a01e0a93fb7f723727b14175fc78cdbad71c5e5450cd785963143f00bc652e5d

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Stellar_2.1.1_x64_en-US.msi
Size 19.9MB
Sample260820-txblea1cma
SHA256 a01e0a93fb7f723727b14175fc78cdbad71c5e5450cd785963143f00bc652e5d
MD5 9bb70d9b2ac6a80d24c5b92ccff83e9d
SHA1 eb81a85611c85bfa40724a5d44f4b18b0e211586
SHA512 acc9f633e9e8fad6f0366dbf0d3f1bb605a0939e6d37da0b92c834c51db27ffe3db4fe65d00b21767c4a298410dc162ab2e0dd7f50e1c62109e8ce2f423bbf42
SSDEEP 393216:vwz0ObTMXojxhVCQbyHEVlWGIIu13dStThWP/62RoEcLQ5+d0qcMAPBi/:vyTbQXuVCjHQYV9QThWn6goE35La
TLSH
T10D27330B3E06CA16D4262EF8C87BE7F5412AAC04D8525C131365BB5DFAF08C7EE915E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4072	stellar.exe

Loads dropped DLL 1 IoCs

pid	Process
3068	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	stellar.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Stellar\stellar.exe	msiexec.exe
File created	C:\Program Files\Stellar\Uninstall Stellar.lnk	msiexec.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_281714701\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_281714701\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_281714701\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\Installer\e59b22f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59b22f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAF33F1CE05C684FF.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBB09B5BC2485019C.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_1176746300\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_1176746300\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF789A500BE7991FE.TMP	msiexec.exe
File created	C:\Windows\Installer\{7A2CB71B-FA8F-4518-99D8-F53A7A5A34C9}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e59b231.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_1176746300\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_1176746300\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_281714701\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\Installer\SourceHash{7A2CB71B-FA8F-4518-99D8-F53A7A5A34C9}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB7CD.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_1176746300\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_281714701\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_281714701\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\~DF87DEDA9EBDD5790E.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\{7A2CB71B-FA8F-4518-99D8-F53A7A5A34C9}\ProductIcon	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4416	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000940e18cbc83cc7300000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801940e18cb0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101940e18cb000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3940e18cb00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6940e18cb00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 37 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B17BC2A7F8AF8154998D5FA3A7A5439C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B17BC2A7F8AF8154998D5FA3A7A5439C\ShortcutsFeature = "MainProgram"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B17BC2A7F8AF8154998D5FA3A7A5439C\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B17BC2A7F8AF8154998D5FA3A7A5439C\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B17BC2A7F8AF8154998D5FA3A7A5439C\External	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B17BC2A7F8AF8154998D5FA3A7A5439C\Version = "33619969"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B17BC2A7F8AF8154998D5FA3A7A5439C\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B17BC2A7F8AF8154998D5FA3A7A5439C\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\stellarv2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\ = "URL: protocol"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B17BC2A7F8AF8154998D5FA3A7A5439C\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B17BC2A7F8AF8154998D5FA3A7A5439C\MainProgram	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B17BC2A7F8AF8154998D5FA3A7A5439C\PackageCode = "49919209B2A94DB48814DE10360F9614"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B17BC2A7F8AF8154998D5FA3A7A5439C\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B17BC2A7F8AF8154998D5FA3A7A5439C\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B17BC2A7F8AF8154998D5FA3A7A5439C\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\stellarv2\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B17BC2A7F8AF8154998D5FA3A7A5439C\ProductName = "Stellar"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B17BC2A7F8AF8154998D5FA3A7A5439C\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B17BC2A7F8AF8154998D5FA3A7A5439C\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\stellarv2\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\shell\open\command\ = "\"C:\\PROGRA~1\\Stellar\\stellar.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B17BC2A7F8AF8154998D5FA3A7A5439C\Environment = "MainProgram"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B17BC2A7F8AF8154998D5FA3A7A5439C\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B17BC2A7F8AF8154998D5FA3A7A5439C\ProductIcon = "C:\\Windows\\Installer\\{7A2CB71B-FA8F-4518-99D8-F53A7A5A34C9}\\ProductIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\812181F64B4B79A53877A752AA655852	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B17BC2A7F8AF8154998D5FA3A7A5439C\SourceList\PackageName = "Stellar_2.1.1_x64_en-US.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B17BC2A7F8AF8154998D5FA3A7A5439C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\812181F64B4B79A53877A752AA655852\B17BC2A7F8AF8154998D5FA3A7A5439C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B17BC2A7F8AF8154998D5FA3A7A5439C\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B17BC2A7F8AF8154998D5FA3A7A5439C\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\DefaultIcon\ = "\"C:\\PROGRA~1\\Stellar\\stellar.exe\",0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3424	msiexec.exe
3424	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5192	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4416	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4416	msiexec.exe
Token: SeSecurityPrivilege	3424	msiexec.exe
Token: SeCreateTokenPrivilege	4416	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4416	msiexec.exe
Token: SeLockMemoryPrivilege	4416	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4416	msiexec.exe
Token: SeMachineAccountPrivilege	4416	msiexec.exe
Token: SeTcbPrivilege	4416	msiexec.exe
Token: SeSecurityPrivilege	4416	msiexec.exe
Token: SeTakeOwnershipPrivilege	4416	msiexec.exe
Token: SeLoadDriverPrivilege	4416	msiexec.exe
Token: SeSystemProfilePrivilege	4416	msiexec.exe
Token: SeSystemtimePrivilege	4416	msiexec.exe
Token: SeProfSingleProcessPrivilege	4416	msiexec.exe
Token: SeIncBasePriorityPrivilege	4416	msiexec.exe
Token: SeCreatePagefilePrivilege	4416	msiexec.exe
Token: SeCreatePermanentPrivilege	4416	msiexec.exe
Token: SeBackupPrivilege	4416	msiexec.exe
Token: SeRestorePrivilege	4416	msiexec.exe
Token: SeShutdownPrivilege	4416	msiexec.exe
Token: SeDebugPrivilege	4416	msiexec.exe
Token: SeAuditPrivilege	4416	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4416	msiexec.exe
Token: SeChangeNotifyPrivilege	4416	msiexec.exe
Token: SeRemoteShutdownPrivilege	4416	msiexec.exe
Token: SeUndockPrivilege	4416	msiexec.exe
Token: SeSyncAgentPrivilege	4416	msiexec.exe
Token: SeEnableDelegationPrivilege	4416	msiexec.exe
Token: SeManageVolumePrivilege	4416	msiexec.exe
Token: SeImpersonatePrivilege	4416	msiexec.exe
Token: SeCreateGlobalPrivilege	4416	msiexec.exe
Token: SeCreateTokenPrivilege	4416	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4416	msiexec.exe
Token: SeLockMemoryPrivilege	4416	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4416	msiexec.exe
Token: SeMachineAccountPrivilege	4416	msiexec.exe
Token: SeTcbPrivilege	4416	msiexec.exe
Token: SeSecurityPrivilege	4416	msiexec.exe
Token: SeTakeOwnershipPrivilege	4416	msiexec.exe
Token: SeLoadDriverPrivilege	4416	msiexec.exe
Token: SeSystemProfilePrivilege	4416	msiexec.exe
Token: SeSystemtimePrivilege	4416	msiexec.exe
Token: SeProfSingleProcessPrivilege	4416	msiexec.exe
Token: SeIncBasePriorityPrivilege	4416	msiexec.exe
Token: SeCreatePagefilePrivilege	4416	msiexec.exe
Token: SeCreatePermanentPrivilege	4416	msiexec.exe
Token: SeBackupPrivilege	4416	msiexec.exe
Token: SeRestorePrivilege	4416	msiexec.exe
Token: SeShutdownPrivilege	4416	msiexec.exe
Token: SeDebugPrivilege	4416	msiexec.exe
Token: SeAuditPrivilege	4416	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4416	msiexec.exe
Token: SeChangeNotifyPrivilege	4416	msiexec.exe
Token: SeRemoteShutdownPrivilege	4416	msiexec.exe
Token: SeUndockPrivilege	4416	msiexec.exe
Token: SeSyncAgentPrivilege	4416	msiexec.exe
Token: SeEnableDelegationPrivilege	4416	msiexec.exe
Token: SeManageVolumePrivilege	4416	msiexec.exe
Token: SeImpersonatePrivilege	4416	msiexec.exe
Token: SeCreateGlobalPrivilege	4416	msiexec.exe
Token: SeCreateTokenPrivilege	4416	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4416	msiexec.exe
Token: SeLockMemoryPrivilege	4416	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4416	msiexec.exe
4416	msiexec.exe
4072	stellar.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4416	msiexec.exe
3424	msiexec.exe
3068	MsiExec.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 3068	3424	msiexec.exe	90
PID 3424 wrote to memory of 5884	3424	msiexec.exe	96
PID 4416 wrote to memory of 4072	4416	msiexec.exe	99
PID 4072 wrote to memory of 5192	4072	stellar.exe	100
PID 5192 wrote to memory of 3308	5192	msedgewebview2.exe	101
PID 5192 wrote to memory of 2732	5192	msedgewebview2.exe	102
PID 5192 wrote to memory of 2732	5192	msedgewebview2.exe	102
PID 5192 wrote to memory of 2732	5192	msedgewebview2.exe	102
PID 5192 wrote to memory of 2732	5192	msedgewebview2.exe	102
PID 5192 wrote to memory of 3412	5192	msedgewebview2.exe	103
PID 5192 wrote to memory of 5788	5192	msedgewebview2.exe	104
PID 5192 wrote to memory of 5788	5192	msedgewebview2.exe	104
PID 5192 wrote to memory of 5788	5192	msedgewebview2.exe	104
PID 5192 wrote to memory of 1132	5192	msedgewebview2.exe	105
PID 5192 wrote to memory of 1132	5192	msedgewebview2.exe	105
PID 5192 wrote to memory of 1132	5192	msedgewebview2.exe	105
PID 5192 wrote to memory of 1132	5192	msedgewebview2.exe	105
PID 5192 wrote to memory of 1132	5192	msedgewebview2.exe	105
PID 5192 wrote to memory of 2536	5192	msedgewebview2.exe	108
PID 5192 wrote to memory of 2536	5192	msedgewebview2.exe	108
PID 5192 wrote to memory of 2536	5192	msedgewebview2.exe	108
PID 5192 wrote to memory of 1412	5192	msedgewebview2.exe	109
PID 5192 wrote to memory of 1412	5192	msedgewebview2.exe	109
PID 5192 wrote to memory of 1412	5192	msedgewebview2.exe	109

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Stellar_2.1.1_x64_en-US.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Program Files\Stellar\stellar.exe
  "C:\Program Files\Stellar\stellar.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=stellar.exe --webview-exe-version=2.1.1 --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4072.4536.17127011309160259972 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:5192
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView /prefetch:4 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x148,0x194,0x7ffe6b1a5fd8,0x7ffe6b1a5fe4,0x7ffe6b1a5ff0
      4⤵
      PID:3308
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1776 --field-trial-handle=1780,i,7868255255467619706,15481296452023857307,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
      4⤵
      PID:2732
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2092 --field-trial-handle=1780,i,7868255255467619706,15481296452023857307,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
      4⤵
      PID:3412
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2308 --field-trial-handle=1780,i,7868255255467619706,15481296452023857307,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
      4⤵
      PID:5788
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3276 --field-trial-handle=1780,i,7868255255467619706,15481296452023857307,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493 /prefetch:1
      4⤵
      PID:1132
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2088 --field-trial-handle=1780,i,7868255255467619706,15481296452023857307,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
      4⤵
      PID:2536
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=stellar.exe --webview-exe-version=2.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4696 --field-trial-handle=1780,i,7868255255467619706,15481296452023857307,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
      4⤵
      PID:1412

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2F36D2A27A8320A54D0FB1BA36C6D0EE C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3068
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5884

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59b230.rbs

Path C:\Config.Msi\e59b230.rbs
Size 10KB
SHA256 58886c96aaa7df2a8ec996f83cb25895cfb2c13812bf909a63aecc6a6b5ae6cb
MD5 fe7af80122602e656d60e695a93a5d2d
SHA1 0345f61a76170fbd4564c36f04badf837a82646e
SHA512 bf0c6edf2f572ede730ade45069fcc64eda4666a89f91f2052013986c229943c157218e71ec5df01bd21928451c1585ae9ccf8788c5d4e01d626b9ac06a97f43
SSDEEP 192:nTl6Tv3keo4V/FQOsJCuLk3GFk3eWd1O9JW8ir+pJ:nTl6TvUDrkAk0Ys
TLSH
T192224086B74183F2E85A4B39CB4B2B313BA2D3CAD305531B5ACD94716F437851B9928F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stellar.exe

Path C:\Program Files\Stellar\stellar.exe
Size 29.9MB
SHA256 8fab8e24eabd250b6dbcc5b58075ec480d8ca949e6e5a065c792230ff50cce8a
MD5 418ce4fa4861979a55f9d64bbb8792d9
SHA1 ac7f4a450f21adc03481728780790ea5598ed30b
SHA512 8d4fd9858446fb65b665c82fac0a521868e03e31e9576fbff92c0a6a09e93565e718ad6aeb97ef38e3199f8dc084b3ae16fa6a63bddc1497a30ed1cada34916f
SSDEEP 786432:IX8pL/tZEVw+Hcs8zObxjLQUv9Nm1LEPE4+:uFwGcjabxjLQUVkLEt+
TLSH
T1FE679D117B5B99ACD18BC87083474AB30E2174DB1A36B9AF44C462393F7DBF46F29219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Stellar.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Stellar\Stellar.lnk
Size 1KB
SHA256 81b7eff1183bc8295b4742fb6dc532823facbdb19516387113f2cf0682b30a72
MD5 94f4d89f1921ff26129878c6d166a0aa
SHA1 cba578cd6b5f10f34b7460d5b172a452501a5a35
SHA512 50ed96d08ee8879fd37861aa339fb557ec36de1d9708c69b599194b864cca5cb78b1cca9b2d5881dbdb5219a4272aebbb09f564ec08d1e658f771508d436af09
TLSH
T10441BE106BD6173AF2738A397E615E664771BC12A6614F2F458640CE1CB4001A5E5F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Stellar.lnk~RFe59bb28.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Stellar\Stellar.lnk~RFe59bb28.TMP
Size 1KB
SHA256 de491e3db01da72b011b7e53c287b781bab8ca54590c2bb4b8b2143540764463
MD5 53f9bae85f90fb9797e7726aaa9c7359
SHA1 5430261362954524cd4143f7d13ffba3149fc46c
SHA512 62df62d8db6426ffec0db87b03894cb3714ea43136f319a0526b098f3198ff7ad34b0091884c33c24baf0ea4a31aa9ced5a722ff8e1c3857be2403309093824b
TLSH
T13941DF206BD6173EF37386397E615E668772FC12A6614F2B458640CE08B4001A5E5F5F
MD5 SHA1 SHA512 TLSH

Submit Download

MSI5A8A.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI5A8A.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e849a5e5abcf0fc3b2fa9417902f96c1c219fb036fb635a80e1a461fab363d07
MD5 212eb6de0304b0bd059ac3977b60945d
SHA1 2963220c08e5ac33456a0767bb899e176b1f70fe
SHA512 0b0030a3391ca4fb4340a39460ef316b3eb6b0a3b363eeee0c279459a167b9878964faed1b0175ad122773a12dc1e898dec4e8b2651a85a6c2e3bb5725e562aa
TLSH
T1AAD00430D3411C11D30311F5171153D015145C11030703055130117404C04011455041
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f30cbc1f87c9f9342e012392471e01971ceaa2ffc64ba4fe9084925e17a87996
MD5 8a8a8a3427ae9c90dc75ba2562398dc2
SHA1 cdbdfd7e575985e64e7ac441f9a43a206206222c
SHA512 290e833189579de7fac029f8f6079168541ef388e790bf5abc97307da6246122cfa8e576c8d266bd76ff14ac1727aec83be918d7ff422859b513b88164d39f34
TLSH
T116D0122273420934C11121B3160372881800D51B420A4105A438967D1A444501D16482
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

263997be-5a95-4601-ba9f-1205ff2f6bff.tmp

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\263997be-5a95-4601-ba9f-1205ff2f6bff.tmp
Size 6KB
SHA256 0c37ca3f8e1f49faecc5033742c7e7c5d3b958eb37aae38b5a4d454ec5667926
MD5 795c5accddbee6e193dfb1253f32109e
SHA1 5d1d337ecb0ca5e163e5b03efb8d0841c55c4af4
SHA512 2fd4d8a4ecccaf8f557c60bb08d7fc05fc58d140c47638ead70454cfe6f792e1c1064f0d570d7b0c7cde5bca94fb22f11897e8a9f6754928756575862b8e1e5e
SSDEEP 96:stB/dY8R4b9LkMo5h16Z07s7/x+6MhmuecJg/1eje8K+go528XM1C7K:st1at3on7sV+Fdg/Qjw65G6K
TLSH
T1BED195426E2479BF4CC6F109BA69BA07E3F5607260D51E58EBF9462C04DBADC2317D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Cache\Cache_Data\f_000002
Size 1.8MB
SHA256 88d83e5451117dedbc3daf82fdc947108f37ca24239e7bf59975bbeb589463df
MD5 9fcd44601adbc3b4b674332a672525cc
SHA1 ba2ac86618fea3c058a98b3fa8284d0c7c25f73b
SHA512 63f776cc7e27f11f232145cfd6c7e52f84fb352a93fb4213785f1a4389b87d9e3f9c218b472e195b0b7fd2f3fa38a7265545576ca2de4296d1fd24afe4e396c2
SSDEEP 49152:taBFrAL3VR/jKQ+n7YBibdvobIURpVfRF64Og:twsLlFKvYBSdGIEpDog
TLSH
T1F68533A0AFDC9F397D57A81745022C8E4AE23B90F9258AC2D476C4E4752CB652F6C7CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Cache\Cache_Data\f_000003
Size 683KB
SHA256 83ae56bee1833fd3190fa5d49098759520dcbca48fb9b358c88c6d1ef4f14acc
MD5 a4e733292c70b0bc1071417a1a6d629e
SHA1 fbdcc285657affd7aa56117041bb597271830f1f
SHA512 f45be5bfd54dc86500eb70e9d293b7d23182b073d4c7061ce523270649eac472e42d14fa03bc7198910d35f837b0c9956188aab6bf5548bd657516a0b940db5b
SSDEEP 12288:G4w22UCsoeIx8ocXJJrLMglZnSgI5eSXt7gN2TrFuJWZf08YUv56:nw2bseItcXrLMgMUSXVS2gMzJ56
TLSH
T133E433362614C4BC7298F4B522FFA15969BC64B01F3764F3E669A08C5F4B411DB28CF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Cache\Cache_Data\f_000004
Size 314KB
SHA256 ed79a04c5ea00f1063ef7ec7e9858f38811e437229fa92608096a47a409b841b
MD5 e57b46111243862f892bbcf5d9f73f7c
SHA1 d56bcfd994589f147a9080819edda29ef7712b5f
SHA512 4cf6cfc8e8f0183211d1ae433fba984e9a8588a5a79bb258cf921c36b0e8c3fc8f0269488a0d0b0cbbbbf88f3eaececbdacc65434d58559cfbcdbfcb880e685b
SSDEEP 6144:n1tt3Sm+SdnNJ7tgIZBcgxTb/oDAxiUSiEjNEvllktpYz6noKUNbb3Cb86f7:n1td3+S5N7RugxTb/oE8jSqy6op3cp
TLSH
T1866423D7278073B22756042ECF2A8AEED19B328C52D1B0CA150B6DC25E4DFED9D918DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Cache\Cache_Data\f_000005
Size 538KB
SHA256 53c7b1d6f3e52f2c3f4d604908a899957f57dd59e5121fa8c2d2ee9dffa6a4b6
MD5 d3d0031e1e2ad5e53c42bcf7726e9221
SHA1 c9e584bb103ee069d052886cecec7093f1a14103
SHA512 596be7296772c99bf8b8865af68f176ad98411b3d52cf288174569cb073424de711e66988f90e17af1c7eab5ed3cecd62db2c48a8b216148ef9d5217d724cc8a
SSDEEP 12288:89FC5NQXK/quPoj40JMHDapZL+02ki2avKfWQFZdFN9G:8DeG6/p+XZ+0Y2agjZhU
TLSH
T1F4C423DAC3E7A078C996FDAC9AE50C410EF3735407A08B26E16BD062E9458345FE4F98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Cache\Cache_Data\f_000006
Size 536KB
SHA256 b04ba884bb48a983d859d5d929e18dff53afa6c72fd9b52e030a03259785372d
MD5 d5c6c81a4150ce4370bae41c9f384195
SHA1 38ae62399f57656fc1df27bf21e0bc12097d39a7
SHA512 b4e9703c2d850ed39670285e1e3bb8e5a7d4b584c48e09649c63f29c09dfc0a41f341a8dfda062b21efa7c5699863861c40fb6b22a4e1025ea71323d39b2afbd
SSDEEP 12288:hjTkoox6rQvKpP/uxwTlPDCh+VE25Pc37sC:hnNoEQCBEwTlL6+Vt5Pc3z
TLSH
T1CAC423C0E5C56BFA08659B25B9CF0F841FA8C6F07781FD7A953F8067F84469A185348B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Cache\Cache_Data\f_000007
Size 57KB
SHA256 6a239b6cd82b9e19dbf907fbaf2b15dd1126197f9522bc42c28c9d91948ba773
MD5 b6e1d1b3c30aa36ada12ad943e5c5d2d
SHA1 a05621d2989da0f71a425576f67a954444ee5a08
SHA512 b7271d0f047daadb0fb716144a1f64d7101045320f679f452eb7a629f37f2d8c1a5ccc06ef3f387141ba6c3127798a4f647aa4471cc53eec48b5d021f4a6f39d
SSDEEP 1536:C1gsrC/vm9b4pC8heE4wmG5nhGvER9CWSYMD:UgsrmmNuC8h0G5hVR8WjMD
TLSH
T17E438C035D16AE83A53583ECBF039CAC9BA4371CFA9235DA1A63DED33C20115AC9D579
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 862012502239df7c5c5d8e60214cd6cc3817a21ae61b1723a5b1681b935cc2a8
MD5 72c69e3399a9f41961fda5b6865f67c8
SHA1 8dded65050194ab78f4bdffcebc65508891cea68
SHA512 cbff3dd67476ea9c3786ea21917ca6d80b4a7be75fc285cdd55734e4c17aec19b6ccb8fbef25a990ca7b3ba7281cd5df332d3274e992246ad7636723bc57a80a
TLSH
T1FAA002A006861442C500177850C64DC9B2345DBB131B865265B156A89D69B586145054
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a2d6a.TMP

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a2d6a.TMP
Size 48B
SHA256 2532983d024a5c32f645192259fe2ad97288fe3a8b0f8a616cb2ccf9d89a8238
MD5 d41213b968ad8bcb67929f348e781385
SHA1 76a032ba00af706decb6312da5b197b3213e07f8
SHA512 4dcbff7c7b5de84fee55a0d53c8fb50ec25cd9634a610bc6dfda3d93c9bb2d6e56b705e94a9e81f304eb7ca0eb9d4bb10ba46d988cd094b88bb71ab81b4db342
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 17f02db1ff548b5733a2156437d415e07a48257cc3b711dd0cdcf36738d9fe85
MD5 4f55bc2191e1ae66cb32b9d942a1a870
SHA1 d27fdc073cc96e9cc13a3589a4d86c5210475824
SHA512 d513a18bbe7795d043a3c7fc402db4eb5a568d77da2cc53b0ed910e9cd57017673ebbc5f79ad4d122e417af8a3eb79b3dc3a305b44d98ea0ef97ea8684deee5d
TLSH
T18631B292C3E4C67D895566E827303817CD2E051DA2282D27CDDAEBE65BD2471D22510F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5af03d.TMP

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Network\Network Persistent State~RFe5af03d.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 a57ae94f20948a658418b0dbe449692278620cddfe576319f11cb41da43a6dbb
MD5 25efdc577035295d04900a048153eb27
SHA1 0946ae8bcbbcb64e77249ab6d60e31c516bf646f
SHA512 5821b96388d82d840335d9363558ca110065912eda977eb54d2f6ade291c832c7f2b0ea61ad7d6c751807b184d95aaeea7fea4a7238e1d4a3e1490e540c28bcb
TLSH
T1F4E0C0D790BAF033107859360D44BD062B36A23410505CF4DE52827C60401E34B23122
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5a35b7.TMP

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Network\TransportSecurity~RFe5a35b7.TMP
Size 356B
SHA256 3896cd4257ce965e4bd3b20a2649053aa4ad1511b93c3d02dbb13dff47696027
MD5 deff7c5d89aa9670bcfd32deca78aee7
SHA1 0af119cb353cc9e536f3cefdd34e6335aeebe833
SHA512 d6bea4ae29c2bfb79f587e81d6abcee9d3956ddce0c42b8407dba250091e1c56b7745dfaded3cc76d25169cefd6bd9ba37c5b8a99c735c22f475bbda171fa501
TLSH
T16CE0C6E3C0BAF07B90785D3A0D46FC4A1F36A63020611CECEE52823CB0804E39B135A2
MD5 SHA1 SHA512 TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Sync Data\LevelDB\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Local State
Size 2KB
SHA256 001992aa78077f6cc3a2285c93b87970f9102e05b6a4d58e13459e689006f9d2
MD5 5ea7c8cfbe72a5b0421d1b77262bfb8f
SHA1 ae299549d128297668374d0dab04bfe37d93353e
SHA512 ca5a86a6c0278ac01923a91632f24ad854ac5cf8ed7f8c67225806b4b9c641bd3576cbcea62d1fb9e55853ef0d7d8c5ce031ac1814ed5285b955c47312e5dc2d
TLSH
T18B5195736D646B778AF26744B50B3A23CF3990A19A716F919BED0F1C01A369C1346C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Local State
Size 3KB
SHA256 b472fde3ceb00c23d8030326fa48c654000237fce1dee4f40397a6083c2378a1
MD5 84cc83eedbf9abe47c3b52eed048e7ba
SHA1 70b0ae9c27dbfae24071fc30b87d9c46b96e6d65
SHA512 289e6701893ac084e88512949ca5be4fdee7cd8cb08dcb5c2d1c41d861dbc359ddbdae761d3ca1a451fed056886e4e2a0d57450144bff541a0bc8cf38cd7e2e8
TLSH
T1C76186776D74A93B4EF2AA04B4463B17ABA59023E5A17F95DAFC0F0D01E32D81341C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Local State
Size 15KB
SHA256 b604294af908f05c537de72fe274d19802b67515c94af0a920b63c1359c394bc
MD5 1f67e45e9b6751b84ba7a835550a4b52
SHA1 5cfffdac0c247ac7ffe5607e53ccf52c9c0224d8
SHA512 82580bf77716a476e43d87d92b2847ebde5db91654875eadd1da1e1bf48d0a574d57f83b0ba1dd17aee926eecdd4da0022b2a19f8e6618386669de9789061343
SSDEEP 384:l+aQikB+z/xvxjg/qhEwNBSgp9r3VdgA59zG:w/UxvxjgC+g9Dz35FG
TLSH
T1D0729E2B59797E2796F7FA04794A0B4BCFB894B291916EB84EFE6F0D02973D40301C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59dcaa.TMP

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Local State~RFe59dcaa.TMP
Size 1KB
SHA256 458eec7b9a759f833bd7224822666594bc5a3ae088bfd1d2758f90a5356ea809
MD5 e082a811fd12f2113367b4fba449647f
SHA1 98125e650a14d445cfd67378f57eda385eb7eff2
SHA512 03ad561523c194b9f0e5ed4f93ab7b5ddec88c59b6b0a1ae9eead1a1e8b4a043badecc68a7520f09721df8a66eaeb43d5183fcb6ae5ed25d20fc069df3875022
TLSH
T11A2165B2ACB41F33AE907785311776575F20907642708F8467EE4F1E02B31DC962AC36
MD5 SHA1 SHA512 TLSH

Submit Download

e59b22f.msi

Path C:\Windows\Installer\e59b22f.msi
Size 19.9MB
SHA256 a01e0a93fb7f723727b14175fc78cdbad71c5e5450cd785963143f00bc652e5d
MD5 9bb70d9b2ac6a80d24c5b92ccff83e9d
SHA1 eb81a85611c85bfa40724a5d44f4b18b0e211586
SHA512 acc9f633e9e8fad6f0366dbf0d3f1bb605a0939e6d37da0b92c834c51db27ffe3db4fe65d00b21767c4a298410dc162ab2e0dd7f50e1c62109e8ce2f423bbf42
SSDEEP 393216:vwz0ObTMXojxhVCQbyHEVlWGIIu13dStThWP/62RoEcLQ5+d0qcMAPBi/:vyTbQXuVCjHQYV9QThWn6goE35La
TLSH
T10D27330B3E06CA16D4262EF8C87BE7F5412AAC04D8525C131365BB5DFAF08C7EE915E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 f2ea436d992ecd30c06de553d71d1153de8a2aa4cc177bea2b4be5f215e6f128
MD5 1ceefaeee5acd2c27756522538d21348
SHA1 a83eb23a9ca08e40ca0e29aa43e8e091260045f2
SHA512 1d787b0d37c9ccf84289939793bdda54af16762424ecceb00660d95b40a3172677d9613e30269d480ad4d6763e3e1d2cdf0c1c9b1c0dad1d58ab0a102a525860
SSDEEP 24576:cFo3DMPCdoO/vvTL/iQSCy1w/7uoZ7lhkvUAtvsqUnc65lTicoxGSr4j2+4:nHU
TLSH
T17657F41436F92210E7F39E3CA8F46A234D397D5B9C1ADE8C45411B4E0922F71E972F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{72ee98a1-0e70-4119-828b-a43fef0c548a}_OnDiskSnapshotProp

Path \??\Volume{cb180e94-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{72ee98a1-0e70-4119-828b-a43fef0c548a}_OnDiskSnapshotProp
Size 6KB
SHA256 f2373007377edc710ec6a1446b46de166c7d4657e6f51f125f09f10c34979742
MD5 25591eeadff944e96ae709962416edac
SHA1 4dec221a267ce0db10dc428dc7e40f29bd1ffaf5
SHA512 57bcb9635604b0a1e62e141a9fcb146c6d04dd259086339fd37268eac80676171c7f50371cd5769401414ceff76eef0cf73ec9c631cd6a6fb8f54b1bae8bec94
SSDEEP 96:FHzak767vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:Qtb++uVm
TLSH
T10CD177085AF54711E2B3AB3128F58557A877B911EF33CB8E0198238E6631A10F935F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1132-233-0x0000029B32A90000-0x0000029B32B66000-memory.dmp

Download

memory/1132-77-0x00007FFE8CAD0000-0x00007FFE8CAD1000-memory.dmp

Download

memory/2536-328-0x00007FFE8D5C0000-0x00007FFE8D5C1000-memory.dmp

Download

memory/2536-327-0x00007FFE8D570000-0x00007FFE8D571000-memory.dmp

Download

memory/2732-69-0x00007FFE8CAD0000-0x00007FFE8CAD1000-memory.dmp

Download

memory/2732-232-0x000002267D7D0000-0x000002267D8A6000-memory.dmp

Download