exe Token: SeSystemProfilePrivilege 4816 msiexec.exe Token: SeSystemtimePrivilege 4816 msiexec.exe Token: SeProfSingleProcessPrivilege 4816 msiexec.exe Token: SeIncBasePriorityPrivilege 4816 msiexec.exe Token: SeCreatePagefilePrivilege 4816 msiexec.exe Token: SeCreatePermanentPrivilege 4816 msiexec.exe Token: SeBackupPrivilege 4816 msiexec.exe Token: SeRestorePrivilege 4816 msiexec.exe Token: SeShutdownPrivilege 4816 msiexec.exe Token: SeDebugPrivilege 4816 msiexec.exe Token: SeAuditPrivilege 4816 msiexec.exe Token: SeSystemEnvironmentPrivilege 4816 msiexec.exe Token: SeChangeNotifyPrivilege 4816 msiexec.exe Token: SeRemoteShutdownPrivilege 4816 msiexec.exe Token: SeUndockPrivilege 4816 msiexec.exe Token: SeSyncAgentPrivilege 4816 msiexec.exe Token: SeEnableDelegationPrivilege 4816 msiexec.exe Token: SeManageVolumePrivilege 4816 msiexec.exe Token: SeImpersonatePrivilege 4816 msiexec.exe Token: SeCreateGlobalPrivilege 4816 msiexec.exe Token: SeCreateTokenPrivilege 4816 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4816 msiexec.exe Token: SeLockMemoryPrivilege 4816 msiexec.exe Token: SeIncreaseQuotaPrivilege 4816 msiexec.exe Token: SeMachineAccountPrivilege 4816 msiexec.exe Token: SeTcbPrivilege 4816 msiexec.exe Token: SeSecurityPrivilege 4816 msiexec.exe Token: SeTakeOwnershipPrivilege 4816 msiexec.exe Token: SeLoadDriverPrivilege 4816 msiexec.exe Token: SeSystemProfilePrivilege 4816 msiexec.exe Token: SeSystemtimePrivilege 4816 msiexec.exe Token: SeProfSingleProcessPrivilege 4816 msiexec.exe Token: SeIncBasePriorityPrivilege 4816 msiexec.exe Token: SeCreatePagefilePrivilege 4816 msiexec.exe Token: SeCreatePermanentPrivilege 4816 msiexec.exe Token: SeBackupPrivilege 4816 msiexec.exe Token: SeRestorePrivilege 4816 msiexec.exe Token: SeShutdownPrivilege 4816 msiexec.exe Token: SeDebugPrivilege 4816 msiexec.exe Token: SeAuditPrivilege 4816 msiexec.exe Token: SeSystemEnvironmentPrivilege 4816 msiexec.exe Token: SeChangeNotifyPrivilege 4816 msiexec.exe Token: SeRemoteShutdownPrivilege 4816 msiexec.exe Token: SeUndockPrivilege 4816 msiexec.exe Token: SeSyncAgentPrivilege 4816 msiexec.exe Token: SeEnableDelegationPrivilege 4816 msiexec.exe Token: SeManageVolumePrivilege 4816 msiexec.exe Token: SeImpersonatePrivilege 4816 msiexec.exe Token: SeCreateGlobalPrivilege 4816 msiexec.exe Token: SeCreateTokenPrivilege 4816 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4816 msiexec.exe Token: SeLockMemoryPrivilege 4816 msiexec.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4816 msiexec.exe 4816 msiexec.exe 2452 stellar.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4816 msiexec.exe 4160 msiexec.exe 2520 MsiExec.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 4160 wrote to memory of 2520 4160 msiexec.exe 90 PID 4160 wrote to memory of 3412 4160 msiexec.exe 96 PID 4816 wrote to memory of 2452 4816 msiexec.exe 99 PID 2452 wrote to memory of 3376 2452 stellar.exe 100 PID 3376 wrote to memory of 416 3376 msedgewebview2.exe 101 PID 3376 wrote to memory of 2712 3376 msedgewebview2.exe 102 PID 3376 wrote to memory of 2712 3376 msedgewebview2.exe 102 PID 3376 wrote to memory of 2712 3376 msedgewebview2.exe 102 PID 3376 wrote to memory of 2712 3376 msedgewebview2.exe 102 PID 3376 wrote to memory of 5188 3376 msedgewebview2.exe 103 PID 3376 wrote to memory of 1636 3376 msedgewebview2.exe 104 PID 3376 wrote to memory of 1636 3376 msedgewebview2.exe 104 PID 3376 wrote to memory of 1636 3376 msedgewebview2.exe 104 PID 3376 wrote to memory of 2432 3376 msedgewebview2.exe 105 PID 3376 wrote to memory of 2432 3376 msedgewebview2.exe 105 PID 3376 wrote to memory of 2432 3376 msedgewebview2.exe 105 PID 3376 wrote to memory of 2432 3376 msedgewebview2.exe 105 PID 3376 wrote to memory of 2432 3376 msedgewebview2.exe 105 PID 3376 wrote to memory of 3740 3376 msedgewebview2.exe 108 PID 3376 wrote to memory of 3740 3376 msedgewebview2.exe 108 PID 3376 wrote to memory of 3740 3376 msedgewebview2.exe 108 PID 3376 wrote to memory of 1220 3376 msedgewebview2.exe 109 PID 3376 wrote to memory of 1220 3376 msedgewebview2.exe 109 PID 3376 wrote to memory of 1220 3376 msedgewebview2.exe 109 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Stellar_2.0.1_x64_en-US.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Program Files\Stellar\stellar.exe"C:\Program Files\Stellar\stellar.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=stellar.exe --webview-exe-version=2.0.1 --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2452.5556.1104107908196694531 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a4933⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView /prefetch:4 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff913545fd8,0x7ff913545fe4,0x7ff913545ff04⤵PID:416
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1768 --field-trial-handle=1772,i,17877198993466561696,8735449950753700565,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a4934⤵PID:2712
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1844 --field-trial-handle=1772,i,17877198993466561696,8735449950753700565,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a4934⤵PID:5188
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2300 --field-trial-handle=1772,i,17877198993466561696,8735449950753700565,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a4934⤵PID:1636
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3308 --field-trial-handle=1772,i,17877198993466561696,8735449950753700565,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493 /prefetch:14⤵PID:2432
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4556 --field-trial-handle=1772,i,17877198993466561696,8735449950753700565,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a4934⤵PID:3740
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4684 --field-trial-handle=1772,i,17877198993466561696,8735449950753700565,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a4934⤵PID:1220
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2DE4F710415C113AB6DB64277DFC8564 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2520
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3412
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:2984
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5971bc.rbs
- Size 10KB
- SHA256 0cb8e21d3d8ba1985f4f58e74543aee55e4bd00e1a6afebdc6689c2f5507c478
- MD5 108c7e978530a2cea1370f153725c9a9
- SHA1 6d1582c1421fd97fe8e3b1529ca378d0591f9744
- SHA512 83a8645467f780ee78f8274a644a3c3907363403f409e99587717e7f605e288f03386b9ec0b6dad063b1b402739d2efecd3802491155c5cf3103193ac0f8fe28
- SSDEEP 192:zVQF536eS4V/FQOsJCUQQGYG4QGYwSfnQ/9WKi5EvpY:zVQF5qBaQGUQGhUCK
- TLSH T1BF22EE4173008BC3E8AB6739C747235837B2D6988306538F198D95A58E1B7D82EE96CF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Stellar\stellar.exe
- Size 29.2MB
- SHA256 0cc58a26d1037b152edd52c7e6cf64283effc97826da249b4917c640d89765c8
- MD5 64ff05be786449b1f32873aac1f9d371
- SHA1 4e0bf454b03c6165674e2bbc38708c2d0ba48041
- SHA512 8395c89e1c2f805d537785e1726cff2f0d311fee74d9ba0215e8f467ff42c6c23220af8743c88f097d09213d8b7f164969dd9f6c1ec5a7023119cc3cda27b5a5
- SSDEEP 393216:ZQfPK+lN7txZUHyUBKUv9TRmrxbXpeovlbra+2RsGswkkc:+PK+lN71wQUv9Nm11eu5ra+2RsGFP
- TLSH T1E7679D117A5B99ACD19AC8B083474A734E2174DF1A36B9AF41C462383F7DBF46F28319
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Stellar\Stellar.lnk
- Size 1KB
- SHA256 f0bf749532315316b1f5130d3aa0282cc5d28fe582b7c7844d4a8bed5a12e2b6
- MD5 548744b37d84c8722d0d36e5335fe24f
- SHA1 c6e8bbc80a7f79bfb2ad60dab407eb4611cf6479
- SHA512 fbb6094f018abe44aaa47ffb7b0a6a7cd0848b61dcb769375150c0436530c2d00d675e818be666b827bffe0c020a11bc1d248e0c320799a75e2c69a4f8a63b05
- TLSH T17D41DD1057E60729F373CB39BD711A62DA71FC06A9216F6F478640CA0878140F669F6F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Stellar\Stellar.lnk~RFe59816b.TMP
- Size 1KB
- SHA256 f00fe0211e5b3652ef8684c68bfd35aec0560f6d5bba20c57a88f23ace40b5fb
- MD5 28a0b4c43686553d63cada6ec32d0a4c
- SHA1 fbd46aa50bd683acbe61086256d2c2b744c3ce71
- SHA512 dcd4a55628793900850da3ebefe562d73a88a3f9da384481b2064be5db3d2638a8e8bdea70849c484e02089004dcaabe57c578aea9c0cc20e7da873abdad5411
- TLSH T13841DC1017E10A29F373CB39BD721A62DB71FC0AA6216F6F47C6408A0878100F669F6F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI142A.tmp
- Size 132KB
- SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
- MD5 cfbb8568bd3711a97e6124c56fcfa8d9
- SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
- SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
- SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
- TLSH T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 1d45a96aa5d68e8d0ed783a80e3e90bbbaa00df9fbdf0b2b07f22d7b1cc2e1cd
- MD5 6516644d144be7c1e3323b3c8ecb084e
- SHA1 68cec8fff5ad60f234975ce69d56b2002eb4004d
- SHA512 f7ee334fd948ccda5b370d8f2b41dbdb2bdeedea5893cb750162d67d01323e58abe39541952cd35d6b0aa8731120132f17b9cd626df4faf0cdd03f3a4a2cbb8b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 f83bb1724a8aba667ac192ca1aed5b35c99b123f71831fa9f6cdbb77ff1002cb
- MD5 6ef5beb3bd6831b3542159870ab9947f
- SHA1 b8043f5495948a397f0695f6e595feba5dcdb762
- SHA512 0f142d405c77aeb661ec1d6ee3b26d582bdfa63b4099e8d3748bbc38c384004802d46691289cab431b5ad2255457bd5b8b279df37f19cfede8319da579551f30
- TLSH T173D011223B02823CC02030B300A2A3080880CA0B800AC002A828EAAEAA088A00A028C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 72B
- SHA256 097bec91082317355c3d52676dd956d239630a416c3b353f63a075befff0825e
- MD5 2dfd02fad663eb2b89608fa1bd719000
- SHA1 eb4eac20e429d1ac8b7292e39df9a5b1a483355a
- SHA512 758e9b9efdd3d88c4969fc230893e45ebaa2b702c2c1c2697ebcf78d82b7e67ff7bca3471b74c2e7d4f1806bdb33d18618d997827e5d8f3e002d496e5948bf81
- TLSH T196A0023503C3A942E501837150C1034037B09D77474F961184E106FA98703406146571
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a40d3.TMP
- Size 48B
- SHA256 2f629c3f273f64f74946a6e5181e6b227ccb4afe87d028339a56f61e7db9d2a0
- MD5 3b1ce3ce7b3903fae0614d45b83f3a23
- SHA1 675b6d1aaef9f2dcd74c68e1a163439f2b7da340
- SHA512 97989e0924156181ecf14818424685b2e0a0d14ca0f2ea2e088c06b511c4ca29b78aa5fdc1cdc18100d851ad6ad59a0034d57bf962666edf7ed3e5f6bb5ea771
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Network\Network Persistent State
- Size 842B
- SHA256 03b649ff9fcc8d4130ef4219bd19bed83c937eab102911b36ba5c93482486153
- MD5 605403a193ba64ba26b20133cd4bc562
- SHA1 4e435df0001cae1319c57a831d9df53896c62341
- SHA512 52b81b5169be475c0196f3afa4698e36c69169e12e359a1418c282076003470cc84b14572f7ae62c015ddd80efe7afa576abae58cf7bed602f101144679e80c4
- TLSH T14D01C293C3E4C6BD4B4127E827343417CC1E0509A22C2D17DDEAFBAA6BD1475E21500F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Network\Network Persistent State~RFe5ac3bf.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Network\TransportSecurity
- Size 188B
- SHA256 3672f0c5c155aeedb2327f21b711f8cd5f1dabe6c43070ce4c06dd592de135e3
- MD5 717caf9f8186aa9d17570aa2fbcf1a3a
- SHA1 3c81eb20d82bd1cdf80442f15ff093f5e01c84e3
- SHA512 63e8adba754c9a3f937f62853ae9013718096d4c85e734adeaed98a5aa6871e534a0bdc7023841096c26976855756670fab7e7c311d61a35add5cef8456ca861
- TLSH T18BC022A2842AA03A103905322A887E006E36F0300341D4FCC14E0938E0509F68303022
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Network\TransportSecurity
- Size 188B
- SHA256 4e94429dd33c5af33a198a12cac25296ba769471250dca9b80d97a026d64a351
- MD5 97ddb1cf725dcdd7c737565ab84aed2e
- SHA1 715491a333ec2b22c1d6fee3276851b1dd7ed872
- SHA512 11d36fcfab76642e5d01c5e1e12aec671828d89aedd1142bfcb730bd80841339ff5c4e7d5b518079c9fbbd889fce2594aaf0b10d509f627327756f8139e97690
- TLSH T1C6C022620129B03B10380B211E847D009E36F070214394F8C55389B891505665103022
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Network\TransportSecurity~RFe5a1a50.TMP
- Size 188B
- SHA256 fc76f4bbd1b52b23827bd2d2e93d5c1ca5bb64d96fc61ebb400d9578b555ebc8
- MD5 4ab78894dd4137b0a01de3f6feb3c11f
- SHA1 6ce6bf92bf8fbdf5854676ccd86702586ab27d41
- SHA512 6fd5f6804443e01112a5a06eb0d7c2dd4a3263e5a0b2f0a7f3c162ec7a4709fbe6c7fe42099050a24212a0424de4cbdc5a82bbfe747866701bd0a4bea24c41f6
- TLSH T14DC0C0A3063DF03710380722198C7D006F3BF23003C1B4F8E54A817C90909BE550F003
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Preferences
- Size 5KB
- SHA256 5dca7990679d20c3beb4f400301cd83c6f3371f5f2f7cbafa82340406ea29637
- MD5 ad14e6639852cf67eec102410c23a0d0
- SHA1 91555e42c2bf4a5175032fff2b346b442b2944e0
- SHA512 11e4853ac736d03d4d0f79eb1d519682ee41c4b1b97787a5a9aea63b49f90f875aa98f6ae25b80daf74a2de645fb3f7c114937f58c7810e135290eeba9ac48f1
- SSDEEP 96:rT/dYPq0b9qk0do616Z0ns7/x+6MhmuecJ891ejeOK+gL28XM1C7K:rLaiHo6nsV+Fd89Qj6ZG6K
- TLSH T186C195069E28697B4CC6E108BA397A17E2FA5431A5D52D5CEBF8CB2C04DB5CC630791B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Preferences
- Size 6KB
- SHA256 ebae89929fe89b6def788d9141f1ecdbe6d34ed73486084fdf5fd42d4716d6c6
- MD5 2c7241c484125f51ff5e12a1b78cc253
- SHA1 6b3bcf40e3388f0f6e1a79ac6a8143292aabcc69
- SHA512 5aa7ad5191c09404525f50c157d6e66ed6cfd89b19ec690c978cf61ce2d2064a7359a8acb92384f83f50e749a8fba9435acc0cfbe7c8b9e9fe0c58d0dcf888e6
- SSDEEP 96:stT/dYPq0b9qk+I3o5h16Z0ns7/x+6MhmuecJ891ejeOK+gu28XM1C7K:stLai83onnsV+Fd89Qj6UG6K
- TLSH T1DED1B7069E24697B4CC6E109BA39BF13E2F95431A5D12D58EBF8C71C04DB6DC630791B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Site Characteristics Database\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\GraphiteDawnCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\GraphiteDawnCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\GraphiteDawnCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Local State
- Size 3KB
- SHA256 d695ad92b30c0dd68f9a7e8cd72eab5b632a8f4b26bafc243b16c5cf2396d9d2
- MD5 bbb455a332949f0077aa43ed6f5db1b8
- SHA1 2bb9835225631e97624d20ed1beeeddba406cc3e
- SHA512 eb18c903e0d46dcf59f829c84a788f768f28a1ed34b1af8c54ffe62d560abe1a118864e9cd59157420f8834726c7b073e7d1117527d6c4c5b6807c9aad8e30d0
- TLSH T11B81743AA960693749F3D5057C8A2F43ABA55073EA927F98D6EC4F0C02D76CC1346C27
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Local State
- Size 2KB
- SHA256 97c1ccc48396852c5873a7b3a634181e3d40ce165931f71c82cfb7f635dd4ac4
- MD5 49bc02755264e92f124383b310d7222c
- SHA1 13e4935d9cb89823a583a68670c5308b754cf833
- SHA512 9dc1cbbc79f6bfb1e40412a5bccada6470bcf979d53d3d83689bbd62dc939a39bdb47efc40b2444a8a39250c03fe9810cb2e12065fd515f1e140d5b11311a7a6
- TLSH T1A551B53BAD50663AC5F38645784A2F239E3651B2AF932F9896DC5B0C01C754C234BC37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Local State
- Size 3KB
- SHA256 b63f5c242e823215e50d21c14993dcaf1bd12e19740eb06ad82b871e6da3cda4
- MD5 90b26fa8215e8eb0cc367cb1b38fe199
- SHA1 4ce19f8e670c5b2dc3973ccbac49b3fa587d94e2
- SHA512 f0432360b327b960f143a564e551f3a33101215af602f081d595dbbc0daa28f2fd76696f2b3bf0df4429ab863ecff726912407153d71a62bec6676b38231c0d3
- TLSH T12571657FA960A53B89F3960578862F17A7A55137EA923F98D5EC5F0C01C728C1346C37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Local State
- Size 16KB
- SHA256 5f480dc959130e7c9033f71abb249124522a0ec2df28d70db1fc26e8f3281d96
- MD5 0d3b3325271a97aa1c5a7de0a9ea675b
- SHA1 34142a9941d2797fd4af67137a5ce2506f2d8cd0
- SHA512 8b720eb7861bb7feb735604a5b88c8524798b786c7695017f402053bedcd581cf5a805e42db76b676f0834b756eff3e5cbf8bd23be272b2c2685f6b906cb638a
- SSDEEP 384:H+aQikB+z/xvxjg/qhEwNBStkfvxTrisdLp9zV:W/UxvxjgC+apTrislpFV
- TLSH T14972AE3F99683D3795F7E605794D0B8BDBB9847295C27DB84AACAF0806C72D80346C27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Local State~RFe599e0b.TMP
- Size 1KB
- SHA256 b755565c8b61d900839b80ad7655fa23780aec8bfd91fe65e3c14418db06d44a
- MD5 f124542736096834d666d61566a4cb4c
- SHA1 1d59b095953a11e8fd18843436623966e9c7fda9
- SHA512 eab814cdaf8f35b101b9dccc9374e58afc9ea44a79d2b0cca106b68d75d81ebd9c32c29ca0acd4f9c1ea921c7eb0d5f58344151279021ba97f63e9fea02f3956
- TLSH T1B43174BAE9502A36E8E7624635466E976E31117797930E4861DC9B0C13C348C676F832
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e5971bb.msi
- Size 19.6MB
- SHA256 c1c9da4c27fa3787e9418576fe4e54bad5c49bb07f15e3426a958d6250af6bf4
- MD5 e14c45e116d77933d17ae038ca92c3e1
- SHA1 09f3852c07121bec9db2214dfce252dfae77e277
- SHA512 ba893555220eda7fc3fc916d6770b15ad11d35ea20dd7b71a02c1c4368cd04c55da2e0045899037b5963fb68ab57c3efd65215ea75b55a7ef096ab873aa4a1af
- SSDEEP 393216:s/Zk8znM6WDMvjF2v/NuQnzSSmR5Q38zFjBbwoyh6ojtL3oLwZ9MTcV:s/zQvDCEtnzSDR2MjbFyh6ojtcpwV
- TLSH T1402733077D02CA27C0162EB9C8BBEBF1142AAD04ED515C1363687D29F9F18E3EDA15D9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 c0601496478fb5cc5b3582686e1cdfc85522de3d12b95ee822c25f2e17a8fe53
- MD5 618365c013589d30022d467bb2afd308
- SHA1 7a3e53ad92cb16102856e0548ca2c4f7c4d275a7
- SHA512 88fd91c3f78a6ecc18e031407b439df80ce7ca81a69436f380e217368dccd82822da165a8fe66a9c81a4eab993a9217d0c533be21d996dafd419663842f9cd76
- SSDEEP 24576:OFo3DMPwdoO/vvTL/CgySSFAvbOo5L1hUv0AdfMakHca5FTS8YBmyLIz2O4:7Hk
- TLSH T12357F62836F92100E7F79E3CA8F56A634D397D57AC15DE8D05411B8D0822FB1E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c576ab2f-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{f1ea4d08-78a7-47a6-98c1-6040e7d095fc}_OnDiskSnapshotProp
- Size 6KB
- SHA256 c8060275fb62ed3c7f4f5b5c8607a9636d75fb4858e8988c9c835f1ea61003cc
- MD5 d98569ea995d692a9bec3e8462ae0525
- SHA1 dcbd87c628f1184e0a63412c8a9c69a86fad8e6e
- SHA512 b0e1167a20163703e2ef0632d528efd594fc1ba110000c3d5ae9c31e5ba0e04dda74eb59a542e4ac25edf6be7aef31fe7ab580b98c36aa50f4bf0dfd6fdd87ff
- SSDEEP 96:F4kFDsvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:K8gb++uVm
- TLSH T1D4D188085AE54711E2B3AB312DF18557A877B911EF33CB8E0298238E2671910F975F6B
- MD5 SHA1 SHA512 SSDEEP TLSH