e005d0e59cfbf34e692ad849caa7eb4ca1895ace79b1ffd5a289ad87d358e292

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Stellar_2.0.7_x64_en-US.msi
Size 19.7MB
Sample260730-e3lk8szarb
SHA256 e005d0e59cfbf34e692ad849caa7eb4ca1895ace79b1ffd5a289ad87d358e292
MD5 7c7ab4d27ce35a416cf14842d6e3aa1c
SHA1 ee36b5c9f8b25a309e2a2c35c5dec8baae72e52f
SHA512 91e7da3d41e112c3cbb24b5e29fda52c420397ffdd3e2b2703e615fb9f0f69bfbb0f4a29c642f6872145e3ca1c28c263372810656f80ed022ac23a30ea730477
SSDEEP 393216:yc821BcGfNfOYbpbY0/NdSh0kkzo32uQ0nNiDwgFQfF/DJxYyN:ychjc6ROYL/NdShbkzo3X4kgFQd/txx
TLSH
T16A2733177D46CA26C0052EF9C8B7E7F5462BAC40E8922C5362587E6CF4F08D3DD929E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3780	stellar.exe

Loads dropped DLL 1 IoCs

pid	Process
5040	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	stellar.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Stellar\stellar.exe	msiexec.exe
File created	C:\Program Files\Stellar\Uninstall Stellar.lnk	msiexec.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DFE82B48718C8E861B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\{D7854084-51FD-4D25-8B3F-5548E7532FE8}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e5a28e6.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_1577632950\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_521983657\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\e5a28e6.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D7854084-51FD-4D25-8B3F-5548E7532FE8}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E64.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCC1BC0103E9160FB.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBDD025C44D4E4A76.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_521983657\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\~DFFC4C25C7C5073572.TMP	msiexec.exe
File created	C:\Windows\Installer\{D7854084-51FD-4D25-8B3F-5548E7532FE8}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e5a28e8.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_1577632950\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_1577632950\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3576_521983657\crl-set	msedgewebview2.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4672	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000f2192634d2a4d980000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838010f2192630000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841010f219263000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e30f21926300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e60f21926300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 37 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\DefaultIcon\ = "\"C:\\PROGRA~1\\Stellar\\stellar.exe\",0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4804587DDF1552D4B8F355847E35F28E\Environment = "MainProgram"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4804587DDF1552D4B8F355847E35F28E\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4804587DDF1552D4B8F355847E35F28E\SourceList\PackageName = "Stellar_2.0.7_x64_en-US.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4804587DDF1552D4B8F355847E35F28E\External	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4804587DDF1552D4B8F355847E35F28E\Version = "33554439"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4804587DDF1552D4B8F355847E35F28E\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4804587DDF1552D4B8F355847E35F28E\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\shell\open\command\ = "\"C:\\PROGRA~1\\Stellar\\stellar.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4804587DDF1552D4B8F355847E35F28E\PackageCode = "739D1B8F05E41D34286C41EC3BF4071C"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\stellarv2	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\stellarv2\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4804587DDF1552D4B8F355847E35F28E\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4804587DDF1552D4B8F355847E35F28E\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4804587DDF1552D4B8F355847E35F28E\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4804587DDF1552D4B8F355847E35F28E\MainProgram	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4804587DDF1552D4B8F355847E35F28E\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4804587DDF1552D4B8F355847E35F28E\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4804587DDF1552D4B8F355847E35F28E	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4804587DDF1552D4B8F355847E35F28E\Language = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\812181F64B4B79A53877A752AA655852	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4804587DDF1552D4B8F355847E35F28E\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4804587DDF1552D4B8F355847E35F28E\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4804587DDF1552D4B8F355847E35F28E\ProductName = "Stellar"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4804587DDF1552D4B8F355847E35F28E\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4804587DDF1552D4B8F355847E35F28E\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\812181F64B4B79A53877A752AA655852\4804587DDF1552D4B8F355847E35F28E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4804587DDF1552D4B8F355847E35F28E\ProductIcon = "C:\\Windows\\Installer\\{D7854084-51FD-4D25-8B3F-5548E7532FE8}\\ProductIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\ = "URL: protocol"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\stellarv2\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4804587DDF1552D4B8F355847E35F28E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4804587DDF1552D4B8F355847E35F28E\ShortcutsFeature = "MainProgram"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
252	msiexec.exe
252	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3576	msedgewebview2.exe
3576	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4672	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4672	msiexec.exe
Token: SeSecurityPrivilege	252	msiexec.exe
Token: SeCreateTokenPrivilege	4672	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4672	msiexec.exe
Token: SeLockMemoryPrivilege	4672	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4672	msiexec.exe
Token: SeMachineAccountPrivilege	4672	msiexec.exe
Token: SeTcbPrivilege	4672	msiexec.exe
Token: SeSecurityPrivilege	4672	msiexec.exe
Token: SeTakeOwnershipPrivilege	4672	msiexec.exe
Token: SeLoadDriverPrivilege	4672	msiexec.exe
Token: SeSystemProfilePrivilege	4672	msiexec.exe
Token: SeSystemtimePrivilege	4672	msiexec.exe
Token: SeProfSingleProcessPrivilege	4672	msiexec.exe
Token: SeIncBasePriorityPrivilege	4672	msiexec.exe
Token: SeCreatePagefilePrivilege	4672	msiexec.exe
Token: SeCreatePermanentPrivilege	4672	msiexec.exe
Token: SeBackupPrivilege	4672	msiexec.exe
Token: SeRestorePrivilege	4672	msiexec.exe
Token: SeShutdownPrivilege	4672	msiexec.exe
Token: SeDebugPrivilege	4672	msiexec.exe
Token: SeAuditPrivilege	4672	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4672	msiexec.exe
Token: SeChangeNotifyPrivilege	4672	msiexec.exe
Token: SeRemoteShutdownPrivilege	4672	msiexec.exe
Token: SeUndockPrivilege	4672	msiexec.exe
Token: SeSyncAgentPrivilege	4672	msiexec.exe
Token: SeEnableDelegationPrivilege	4672	msiexec.exe
Token: SeManageVolumePrivilege	4672	msiexec.exe
Token: SeImpersonatePrivilege	4672	msiexec.exe
Token: SeCreateGlobalPrivilege	4672	msiexec.exe
Token: SeCreateTokenPrivilege	4672	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4672	msiexec.exe
Token: SeLockMemoryPrivilege	4672	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4672	msiexec.exe
Token: SeMachineAccountPrivilege	4672	msiexec.exe
Token: SeTcbPrivilege	4672	msiexec.exe
Token: SeSecurityPrivilege	4672	msiexec.exe
Token: SeTakeOwnershipPrivilege	4672	msiexec.exe
Token: SeLoadDriverPrivilege	4672	msiexec.exe
Token: SeSystemProfilePrivilege	4672	msiexec.exe
Token: SeSystemtimePrivilege	4672	msiexec.exe
Token: SeProfSingleProcessPrivilege	4672	msiexec.exe
Token: SeIncBasePriorityPrivilege	4672	msiexec.exe
Token: SeCreatePagefilePrivilege	4672	msiexec.exe
Token: SeCreatePermanentPrivilege	4672	msiexec.exe
Token: SeBackupPrivilege	4672	msiexec.exe
Token: SeRestorePrivilege	4672	msiexec.exe
Token: SeShutdownPrivilege	4672	msiexec.exe
Token: SeDebugPrivilege	4672	msiexec.exe
Token: SeAuditPrivilege	4672	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4672	msiexec.exe
Token: SeChangeNotifyPrivilege	4672	msiexec.exe
Token: SeRemoteShutdownPrivilege	4672	msiexec.exe
Token: SeUndockPrivilege	4672	msiexec.exe
Token: SeSyncAgentPrivilege	4672	msiexec.exe
Token: SeEnableDelegationPrivilege	4672	msiexec.exe
Token: SeManageVolumePrivilege	4672	msiexec.exe
Token: SeImpersonatePrivilege	4672	msiexec.exe
Token: SeCreateGlobalPrivilege	4672	msiexec.exe
Token: SeCreateTokenPrivilege	4672	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4672	msiexec.exe
Token: SeLockMemoryPrivilege	4672	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4672	msiexec.exe
4672	msiexec.exe
3780	stellar.exe
3780	stellar.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4672	msiexec.exe
252	msiexec.exe
5040	MsiExec.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 252 wrote to memory of 5040	252	msiexec.exe	91
PID 252 wrote to memory of 3872	252	msiexec.exe	97
PID 4672 wrote to memory of 3780	4672	msiexec.exe	100
PID 3780 wrote to memory of 3576	3780	stellar.exe	101
PID 3576 wrote to memory of 4820	3576	msedgewebview2.exe	102
PID 3576 wrote to memory of 1444	3576	msedgewebview2.exe	103
PID 3576 wrote to memory of 1444	3576	msedgewebview2.exe	103
PID 3576 wrote to memory of 1444	3576	msedgewebview2.exe	103
PID 3576 wrote to memory of 1444	3576	msedgewebview2.exe	103
PID 3576 wrote to memory of 1624	3576	msedgewebview2.exe	104
PID 3576 wrote to memory of 5388	3576	msedgewebview2.exe	105
PID 3576 wrote to memory of 5388	3576	msedgewebview2.exe	105
PID 3576 wrote to memory of 5388	3576	msedgewebview2.exe	105
PID 3576 wrote to memory of 1220	3576	msedgewebview2.exe	106
PID 3576 wrote to memory of 1220	3576	msedgewebview2.exe	106
PID 3576 wrote to memory of 1220	3576	msedgewebview2.exe	106
PID 3576 wrote to memory of 1220	3576	msedgewebview2.exe	106
PID 3576 wrote to memory of 1220	3576	msedgewebview2.exe	106
PID 3576 wrote to memory of 1748	3576	msedgewebview2.exe	107
PID 3576 wrote to memory of 1748	3576	msedgewebview2.exe	107
PID 3576 wrote to memory of 1748	3576	msedgewebview2.exe	107
PID 3576 wrote to memory of 1748	3576	msedgewebview2.exe	107
PID 3576 wrote to memory of 1748	3576	msedgewebview2.exe	107
PID 3576 wrote to memory of 1788	3576	msedgewebview2.exe	110
PID 3576 wrote to memory of 1788	3576	msedgewebview2.exe	110
PID 3576 wrote to memory of 1788	3576	msedgewebview2.exe	110
PID 3576 wrote to memory of 5304	3576	msedgewebview2.exe	111
PID 3576 wrote to memory of 5304	3576	msedgewebview2.exe	111
PID 3576 wrote to memory of 5304	3576	msedgewebview2.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Stellar_2.0.7_x64_en-US.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Program Files\Stellar\stellar.exe
  "C:\Program Files\Stellar\stellar.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3780
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=stellar.exe --webview-exe-version=2.0.7 --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3780.3244.11091305513027061571 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:3576
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView /prefetch:4 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffa03285fd8,0x7ffa03285fe4,0x7ffa03285ff0
      4⤵
      PID:4820
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1808 --field-trial-handle=1812,i,180215029431882304,14923585699812174178,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
      4⤵
      PID:1444
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2208 --field-trial-handle=1812,i,180215029431882304,14923585699812174178,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
      4⤵
      PID:1624
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2128 --field-trial-handle=1812,i,180215029431882304,14923585699812174178,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
      4⤵
      PID:5388
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3324 --field-trial-handle=1812,i,180215029431882304,14923585699812174178,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493 /prefetch:1
      4⤵
      PID:1220
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3824 --field-trial-handle=1812,i,180215029431882304,14923585699812174178,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493 /prefetch:1
      4⤵
      PID:1748
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4284 --field-trial-handle=1812,i,180215029431882304,14923585699812174178,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
      4⤵
      PID:1788
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.0.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4980 --field-trial-handle=1812,i,180215029431882304,14923585699812174178,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
      4⤵
      PID:5304

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:252
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 83906555E4D677B12D8FD9796CB76C55 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5040
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3872

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a28e7.rbs

Path C:\Config.Msi\e5a28e7.rbs
Size 10KB
SHA256 4f3adee1ae7c60b45494491ef5f051d93bc549b3b3abb298627ca5c557a4779b
MD5 264bfdfa32ef80d76a1da2d63bb4fbfe
SHA1 b748d08bacccb85d44f9646d909bcbf064bc295d
SHA512 9d7d1d573dfbb44a5ac03a375f663bc25d255bcb01d65bb18ee792b2acbdcef193cb133e56ebf0d2ead3dfbbbcef42cb7324a5d2d9da8be16a5dc8b60ce68366
SSDEEP 192:OYZpws3Pev4V/FQOsJChucGmGXcGmZ40ifgZWXibEypIC:OYZpws/UHcGFcGjgIHC
TLSH
T10E222042B70882E3E9961738CB031321BBA2D7CD4B16139B49CE96721E4778D5FB53DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stellar.exe

Path C:\Program Files\Stellar\stellar.exe
Size 29.2MB
SHA256 3e72de9a8f44f5b58819d0fea32590352d219f74c39abc286e6572e822b94cf1
MD5 92bf4322c6d7b3b23d7dd096186c3456
SHA1 4e25c33d6e6d46684614eee767c8a2a052782d2e
SHA512 d2d155506e73ac66c93afa6a94f12dab4bc49b50095f7d136e6ae4ae00ccf4d1f23bffa842ef82c7c63e6000288c4b1cbb363c3780bee2778d59aa6be8aab9d3
SSDEEP 786432:rYJLqufWkoKZu5sfW2eLrR+QUv9Nm124:r+PZiSW2ep+QUVk24
TLSH
T1B667AE157B5B99ACD18BC8B083474A630E2174DB1A36B9EF44C462393F7DBF46F28219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Stellar.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Stellar\Stellar.lnk
Size 1KB
SHA256 f6bede251b874eccec815301ca9c30125b809f6c46a98c6afff0e2a95f90fde2
MD5 cf2c2f2558446210d83902b7ddea99d6
SHA1 b9a500b6fb3932bde113e3c650bc3888ebce155a
SHA512 5f5556d23ee4d92ca23ca3e505b98a3e0dc6be5a3a531b786b83eae2103e018f008efb7c180e1b222fafc0d02fb9c2e3af0fc356022223de179ae0581d1dd1bb
TLSH
T16741AD1053D60716E3B38739BD729AA1C631BC12A5254F3F82C7408E0C75140AE6DF6F
MD5 SHA1 SHA512 TLSH

Submit Download

Stellar.lnk~RFe5a31ee.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Stellar\Stellar.lnk~RFe5a31ee.TMP
Size 1KB
SHA256 345991bae2229611b2ed8e8dc05f78b99b0f4ff7f17612b2b954165b9f3a14aa
MD5 3c87f66ecd6569032b09733a8ae2e9c4
SHA1 ac1886935a13cded2388460400f5b774c10d9ac4
SHA512 7d7ed45815ed5c913572f9f105dae961b60a3acd46a908b339605899d68e5c55c35a4829091773632d873d77142c5ac5625c2f322277a5969aeaa5be993dc4c3
TLSH
T1AA419E1417E50727E3B38739BD629AA1C671BC1296255F3B81D7048E0875240AE6DF6F
MD5 SHA1 SHA512 TLSH

Submit Download

MSICC30.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSICC30.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 39b7ae643161611bb6114c475c68a399aa7c037a105665c3a9a4fbe7d24b210d
MD5 aa381e049b2501263e8640c9691db124
SHA1 9088235f056467b590bf2c9ae636d00591de1e8c
SHA512 d94bf8d9bd52056fbacc07503ed721b8ffe1b47941ea51e26876f0611af094eddf38fa8033466d95b850fc5852b2653b3b3771568274a02aaa917267ce95cc31
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 60be3be34539e520c98fcb39b09546b3144ea86de071a8c1004035391e3b9214
MD5 531b8eb349356551e88ff0cfb7f47c53
SHA1 3e4390be1284b4a1d9cc73eaf8b8c0a7a5fc69e4
SHA512 1d089b8aa5ffd41cd8ac6ed623309de9be19b5edaad36a9541791403a5f749255fa4d7d839f7c70366d23988746ca036de913550ee30b37c5af33e8e25891717
TLSH
T1C4D0241377C54134C03130333443710D0F01D11F41054401543DCD1D3F040500F13443
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

67411cf7-b4c6-4507-8292-cb0b82f9c1ef.tmp

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\67411cf7-b4c6-4507-8292-cb0b82f9c1ef.tmp
Size 6KB
SHA256 9b3c6c1440fea9313bcd232c1df80c1aa3eb64cac12cfbf4fb3102bdcdbdbfab
MD5 596e0e7b6890170c84290443097590ec
SHA1 8852354fb97358dde5a8a1f2bd362531dc1e5802
SHA512 856f9bcae264ce1835bbcac3373c4072fae5ce405801ef835abeb1f33612318ce29d19ab058f3ba4696bc6103ed07c1edf09553a742dadaf289f7110cbbbfc86
SSDEEP 96:st//dyav69b9GkWo5h16Z0Os7/x+6MhmuecJqm2YMkkjeAK+gqa28XM1C7K:stHLzhonOsV+Fdqm2YwjkYaG6K
TLSH
T1FCD196065E2469BB4CC6E509FB397E47E2F96032A5D52E58E7F8861C04EB6DC6307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Cache\Cache_Data\f_000003
Size 1.8MB
SHA256 88d83e5451117dedbc3daf82fdc947108f37ca24239e7bf59975bbeb589463df
MD5 9fcd44601adbc3b4b674332a672525cc
SHA1 ba2ac86618fea3c058a98b3fa8284d0c7c25f73b
SHA512 63f776cc7e27f11f232145cfd6c7e52f84fb352a93fb4213785f1a4389b87d9e3f9c218b472e195b0b7fd2f3fa38a7265545576ca2de4296d1fd24afe4e396c2
SSDEEP 49152:taBFrAL3VR/jKQ+n7YBibdvobIURpVfRF64Og:twsLlFKvYBSdGIEpDog
TLSH
T1F68533A0AFDC9F397D57A81745022C8E4AE23B90F9258AC2D476C4E4752CB652F6C7CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Cache\Cache_Data\f_000004
Size 683KB
SHA256 83ae56bee1833fd3190fa5d49098759520dcbca48fb9b358c88c6d1ef4f14acc
MD5 a4e733292c70b0bc1071417a1a6d629e
SHA1 fbdcc285657affd7aa56117041bb597271830f1f
SHA512 f45be5bfd54dc86500eb70e9d293b7d23182b073d4c7061ce523270649eac472e42d14fa03bc7198910d35f837b0c9956188aab6bf5548bd657516a0b940db5b
SSDEEP 12288:G4w22UCsoeIx8ocXJJrLMglZnSgI5eSXt7gN2TrFuJWZf08YUv56:nw2bseItcXrLMgMUSXVS2gMzJ56
TLSH
T133E433362614C4BC7298F4B522FFA15969BC64B01F3764F3E669A08C5F4B411DB28CF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Cache\Cache_Data\f_000005
Size 314KB
SHA256 ed79a04c5ea00f1063ef7ec7e9858f38811e437229fa92608096a47a409b841b
MD5 e57b46111243862f892bbcf5d9f73f7c
SHA1 d56bcfd994589f147a9080819edda29ef7712b5f
SHA512 4cf6cfc8e8f0183211d1ae433fba984e9a8588a5a79bb258cf921c36b0e8c3fc8f0269488a0d0b0cbbbbf88f3eaececbdacc65434d58559cfbcdbfcb880e685b
SSDEEP 6144:n1tt3Sm+SdnNJ7tgIZBcgxTb/oDAxiUSiEjNEvllktpYz6noKUNbb3Cb86f7:n1td3+S5N7RugxTb/oE8jSqy6op3cp
TLSH
T1866423D7278073B22756042ECF2A8AEED19B328C52D1B0CA150B6DC25E4DFED9D918DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Cache\Cache_Data\f_000006
Size 538KB
SHA256 53c7b1d6f3e52f2c3f4d604908a899957f57dd59e5121fa8c2d2ee9dffa6a4b6
MD5 d3d0031e1e2ad5e53c42bcf7726e9221
SHA1 c9e584bb103ee069d052886cecec7093f1a14103
SHA512 596be7296772c99bf8b8865af68f176ad98411b3d52cf288174569cb073424de711e66988f90e17af1c7eab5ed3cecd62db2c48a8b216148ef9d5217d724cc8a
SSDEEP 12288:89FC5NQXK/quPoj40JMHDapZL+02ki2avKfWQFZdFN9G:8DeG6/p+XZ+0Y2agjZhU
TLSH
T1F4C423DAC3E7A078C996FDAC9AE50C410EF3735407A08B26E16BD062E9458345FE4F98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Cache\Cache_Data\f_000007
Size 536KB
SHA256 b04ba884bb48a983d859d5d929e18dff53afa6c72fd9b52e030a03259785372d
MD5 d5c6c81a4150ce4370bae41c9f384195
SHA1 38ae62399f57656fc1df27bf21e0bc12097d39a7
SHA512 b4e9703c2d850ed39670285e1e3bb8e5a7d4b584c48e09649c63f29c09dfc0a41f341a8dfda062b21efa7c5699863861c40fb6b22a4e1025ea71323d39b2afbd
SSDEEP 12288:hjTkoox6rQvKpP/uxwTlPDCh+VE25Pc37sC:hnNoEQCBEwTlL6+Vt5Pc3z
TLSH
T1CAC423C0E5C56BFA08659B25B9CF0F841FA8C6F07781FD7A953F8067F84469A185348B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Cache\Cache_Data\f_000008
Size 57KB
SHA256 6a239b6cd82b9e19dbf907fbaf2b15dd1126197f9522bc42c28c9d91948ba773
MD5 b6e1d1b3c30aa36ada12ad943e5c5d2d
SHA1 a05621d2989da0f71a425576f67a954444ee5a08
SHA512 b7271d0f047daadb0fb716144a1f64d7101045320f679f452eb7a629f37f2d8c1a5ccc06ef3f387141ba6c3127798a4f647aa4471cc53eec48b5d021f4a6f39d
SSDEEP 1536:C1gsrC/vm9b4pC8heE4wmG5nhGvER9CWSYMD:UgsrmmNuC8h0G5hVR8WjMD
TLSH
T17E438C035D16AE83A53583ECBF039CAC9BA4371CFA9235DA1A63DED33C20115AC9D579
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 758948852a4d510253b42c98df2aaecc112e559f00f24543dee0441edba27fcc
MD5 d0fafd23a4e1190005a48f1bf56ad49c
SHA1 75c09d0044ce3e4dad42a5fcca66980c4b50e6f7
SHA512 2f6e4f719136922a76f27e465ad58793f99ed7f05c230981696bb235db794c145daf4fd7535d1abf64e0ec10571ddb2f9a233ef51441724a302fe35e6ca3b532
TLSH
T127A002188AD938A3E545237118C541443F30DF350383569155E0617E8C603805946081
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5aaeb0.TMP

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5aaeb0.TMP
Size 48B
SHA256 115efbdcdf6912d66589e5b762f8acd3e5ec1615ddb6bd95f9da10b37057c7d0
MD5 9b8a350a4194de1d08e4e1dbd08a057d
SHA1 322f8754358c022e0578534b67b37605f0841790
SHA512 e967b4940a5650f5a9ac43e18810e75415776c9ddbd2b36f9d16cc320ebeecefc9922ab58cf81109ad61d4a0cfd8dbf92354d7123920125727b6a97bf78d8c2e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 07a5083bfbd3982fbaa04983a48931f597728fd653f373566e820460669d355c
MD5 87af3fb45d1c7ffcf4bcd812eeb253b5
SHA1 6300acdea85bb73d15513eed8073162cc349e60a
SHA512 8bfeed84ca12b09eb8d746a620d80200eac852c9532e0b5e0d27cc1926838a6b90a4f63c3742ccdeb1372bf262a18e6834e433d27ec71c7190825e7c8ac9ff28
TLSH
T1BB4192A2C3E4C66D895566E467343817CC2E061DA2283D27CDDBEBDB6BD2471E32160F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5b70c7.TMP

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Network\Network Persistent State~RFe5b70c7.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 8b82ddba8f358faab3f38860cc159b79ad0e5cf3a6f6c890b091ca428d55552f
MD5 55f284d2976ebd41ba3247264b0d7421
SHA1 04d287a3e907a61066bec1e818255696030f9699
SHA512 44b6f8fd19fe7889782ff6b8ad57600d01066d99c0d9ee03d4a58b261ea9da95403d208dbaeeaf3dd7b70ed5bfc8ef1075aa89d0a5b38b49cff3d78faae7f935
TLSH
T144E020DF42BEA47B102C1DB608847C591F7BA571479168E4DB57447C70806F75613426
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5ab70d.TMP

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Network\TransportSecurity~RFe5ab70d.TMP
Size 356B
SHA256 4dcecb6432670a97b69b752b83182ea43ce675c858def4a9acd4f781c740c816
MD5 51604cecdd7e6bf9e8dbd0edf4bd7181
SHA1 58490a15a3189a025596d622d38303e893433a01
SHA512 c3e618f97b72a5555f44b3b39025ef1553c752f5be774d20b072eeaeb7ded02e66ab26925eb53e5d421acfb97b95b3e5af1b721abad88d19b37884ba0aaed9f2
TLSH
T1D1E020DB43BEA437102C0DB609807C5B1BB6A53047A158E4D657457C70C16F75647426
MD5 SHA1 SHA512 TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Site Characteristics Database\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Local State
Size 3KB
SHA256 072573d2dc5307aa95355806e3fc6eabafd042196ef6c35332e64615fa410651
MD5 821965b08ec11c1419dc4f85a1e53fb1
SHA1 0149fe0019bd037d5f5b88358424f17a3447db57
SHA512 691f7c20cdb45cdf352f229ae1cc64b66b24812ced0c16ec37b9c52f4b5e2ad13511d80c38abd4b5b00d705567b05e9b6436678d39168ea2d26adcc8e79046aa
TLSH
T11461773B6974AA774EF29A05F98A3F066B699023EA957F55C6EC0F0C01D729C1342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Local State
Size 15KB
SHA256 b28419f26fc67b2c8f6b2fb1cff95a8ade3e8f7861230b202458351a3a066057
MD5 6604b1c57b5c57d9116080d89540def6
SHA1 38a3db99b73f2774767e8b16e884a332287db8c4
SHA512 6e3c0d1533d8555d247870a8e3274713ba8ef344a05e56337a2e5801c4287fd3162e7edf3672abb9a2a2efcfb91f5afed2fced7fd32ca1922633419362c12bfd
SSDEEP 384:If+aQikB+z/xvxjg/qhEkNBSnxpTTisd8i9z7:L/UxvxjgC+FVTisvF7
TLSH
T1EE729E3B59793E239AF2EA007A5D075BDBB89472D5C27E748AED5F0D06C32E80342C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Local State
Size 2KB
SHA256 6525b62f42dee2b38566dbef74b66cba92b22da92acbfc7b009c59bf7b746e7b
MD5 67d10d689fff78b9aeb63cdd43f4fac1
SHA1 b6d507472cd1b0200370eff0446b547739408d25
SHA512 e041286135a472c02942c565673b0fec571042a6e1ba4e0d46203601112c80cd6d789853a7c3612549c2560f30a752872eefc2c9d1f8aad81fd6c2f9c3dcf02a
TLSH
T1D25163776924ABB78EF25608BA4A3F138E399062EFA53F10DADC0B1C01D756C1342C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5a5a85.TMP

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Local State~RFe5a5a85.TMP
Size 1KB
SHA256 c761f3748048e844ae7286537c5ad2e74596ea9441cec4ae22af31776423ccf4
MD5 f908e7c26d67c9abbe65ec51aecfa564
SHA1 ee253574dbbdc07a1dfd197d130b98d36e50b518
SHA512 0d8de6ee90a45b316e212b2369ccc58f62bf4b6acec33ca2f72b26076d1fc5d2287588ecc153e945e3e45e5748c56ae9820d239aba1148ce0ec47e63e485b42c
TLSH
T12A2165B7D5B45FB35EE12246B2193F071E249067D354AF0095DD8B1801E315D9366D32
MD5 SHA1 SHA512 TLSH

Submit Download

e5a28e6.msi

Path C:\Windows\Installer\e5a28e6.msi
Size 19.7MB
SHA256 e005d0e59cfbf34e692ad849caa7eb4ca1895ace79b1ffd5a289ad87d358e292
MD5 7c7ab4d27ce35a416cf14842d6e3aa1c
SHA1 ee36b5c9f8b25a309e2a2c35c5dec8baae72e52f
SHA512 91e7da3d41e112c3cbb24b5e29fda52c420397ffdd3e2b2703e615fb9f0f69bfbb0f4a29c642f6872145e3ca1c28c263372810656f80ed022ac23a30ea730477
SSDEEP 393216:yc821BcGfNfOYbpbY0/NdSh0kkzo32uQ0nNiDwgFQfF/DJxYyN:ychjc6ROYL/NdShbkzo3X4kgFQd/txx
TLSH
T16A2733177D46CA26C0052EF9C8B7E7F5462BAC40E8922C5362587E6CF4F08D3DD929E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 7f17c9eca0253aa57d42b63d246a50caffb448e352a3a31801650364be8219cd
MD5 8b4e909f81b6dbec8f8fed69f43d3d81
SHA1 6e4b4139733a5a9b1435957ed6fc445283fafc1a
SHA512 c3b0dcc7e4ae49c07632986f251b27a1ba4cccbd8281ce8714c31637b1e27672ddee5569822066a18c58c0c594cf50757831db6905e08fe62c9fa05d541b6951
SSDEEP 24576:eFo3DMPydoO/vvTL/SwJpilgfrejy7uKkkP7tknB/MnqZeIZ8YhWJwz4NuR:9HQ
TLSH
T1A657F71836F92110F7F79E3CA8F0AA2749397D5B9C15DE8D45811B8E0821F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{98a88d7e-bdb2-472f-bf29-6e4c9df3609a}_OnDiskSnapshotProp

Path \??\Volume{6392210f-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{98a88d7e-bdb2-472f-bf29-6e4c9df3609a}_OnDiskSnapshotProp
Size 6KB
SHA256 16a802c7f344c93527faa1bc70c690625df4c5194ce2ebc5d139f2d6fd32b1d3
MD5 62abea13fe4a03c15a4c566eca8c1205
SHA1 8a6d33322aca401ea50ff1b893935e6a7bd67333
SHA512 101cf0efa046dd195cd161e46711caaa9b1457fddee86f439e4785a37454cfce9f961248bb2a65e6e5d51aae829800252471f7e14939a2399db7ec5d3b6588c2
SSDEEP 96:FZkbgvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:zzb++uVm
TLSH
T1F9D166085AE54711E2F3AB3128F18557A877B911EF33CB8E0298238E6671910F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1220-87-0x00007FFA26F70000-0x00007FFA26F71000-memory.dmp

Download

memory/1444-66-0x00007FFA26F70000-0x00007FFA26F71000-memory.dmp

Download

memory/1444-241-0x000001D3EFF10000-0x000001D3F00D3000-memory.dmp

Download

memory/1444-271-0x000001D3EFF10000-0x000001D3F00D3000-memory.dmp

Download

memory/1788-314-0x000001C308DC0000-0x000001C308DEF000-memory.dmp

Download

memory/1788-302-0x00007FFA27260000-0x00007FFA27261000-memory.dmp

Download

memory/1788-303-0x00007FFA26E60000-0x00007FFA26E61000-memory.dmp

Download

memory/5304-358-0x000002131EC80000-0x000002131ECAF000-memory.dmp

Download