92d189b57f2e8f6af3b85651fa6a2ea7981f5a8957f1b2b860589c1e9c14a17e

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 19:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Stellar_2.1.9_x64_en-US.msi
Size 11.0MB
Sample260930-ybpclasfpg
SHA256 92d189b57f2e8f6af3b85651fa6a2ea7981f5a8957f1b2b860589c1e9c14a17e
MD5 ccf6798a247933732eb13435a756dd41
SHA1 c87bf30865bffa8f49bc901df2234127c85d857b
SHA512 11ef689fb1d82e62c5b40f2bd471ebca19a4c0a6b54135b89dd48208ee74b246b54730959bc2fd899a9c22b877ff162d369bb5f9a0d222d6a530eea328614c1f
SSDEEP 196608:Bn2rUwSEEptxD/AGbl96KE/HhRE+VC2dp6x0dAN+HhC3IPLcP54z:92rD7EpPD/nZks+E2rANKhC3IzcCz
TLSH
T140C633857003C552C04832B9DC1ACAFE1D3CAEBDE59458572FF87E4DB97086ACA948DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1124	Stellar.exe

Loads dropped DLL 64 IoCs

pid	Process
2388	MsiExec.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe
1124	Stellar.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Stellar.exe

Enumerates connected drives 3 TTPs 47 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
	\??\F:\	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Stellar\System.ComponentModel.Primitives.dll	msiexec.exe
File created	C:\Program Files (x86)\Stellar\System.Console.dll	msiexec.exe
File created	C:\Program Files (x86)\Stellar\frontend\dist\polls_backdrop.jpg	msiexec.exe
File created	C:\Program Files (x86)\Stellar\frontend\dist\slots\T-Icon-Shotgun-128.png	msiexec.exe
File created	C:\Program Files (x86)\Stellar\System.IO.Compression.Native.dll	msiexec.exe
File created	C:\Program Files (x86)\Stellar\System.Security.Cryptography.dll	msiexec.exe
File created	C:\Program Files (x86)\Stellar\frontend\dist\slots\T-Icon-Pistol-128.png	msiexec.exe
File created	C:\Program Files (x86)\Stellar\System.Drawing.dll	msiexec.exe
File created	C:\Program Files (x86)\Stellar\stellar_native.dll	msiexec.exe
File created	C:\Program Files (x86)\Stellar\frontend\dist\seasons\season-10.jpg	msiexec.exe
File created	C:\Program Files (x86)\Stellar\frontend\dist\StellarStar.png	msiexec.exe
File created	C:\Program Files (x86)\Stellar\hostfxr.dll	msiexec.exe
File created	C:\Program Files (x86)\Stellar\BouncyCastle.Cryptography.dll	msiexec.exe
File created	C:\Program Files (x86)\Stellar\System.Collections.Specialized.dll	msiexec.exe
File created	C:\Program Files (x86)\Stellar\System.Memory.dll	msiexec.exe
File created	C:\Program Files (x86)\Stellar\Microsoft.Win32.Registry.dll	msiexec.exe
File created	C:\Program Files (x86)\Stellar\System.Security.Claims.dll	msiexec.exe
File created	C:\Program Files (x86)\Stellar\frontend\dist\seasons\season-12.jpg	msiexec.exe
File created	C:\Program Files (x86)\Stellar\frontend\dist\seasons\season-14.jpg	msiexec.exe
File created	C:\Program Files (x86)\Stellar\frontend\dist\seasons\season-20.jpg	msiexec.exe
File created	C:\Program Files (x86)\Stellar\Stellar.deps.json	msiexec.exe
File created	C:\Program Files (x86)\Stellar\System.Net.WebHeaderCollection.dll	msiexec.exe
File created	C:\Program Files (x86)\Stellar\icons\32x32.png	msiexec.exe
File created	C:\Program Files (x86)\Stellar\frontend\dist\seasons\season-16.jpg	msiexec.exe
File created	C:\Program Files (x86)\Stellar\System.Net.NameResolution.dll	msiexec.exe
File created	C:\Program Files (x86)\Stellar\System.Threading.dll	msiexec.exe
File created	C:\Program Files (x86)\Stellar\frontend\dist\seasons\season-15.jpg	msiexec.exe
File created	C:\Program Files (x86)\Stellar\System.ComponentModel.TypeConverter.dll	msiexec.exe
File created	C:\Program Files (x86)\Stellar\System.Net.Primitives.dll	msiexec.exe
File created	C:\Program Files (x86)\Stellar\System.Threading.Channels.dll	msiexec.exe
File created	C:\Program Files (x86)\Stellar\clrgc.dll	msiexec.exe
File created	C:\Program Files (x86)\Stellar\frontend\dist\images\rarity\starwars.png	msiexec.exe
File created	C:\Program Files (x86)\Stellar\System.Net.Http.dll	msiexec.exe
File created	C:\Program Files (x86)\Stellar\System.Net.Quic.dll	msiexec.exe
File created	C:\Program Files (x86)\Stellar\System.Runtime.InteropServices.dll	msiexec.exe
File created	C:\Program Files (x86)\Stellar\System.Threading.Thread.dll	msiexec.exe
File created	C:\Program Files (x86)\Stellar\frontend\dist\0x0.webp	msiexec.exe
File created	C:\Program Files (x86)\Stellar\frontend\dist\index.html	msiexec.exe
File created	C:\Program Files (x86)\Stellar\mscorrc.dll	msiexec.exe
File created	C:\Program Files (x86)\Stellar\frontend\dist\seasons\season-11.jpg	msiexec.exe
File created	C:\Program Files (x86)\Stellar\frontend\dist\seasons\season-18.jpg	msiexec.exe
File created	C:\Program Files (x86)\Stellar\frontend\dist\seasons\season-28.jpg	msiexec.exe
File created	C:\Program Files (x86)\Stellar\icons\icon.ico	msiexec.exe
File created	C:\Program Files (x86)\Stellar\System.Security.AccessControl.dll	msiexec.exe
File created	C:\Program Files (x86)\Stellar\coreclr.dll	msiexec.exe
File created	C:\Program Files (x86)\Stellar\frontend\dist\seasons\season-24.jpg	msiexec.exe
File created	C:\Program Files (x86)\Stellar\frontend\dist\seasons\season-6.jpg	msiexec.exe
File created	C:\Program Files (x86)\Stellar\Photino.NET.dll	msiexec.exe
File created	C:\Program Files (x86)\Stellar\System.Runtime.Numerics.dll	msiexec.exe
File created	C:\Program Files (x86)\Stellar\clretwrc.dll	msiexec.exe
File created	C:\Program Files (x86)\Stellar\createdump.exe	msiexec.exe
File created	C:\Program Files (x86)\Stellar\frontend\dist\images\clock.png	msiexec.exe
File created	C:\Program Files (x86)\Stellar\frontend\dist\images\rarity\frozen.png	msiexec.exe
File created	C:\Program Files (x86)\Stellar\frontend\dist\seasons\season-7.jpg	msiexec.exe
File created	C:\Program Files (x86)\Stellar\System.Net.Sockets.dll	msiexec.exe
File created	C:\Program Files (x86)\Stellar\frontend\dist\seasons\season-29.jpg	msiexec.exe
File created	C:\Program Files (x86)\Stellar\System.Collections.Concurrent.dll	msiexec.exe
File created	C:\Program Files (x86)\Stellar\System.Net.WebSockets.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\Stellar\System.ObjectModel.dll	msiexec.exe
File created	C:\Program Files (x86)\Stellar\System.Text.Json.dll	msiexec.exe
File created	C:\Program Files (x86)\Stellar\WebView2Loader.dll	msiexec.exe
File created	C:\Program Files (x86)\Stellar\frontend\dist\seasons\season-4.jpg	msiexec.exe
File created	C:\Program Files (x86)\Stellar\frontend\dist\seasons\season-9.jpg	msiexec.exe
File created	C:\Program Files (x86)\Stellar\System.Reflection.Metadata.dll	msiexec.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{77D5D66D-74B8-434D-9841-D6CE71F90A18}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4AB0EC961A68987B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI476.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5516_860000938\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5516_860000938\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5516_860000938\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\Installer\e59ff65.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\{77D5D66D-74B8-434D-9841-D6CE71F90A18}\StellarIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{77D5D66D-74B8-434D-9841-D6CE71F90A18}\StellarIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7083AFDC1125ADDA.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5516_860000938\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5516_860000938\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5516_860000938\surnames.txt	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\e59ff65.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4B0518ABFEBEFA73.TMP	msiexec.exe
File created	C:\Windows\Installer\e59ff67.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5516_860000938\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5516_860000938\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5516_860000938\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5516_860000938\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\~DF187A900DBCA33768.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5516_860000938\english_wikipedia.txt	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2820	msiexec.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Stellar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Stellar.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000072eafa9cea60e45e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380172eafa9c0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410172eafa9c000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e372eafa9c00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e672eafa9c00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 43 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\DefaultIcon\ = "\"C:\\Program Files (x86)\\Stellar\\Stellar.exe\",0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D66D5D778B47D43489146DEC179FA081\SourceList\Media	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\stellarv2	Stellar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\stellarv2\URL Protocol	Stellar.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\stellarv2\shell\open\command	Stellar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\shell\open	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D66D5D778B47D43489146DEC179FA081\Version = "33619977"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D66D5D778B47D43489146DEC179FA081\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\stellarv2\shell\open\command\ = "\"C:\\Program Files (x86)\\Stellar\\Stellar.exe\" \"%1\""	Stellar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D66D5D778B47D43489146DEC179FA081	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D66D5D778B47D43489146DEC179FA081\ProductName = "Stellar"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D66D5D778B47D43489146DEC179FA081\PackageCode = "CDB0FF68D8CDBB44D8A30AE046C13B50"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D66D5D778B47D43489146DEC179FA081\SourceList\PackageName = "Stellar_2.1.9_x64_en-US.msi"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\stellarv2\DefaultIcon	Stellar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\stellarv2\DefaultIcon\ = "\"C:\\Program Files (x86)\\Stellar\\Stellar.exe\",0"	Stellar.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D66D5D778B47D43489146DEC179FA081\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D66D5D778B47D43489146DEC179FA081\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\stellarv2\ = "URL:stellarv2"	Stellar.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\stellarv2\shell	Stellar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\ = "URL:stellarv2"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\stellarv2\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D66D5D778B47D43489146DEC179FA081\Main	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D66D5D778B47D43489146DEC179FA081\ProductIcon = "C:\\Windows\\Installer\\{77D5D66D-74B8-434D-9841-D6CE71F90A18}\\StellarIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D66D5D778B47D43489146DEC179FA081\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D66D5D778B47D43489146DEC179FA081\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\stellarv2\shell\open	Stellar.exe
Key created	\REGISTRY\MACHINE\Software\Classes\stellarv2	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D66D5D778B47D43489146DEC179FA081\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D66D5D778B47D43489146DEC179FA081\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\812181F64B4B79A53877A752AA655852	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D66D5D778B47D43489146DEC179FA081\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D66D5D778B47D43489146DEC179FA081\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\stellarv2\shell\open\command\ = "\"C:\\Program Files (x86)\\Stellar\\Stellar.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D66D5D778B47D43489146DEC179FA081	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D66D5D778B47D43489146DEC179FA081\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D66D5D778B47D43489146DEC179FA081\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\812181F64B4B79A53877A752AA655852\D66D5D778B47D43489146DEC179FA081	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D66D5D778B47D43489146DEC179FA081\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\stellarv2\DefaultIcon	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1020	msiexec.exe
1020	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5516	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2820	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2820	msiexec.exe
Token: SeSecurityPrivilege	1020	msiexec.exe
Token: SeCreateTokenPrivilege	2820	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2820	msiexec.exe
Token: SeLockMemoryPrivilege	2820	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2820	msiexec.exe
Token: SeMachineAccountPrivilege	2820	msiexec.exe
Token: SeTcbPrivilege	2820	msiexec.exe
Token: SeSecurityPrivilege	2820	msiexec.exe
Token: SeTakeOwnershipPrivilege	2820	msiexec.exe
Token: SeLoadDriverPrivilege	2820	msiexec.exe
Token: SeSystemProfilePrivilege	2820	msiexec.exe
Token: SeSystemtimePrivilege	2820	msiexec.exe
Token: SeProfSingleProcessPrivilege	2820	msiexec.exe
Token: SeIncBasePriorityPrivilege	2820	msiexec.exe
Token: SeCreatePagefilePrivilege	2820	msiexec.exe
Token: SeCreatePermanentPrivilege	2820	msiexec.exe
Token: SeBackupPrivilege	2820	msiexec.exe
Token: SeRestorePrivilege	2820	msiexec.exe
Token: SeShutdownPrivilege	2820	msiexec.exe
Token: SeDebugPrivilege	2820	msiexec.exe
Token: SeAuditPrivilege	2820	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2820	msiexec.exe
Token: SeChangeNotifyPrivilege	2820	msiexec.exe
Token: SeRemoteShutdownPrivilege	2820	msiexec.exe
Token: SeUndockPrivilege	2820	msiexec.exe
Token: SeSyncAgentPrivilege	2820	msiexec.exe
Token: SeEnableDelegationPrivilege	2820	msiexec.exe
Token: SeManageVolumePrivilege	2820	msiexec.exe
Token: SeImpersonatePrivilege	2820	msiexec.exe
Token: SeCreateGlobalPrivilege	2820	msiexec.exe
Token: SeCreateTokenPrivilege	2820	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2820	msiexec.exe
Token: SeLockMemoryPrivilege	2820	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2820	msiexec.exe
Token: SeMachineAccountPrivilege	2820	msiexec.exe
Token: SeTcbPrivilege	2820	msiexec.exe
Token: SeSecurityPrivilege	2820	msiexec.exe
Token: SeTakeOwnershipPrivilege	2820	msiexec.exe
Token: SeLoadDriverPrivilege	2820	msiexec.exe
Token: SeSystemProfilePrivilege	2820	msiexec.exe
Token: SeSystemtimePrivilege	2820	msiexec.exe
Token: SeProfSingleProcessPrivilege	2820	msiexec.exe
Token: SeIncBasePriorityPrivilege	2820	msiexec.exe
Token: SeCreatePagefilePrivilege	2820	msiexec.exe
Token: SeCreatePermanentPrivilege	2820	msiexec.exe
Token: SeBackupPrivilege	2820	msiexec.exe
Token: SeRestorePrivilege	2820	msiexec.exe
Token: SeShutdownPrivilege	2820	msiexec.exe
Token: SeDebugPrivilege	2820	msiexec.exe
Token: SeAuditPrivilege	2820	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2820	msiexec.exe
Token: SeChangeNotifyPrivilege	2820	msiexec.exe
Token: SeRemoteShutdownPrivilege	2820	msiexec.exe
Token: SeUndockPrivilege	2820	msiexec.exe
Token: SeSyncAgentPrivilege	2820	msiexec.exe
Token: SeEnableDelegationPrivilege	2820	msiexec.exe
Token: SeManageVolumePrivilege	2820	msiexec.exe
Token: SeImpersonatePrivilege	2820	msiexec.exe
Token: SeCreateGlobalPrivilege	2820	msiexec.exe
Token: SeCreateTokenPrivilege	2820	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2820	msiexec.exe
Token: SeLockMemoryPrivilege	2820	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2820	msiexec.exe
2820	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2820	msiexec.exe
1020	msiexec.exe
2388	MsiExec.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 2388	1020	msiexec.exe	91
PID 1020 wrote to memory of 4236	1020	msiexec.exe	97
PID 2820 wrote to memory of 1124	2820	msiexec.exe	100
PID 1124 wrote to memory of 5516	1124	Stellar.exe	101
PID 5516 wrote to memory of 2836	5516	msedgewebview2.exe	102
PID 5516 wrote to memory of 4232	5516	msedgewebview2.exe	103
PID 5516 wrote to memory of 4232	5516	msedgewebview2.exe	103
PID 5516 wrote to memory of 4232	5516	msedgewebview2.exe	103
PID 5516 wrote to memory of 4232	5516	msedgewebview2.exe	103
PID 5516 wrote to memory of 2652	5516	msedgewebview2.exe	104
PID 5516 wrote to memory of 2120	5516	msedgewebview2.exe	105
PID 5516 wrote to memory of 2120	5516	msedgewebview2.exe	105
PID 5516 wrote to memory of 2120	5516	msedgewebview2.exe	105
PID 5516 wrote to memory of 6140	5516	msedgewebview2.exe	106
PID 5516 wrote to memory of 6140	5516	msedgewebview2.exe	106
PID 5516 wrote to memory of 6140	5516	msedgewebview2.exe	106
PID 5516 wrote to memory of 6140	5516	msedgewebview2.exe	106
PID 5516 wrote to memory of 6140	5516	msedgewebview2.exe	106
PID 5516 wrote to memory of 4968	5516	msedgewebview2.exe	108
PID 5516 wrote to memory of 4968	5516	msedgewebview2.exe	108
PID 5516 wrote to memory of 4968	5516	msedgewebview2.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Stellar_2.1.9_x64_en-US.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Program Files (x86)\Stellar\Stellar.exe
  "C:\Program Files (x86)\Stellar\Stellar.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Reads the TCP/IP host and domain name from the registry
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Stellar.exe --webview-exe-version=2.1.9+f3150dcaa0767a72d5fe62fd5dc017228e1d5e5f --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --allow-file-access-from-files --autoplay-policy=no-user-gesture-required --enable-features=MojoIpcz --enable-javascript-clipboard-access --enable-usermedia-screen-capturing --user-agent="Photino WebView" --mojo-named-platform-channel-pipe=1124.4340.7884649676510864241 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:5516
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView /prefetch:4 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x160,0x164,0x7ffe55fb5fd8,0x7ffe55fb5fe4,0x7ffe55fb5ff0
      4⤵
      PID:2836
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-agent="Photino WebView" --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=Stellar.exe --webview-exe-version=2.1.9+f3150dcaa0767a72d5fe62fd5dc017228e1d5e5f --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1752 --field-trial-handle=1756,i,3657525378506295922,9908313582115033744,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
      4⤵
      PID:4232
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-agent="Photino WebView" --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=Stellar.exe --webview-exe-version=2.1.9+f3150dcaa0767a72d5fe62fd5dc017228e1d5e5f --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2096 --field-trial-handle=1756,i,3657525378506295922,9908313582115033744,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
      4⤵
      PID:2652
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-agent="Photino WebView" --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=Stellar.exe --webview-exe-version=2.1.9+f3150dcaa0767a72d5fe62fd5dc017228e1d5e5f --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2272 --field-trial-handle=1756,i,3657525378506295922,9908313582115033744,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
      4⤵
      PID:2120
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-agent="Photino WebView" --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=Stellar.exe --webview-exe-version=2.1.9+f3150dcaa0767a72d5fe62fd5dc017228e1d5e5f --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3284 --field-trial-handle=1756,i,3657525378506295922,9908313582115033744,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493 /prefetch:1
      4⤵
      PID:6140
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-agent="Photino WebView" --user-data-dir="C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView" --webview-exe-name=Stellar.exe --webview-exe-version=2.1.9+f3150dcaa0767a72d5fe62fd5dc017228e1d5e5f --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4628 --field-trial-handle=1756,i,3657525378506295922,9908313582115033744,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:7346ada77ad42d3004fa8dbea997eea31e49a493
      4⤵
      PID:4968

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 90EE9A9DA6CBD068EFF1B4B7377CB656 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2388
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4236

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59ff66.rbs

Path C:\Config.Msi\e59ff66.rbs
Size 29KB
SHA256 4be208b6b015813aa89f7b898481af86cf9150e8ccd237d2c7f903a281061960
MD5 ef0f907cd15893992d3d6c4fade3569c
SHA1 d9dabb9572943e98713dfb9a4dd1e6b38d0cf580
SHA512 b0920a00ca9ea7211c05e64c5882c2bc017adc6fd09d2d3f00ccb2075851da7c0abc2e3ad5b1924eefe17c7700a0774d470ab274fafb7e3e07b375bfe4ebfb3c
SSDEEP 384:6AXl0NNtrvT6BRccbaZ9JscKw/ADmwaKQHBk2xk2Mw5GIK9rrpMFAjkm:6ol0NT+8smwEkokzw5HorrpM+jkm
TLSH
T13CD23F91AA0AC6F3E92999FDF3F2DD0903D2C9B4350A913E228F950345D0EC95A6D9F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Win32.Registry.dll

Path C:\Program Files (x86)\Stellar\Microsoft.Win32.Registry.dll
Size 20KB
SHA256 fc83f0ceada7b9a8027af6ce84b9154d942cff7a9fb6a1a059f9cbe058741a14
MD5 1c614cfa16d62e1acb9dc2f582868500
SHA1 3a8889cfaf6c1f173b9283d6435ecfe5ff3cfbaa
SHA512 b6403173ae52be640cea44cd40cb1d8371402caf86fd7387f6b400bc83973d06b82388a7e27c58fd3fc1ca67ba0627e2680e8f084f77a204738d22095ea85bc2
SSDEEP 384:p9YII9bnGAzzW7DN/Ijiv2ZrqMFs6NHKrV3eFqod/OpZ5zOxWnWvGW:p6rtA/Siv2Zrq6s3eFqoJQZ8X
TLSH
T199926D02DBE8811BF8EF0F7A4CF2860251F79D8D4E13EA8F559842465867BC483327A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Photino.NET.dll

Path C:\Program Files (x86)\Stellar\Photino.NET.dll
Size 38KB
SHA256 fc7f8b0ea10440c7262cabe6659264b9663ab495b8fdf51535df2eb6064dad3e
MD5 6306b057bc1e3f42554eab684909e7fb
SHA1 298f37b77ed0525962023a4191da30d143b95e8d
SHA512 edbc5eefb278b8470499a11084d9173e37ca5d0b512b10c1f7b0a1416c165c112bba169fc561076f92156d9c0bc96fbbb5cbad55a2905480b25cacf2ebf50ba0
SSDEEP 768:J4akdn5N2JrLP4Oc2mL973YxokkcrPdDhtvNsSDaJpWYovDswWv:1yn5N2JLmx7o6kDlD5sQgUYovDi
TLSH
T10A03180192FD4763E6EF173CF8B516964B322C177916EF5E298C009A9B63B90C9503E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Stellar.deps.json

Path C:\Program Files (x86)\Stellar\Stellar.deps.json
Size 11KB
SHA256 d37c75884ec70a6cf319dc00b523379f34832c0671f1f2bccad4ac3bf60d5a82
MD5 731c305061d975ed20cc62a2f94e32f4
SHA1 978ecc93fb6eb4e7e6528bede2f540a7c33d63ce
SHA512 fc4c3f267d73c2ccc3617a9b82a4a4a665676fc3f5fa079eff66f3016492d0c4d2c56a84237194dd8f9462eb796a13480e27a68f9e972c8aae652ba40625d0c3
SSDEEP 96:QM9Bma126Q/aFHGIhJOpy+C648NUzozkp2pB0myk3D2:QM325/aFHGIhJOc+C6TNajszla
TLSH
T19A32DE34C9508DEB8434ABAF18758242F775036F6242588EB8BC291EDFB7DBA5054B3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Stellar.dll

Path C:\Program Files (x86)\Stellar\Stellar.dll
Size 424KB
SHA256 66e2fece829b87c5bcb2879f1df2d0c4a9eb0e4bd7f96d2a030eac14959cbc92
MD5 2689bbee03c084e32002bcfbf7715134
SHA1 34ce7d504a97a317e681a500fa04a3441c6c621b
SHA512 c7a99e7342fea79a1d217cda31b5afc21a0cae891573f4a13c32d250ec54eac5bc1fad75a38f44183538c70e646796b59639ad46766665d3fb853924e8f5d929
SSDEEP 6144:Ap2tCCqesD3/HMWcqvC5HP3xE7tK6SdlRtD7yphefbdYv/r5ZGZlKeTae6jaU:Ao4n0fx6veR2XGZB+nW
TLSH
T1C994071A2217C542C44E73F8CC0BE6F885A9EE51E4459B5F69B9BC9C3835B1BDC048EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Stellar.exe

Path C:\Program Files (x86)\Stellar\Stellar.exe
Size 338KB
SHA256 1a56ce2f22d314a8cd9d72c39422a01fbd090a2b78dc9e66ec69d28126bee9ac
MD5 a4b62038af86f368befacde72e0de0fb
SHA1 16db4abcea680be274df6e62ad8d024c0ac15c2f
SHA512 7afee4b79e47f4428c54c9c367054703133e07e0210afe596bfdf623bebc57dc53bf22c1d3fba567e814d43326daa5ffda14d4da7b3b58fc8046439073dba86c
SSDEEP 3072:MqeXA/4yIbHkNPN+6H6xCYOiVUE265HJ5QuRPZLJdnmavL0zZlfyeWa/m/ijaU3s:MvdHkNFdaxmVEnJ3cZlKeWae6jaU
TLSH
T1AE741716B117C05AC01473F8CC53D9F1A679BC40EBA15ECB22B4BE693E31A5BCD24A9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Stellar.runtimeconfig.json

Path C:\Program Files (x86)\Stellar\Stellar.runtimeconfig.json
Size 1KB
SHA256 d888ab536c7dc5775e966ed153f7aedc6dc3abfe3aa73c1f819b7ad434a69372
MD5 38abb01c4fd982f4a637da359be3db8f
SHA1 1aa51d6656faca384d7a42247db8733e98b81c48
SHA512 bc17d618cf04ebcaf6137a19814a006da6347df54fec287d7bc6f0cebe31e9bfcb7b39eceb5d180becc056395e9482030b4761a757be81cef4c25d9aa9da4a2f
TLSH
T16F411534DA5AACFE047951AB8820D081DA3147271004BC52F1FD040CBFBB6A42376F97
MD5 SHA1 SHA512 TLSH

Submit Download

System.Collections.Concurrent.dll

Path C:\Program Files (x86)\Stellar\System.Collections.Concurrent.dll
Size 20KB
SHA256 1a7df17329c65ce6cdb3e36fd0168c3d275d3abef13e206559e9bfbb7b93b282
MD5 5e995ff4fccf7b3f64f6b4c7fb0c78b7
SHA1 2141fc2b833e4923126b5e6f27a3cdc7df29a610
SHA512 1d9937a5aabc40f5fad128f89b0c07734b88ae3185a876d156030d2cb10d0df73901d58b9d5d8eaa51c94a14decc0881307c2ffd4b8b0c7a2700af41659ead86
SSDEEP 384:t31o1otepm2fLKYJdioZbRZQB2xNsiDTSZljWcgVZZaAjmyUZauZ33ASoAzWLWwH:t31o1oswjcZJAzp
TLSH
T1BC922B0573DE9733DABF0F7FA8A658A00672A7475813CB5E20DA73515C736100FBA2A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.dll

Path C:\Program Files (x86)\Stellar\System.Collections.dll
Size 9KB
SHA256 f9e6acc4dbd12e8c8d72c187d50e7616d79120d0281abce99f19c57fb26c74c6
MD5 8488f507a597831838b9501b4ae2cc32
SHA1 0b36ded742970e38f51a3537de74ed3109994c8e
SHA512 736aa61caa04462ccc099fce9264916d14cd3c83a47029a1df9511c993fc46a96af09557c7a055390cc2085ebdfb742afdac7ad1671c95067346d83174171929
SSDEEP 192:YEaPI34UmaXnUxXICwUyftbBqz7quVfjMxvVR8acuWSFpQW:94WnUxXBlcbsz7quVfjatR8acuWSFpQW
TLSH
T1B312C601B7D89333D9EB0F7EECB3418146B9AE956912DB6E0588521B9C63B110B7237B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Drawing.Primitives.dll

Path C:\Program Files (x86)\Stellar\System.Drawing.Primitives.dll
Size 7KB
SHA256 edabfd86eb8df12a0937a9e3e6c69c597f090bffd5d24d6a14e7bd1307486c89
MD5 88dd02de2492b66e29e06429424bd6b2
SHA1 665439045788a77cf43028314a618a7503ee1375
SHA512 3eda5097ae01709ff3ff5a45837c20cf7eef8c61fd157ecd2007456c0c87540d9bb650d1be8e41086b01b424c2d9689e6e1175a27870dd22137ac95df184766d
SSDEEP 192:gPryuX/IKF02Yb6J+Bxx4LiwjswAgNwdHwCdWI+BW:DZKF0N6J+LvwjswpNwdHwCdWI+BW
TLSH
T19FF1C524A3A94235EF7E4B36AC66518147786F01B993DB2F128E824F9D276810F31776
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.IO.Pipes.dll

Path C:\Program Files (x86)\Stellar\System.IO.Pipes.dll
Size 35KB
SHA256 7ece98ab6554612c2957d53fc533245b9e1d8697c9941fc7fad86524433a15ef
MD5 83b5aee82bdd434fd81d28f6eef157a8
SHA1 4c10270494a1f0ac466b13740c66d68e52af3303
SHA512 1e5739ebb2f6cc61a4cddcb4473a6b20ec6aeeb42386c6b049e1a9a1a763b7c192ef3d347c51321d54c1229280fb2ec1c1986d2030954d57fdc04d2e71a9cbbb
SSDEEP 768:NxeDvsu+kzj7+iYcUTpnLkINH+0cuUjB5:Nx85hNYcGoIR+0UN5
TLSH
T180F24C40B3EC932BFBAF4F3AA8B1A206177ABC465913F75D58C8615D0C577C04622BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Linq.dll

Path C:\Program Files (x86)\Stellar\System.Linq.dll
Size 47KB
SHA256 25ab6d9896769a150550e07ddc7a62580869b172a24def9462d6e0fd0ff282d4
MD5 d75ee40ed212ddf3447ce2bb91c7d169
SHA1 36213dad839cc1b78f11208edab4ea8ce227bd80
SHA512 6a7543e6b1ce047b78ac639e666029fce9f4b02bcfc54ef8fdca8fb7a08015bc93fcb718e8c6c7aa4b34feede09186cd9c8babb21f4ab14170a76e21d21bac9b
SSDEEP 768:ze8chDP7PhoKX8EDJcBuUFgR1i9OlKZjrRFB01Lg2aO0xtBXeAlKD7sOZbEXTBm:ze8+PhB8EDJ2uUFgRwQlkn6kTNXXLcY0
TLSH
T1D223F90571CC8B13D7FF1AFBB4B000A74BB18957A60FE6960DCC6AE41CC77909E591AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Primitives.dll

Path C:\Program Files (x86)\Stellar\System.Net.Primitives.dll
Size 62KB
SHA256 dcbb80eb6bc3bfde956ff1187d2432fafef12fba160bdd2b2f3bf38b0970a71e
MD5 480a0d8f869a060b23c49e1f619d69ca
SHA1 57081c009b840b329c5e5ad4c5e8124677537ca2
SHA512 499960a51334b306326779dfeb04da8c05e68c9d076ff48e557dd2c7e7ba6cae58e9dd09fa8f16156927a32ba9bb355d8afb8bdca6b0630cec2831a141c35c70
SSDEEP 1536:q1pVmMXXZz2HY+mIITHI+oDiI0FAtFE1JVeqJJca:q1KMXcHQHI+ouI0FAty/3
TLSH
T11E538D6063DCAF07F3DF4F79F071610502B166672902EA5B2DD8A1EA1C53BD18A227E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Sockets.dll

Path C:\Program Files (x86)\Stellar\System.Net.Sockets.dll
Size 77KB
SHA256 56eebc13ce425595ef9f518d42d792a8a43bd475d91d30ea6eb9d233a80671fd
MD5 4e91a103ba15060ec0cce19f5b0aa803
SHA1 5b588b8fe217378abd7bbf0669bb55c24bada174
SHA512 8903127c5fa1a198bfe297ad6daf1b808eb7034813926573d3f85d07840db9be468f833b9a1410138360684a9868b792d343607cda0601a6741ba1a164b4da06
SSDEEP 1536:vhKBiabvwZESEBFBw4Ce7lYX+e5P6fKrNef3ag3yjmVab:sBi6vBFBDde5PcYef3aoyj3
TLSH
T186738D3862FD0F1BE7EE077DD8701249027664A6BF07EB964C68A1DD58933D089A07E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.CoreLib.dll

Path C:\Program Files (x86)\Stellar\System.Private.CoreLib.dll
Size 1.8MB
SHA256 7fa17d6b05a94285b337903945564d234b2120a816d1c921e0c639b4b6fa2c01
MD5 6c90073b8cff95df2a31561096686856
SHA1 2204b08267c185b0ead16eb13e197df1bd2750fb
SHA512 768ec98cdc63ce62ba72b1f84e1a682317213f7575c38e91edd28f7aea8ba97ce0ef85b427d8fd4ecbf765c1046e68214ea53ce745fa42332b99df455450c9d9
SSDEEP 24576:CrQfRc+ioa80KZsMYfp8/bbeyYMR/U/H0dbpF3buWdkLkxsfW6Jid5Wpgx1OoJ96:mYfhYfpmYMRfF9Urid5WJ
TLSH
T14F858E5076D8CB2AF04F8339D675DB1A87F2C8652B86E74F7544A5F828137062E8D2F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Uri.dll

Path C:\Program Files (x86)\Stellar\System.Private.Uri.dll
Size 66KB
SHA256 efbe0f1a1a3bc51cc24b7d17728a04c9ef004bdc2bb22d10b2535a942d93cff2
MD5 8e8f269c57a2dda311219240252f4dce
SHA1 d31dda5a74fe43b8f05b7097ae22f331acb41fc8
SHA512 5db066bb05d92adabb506e3e2875e8c318956192b5af85141a2711e254cce6616bd0d58d3ccda5f5c285bcfabcb4f935d907978431c2bf4a938e2d278ed7824d
SSDEEP 1536:dKlsEiuNYK03QcE35l+st/9Yg0y3JtGYLd:4lsBuNV0StiYJtGed
TLSH
T1D4633900A7B9826AFBDD47BA9177134712B45922B453F3959DF834CE19323C28626BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.dll

Path C:\Program Files (x86)\Stellar\System.Runtime.dll
Size 9KB
SHA256 33d20f12abdc2fc6e9abaf9f648669236b935bc7f71808c0bf2fba3d05b9bc1b
MD5 57d0d079f995560d73572bec3c647ac2
SHA1 ea93ba17e1f056b2eb1d5fe899501eee7b788ae4
SHA512 072b23c136b4604b9ce265dbf23bcfceee4bc580b27926919164f24cc4526b3a9dbfa8a01635405ba0e7cbc884aa7554ecf9aba9a8578c9459f52701ef9516d7
SSDEEP 192:bfYmbNoVl9zn+wv3psKW6e0xNW1e01nqGMwPReD47QkRxJWtWJW:bAdVl9zn+wv3ONb0xww0BqxDiQ8JWtWY
TLSH
T153126224BE98A2F7CD5B47B3CCB3958307F7B7D8753F9E2A208A5216985B11C0631395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.AccessControl.dll

Path C:\Program Files (x86)\Stellar\System.Security.AccessControl.dll
Size 46KB
SHA256 93ddca7ae9d1eb8ba92d0f2d8bd02034890d751707b01517f6e3929320a06ffb
MD5 de4985e8bf0f4627df3fa53646b6f103
SHA1 e5f0be6436eab796c1a8f8c36d61f06f1f0098d3
SHA512 ce7a300c4753a6b50effb72e19f9e7b1ea6b588a2bf16a36e613a970f86b126c496149263b7fe46ac15b4186f38cce910de6c30111efebb4101a7216c810b77a
SSDEEP 768:qGj33QW4zMlIYfEiEUmLmVZjcugjTZvBep8VrsEUBQb3Fpic:q6JMM2YsiEPy7oZjvl30Qb3Z
TLSH
T153235A20A2FDC31BFBEF4B799872691906F379A97E03D70D1C46A0E91826BC046517B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Claims.dll

Path C:\Program Files (x86)\Stellar\System.Security.Claims.dll
Size 10KB
SHA256 5e5836fd29589393781a3454745a24e917b2603b255d21806af0cbe382884b53
MD5 d74752fc37b42b61d69f1d0d2b8f3d9e
SHA1 b8443483e02cb6d2e50c7d2ec597c8f0fd7047f2
SHA512 7b22db2214a2398770d1bbdb75c6e63ae501f49139fa37f5d0fca530dab4f9edc554eda842daf4effa08ffa2ff61e2aa28e36599d9eaefe9b77a1261c7ab69b9
SSDEEP 192:lARSq76WD0A0qNdIOWFRffX9AmvCoijV7nxn3+/M2aklWV6WWFUW:yoq7jD10qaDH9AmvCoijV7x3VOm6WWFd
TLSH
T103220908A3DC833BCDBB5F3EE4B341110375FE196922DA1E4AAC610BA8577144B6177B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Principal.Windows.dll

Path C:\Program Files (x86)\Stellar\System.Security.Principal.Windows.dll
Size 48KB
SHA256 dce4ca9a742217643cbaf3f15afb5a9f9a177ef0d3fd3cdc35a44f3888d55f38
MD5 3845a48912249458a870482f1e66890e
SHA1 d665693e4a85543b1223fb02baf7304cf472e2a3
SHA512 8acb12fe890706bd22060ecd13511f5f0a9033520c4af46f0960d27eb25ac6c83c0e40d9aa0903a99d2902510d2ff6a297d1afb4e2e5a454e43c7045285fc5c8
SSDEEP 768:RpGNfKQMTeQrWWG/Y4zTNeLbRPDjFxGHQha/9gEsy27b6:RYNCTSmY/lIb9DjTSQha/bsy27O
TLSH
T1CC234B01E3D85337E5FE8B39E4F3233942B6BA1A1F42DA4A0DB455CE58977C18621367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Json.dll

Path C:\Program Files (x86)\Stellar\System.Text.Json.dll
Size 335KB
SHA256 1d46fd00520b348045bb784e644f118489632d3d98023fb20f5838decac6d6f5
MD5 f65dc8da25408d0c22e5b48b6766fe38
SHA1 04734cd2a409ec567a1a42a7752e310acbd2351d
SHA512 456a28d6ec5423c732f83770ca236e0a64ad1734c76e3065d1319cc4f74f0f7a9e87aca36162ac647fd4ea1b55e9489006930894324cd8eeb57bd9e3f377fa75
SSDEEP 6144:zs5zGo7XxLUdytPK25eMSOzVVmGLVjGl:z8GuxLU8P5eQxVmGLVj
TLSH
T1A9745D5067DD8B67EBEF47B4F0704126C7BDB817A7AAEF89954818E41C437C4AA012B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.Thread.dll

Path C:\Program Files (x86)\Stellar\System.Threading.Thread.dll
Size 5KB
SHA256 03b8ab6b77e360de705de609dca843e789ed7e9c5151edf12ec34639c1b51829
MD5 93f41c68f7f181913a9f782299c278c4
SHA1 f8b2935080a6e3a22272474a4d3569a159c3b287
SHA512 7388d1472f0ed6ede5bc791b3aaee7b4d911806b0c31e12863bdc9ef5dc00ad37e57ab1cebacc002092ca65f3fe08f4adf28e25d7b084ccd898dd0a8b3ec758f
SSDEEP 96:wzeUP0fGPmTrbFiI+6WxvwvUDmDqDDHWcg7WI:5UPSGOTrpdZWxS2Wcg7W
TLSH
T1FDB1426093E84377FC734B769CB3528896B6BA55DD27CB1E08859206BC2B6148E70B71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.dll

Path C:\Program Files (x86)\Stellar\System.Threading.dll
Size 11KB
SHA256 e030b158067696344b85baaa1d06ab28c25ec5153d1d4c3be580916b5e8f37e4
MD5 8ca7d0f0140f23a0435d4ba3f41fdf79
SHA1 2e113a73cb36625af5252360371868832a0f1c1f
SHA512 a2f3a1e780eca1ed8a4158142e414822f565e04cf2977719311eab9535db4af5b63b725aa4c932c46f6c8845d2f99cbfb76bc2e1319f5eef221a5c895095ad38
SSDEEP 192:6NZ34Uj0EtOpX8EuBMfzzU7Uz2Fv4DE0rZvmxiEfWV4TW:6NZ34UbtOpX8BMfzzU7UCv4DEwZvMiEE
TLSH
T110326451A7F81338FAF30B75AE76B1904932FCB84921D16EA05C500E297BB548AF2777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clrjit.dll

Path C:\Program Files (x86)\Stellar\clrjit.dll
Size 1.7MB
SHA256 697c09ac310b8fb8118863971955da135aee348116816e3b511bf5957dc6253a
MD5 9681f60c2e8fb76ce3478e6453893ae4
SHA1 d531032bbb4232bad195a3b8b46d3ee30ff9cb68
SHA512 d8827ad2fd796817be9a2fc5363a08386346f8202102f4942dc79cc9d69046877e4bc102acf66083563ebb77e0210fbb0df66f1da1c8c8def29c85e64a5bfefa
SSDEEP 49152:Lr4ySEEayNJdbVkxeqAxKSmvGh0w+DG5xifDZgtQJt1MkepLdJ:3uaypVkGKVW0zo+DZgtQdMPh
TLSH
T1D785AE42A2F805FCD0AF9534C6574A1FEBB2B45913609FCF42F40A96AF237E2562E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

coreclr.dll

Path C:\Program Files (x86)\Stellar\coreclr.dll
Size 4.8MB
SHA256 bbbcaedb369617695280caaa60cda1aba4fa3c5b557532a89d9f4a9174a5b692
MD5 be8c2190a7ad2ee0ca3ba14a1a05396e
SHA1 71e46da08cf4b3a79dbeb42e2934572a5fa4cfb5
SHA512 71f122ffbca7f0fba542f2911c45e576bbd4e236c6e7047bdb7329299f12fb5d00bb0bf3c1fea128259e8e1e5159c2053fbaa35bf60b55d2c97eab854945ad5a
SSDEEP 49152:MPNKhU5VmRpLaoK713JxZDS/yOcqyi+aX3kQ4wjr2lCsmwc4u97cvXck4uFGtKAi:UVmRpLaoKdu+6UUBDDjb2RBOHq55
TLSH
T126369D56F2AE00ECD4BAC078CAD31927FAB178591738DBEF06644A651F23BD16A3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostfxr.dll

Path C:\Program Files (x86)\Stellar\hostfxr.dll
Size 357KB
SHA256 4f5a0500cd2a2439b0d5edbf242950233aec4539ec9a5e7ba9b8a9b0079f63af
MD5 b12f168ba86e7135e07168cfbec01aba
SHA1 d2d51f767d7e8306e890dd6a97ade93fb117d8a5
SHA512 b2d612c1383c2754fe54a1b433ebdd77cb1a48d3143a7c1406300d6a4a26a52baa0310a10648baeed687201a583132fe9c2326dd1a46ed74c7d69e46a6290f17
SSDEEP 6144:GE7Hjww5R1Gv0crJHeUtJ9NZFSKJ2nje/SnFNonJLSHDWHPDh+vJpmE0f0xcTZ6M:VMjrJnJaKGkriJ4E16tXZPp
TLSH
T1F5741916D6E8017CF0B7D679CAB28901EB727C494BB196CF139099661E73BD09E39323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostpolicy.dll

Path C:\Program Files (x86)\Stellar\hostpolicy.dll
Size 397KB
SHA256 24f18ccb306d5e614932478471ad276e2b041a723a45e571073db383b37c5120
MD5 5cfab0f28a101e8ba58d6ab9c46d7eb0
SHA1 20e6902df5b075e396f8b74e61505ad22f44146b
SHA512 cf38f9550d96fa18bbe537bfbd7efeb19ddd1c7e69570b7bde336ab3cdefbd2bb46c163729487ef093b9a0506c6ab0e9d5cc02c7fc615f01dda987ae0806e6d1
SSDEEP 6144:Kvb1pnG2fGDI9bOnSWEF+1TlBVe8HzXj7l3TtCOa9/Cm8QtBuJ7QDZ0XN94yK34m:KK2E9rfe8h9/jKoLJURLSQooyPrg7
TLSH
T120842916D6AC007CF0B7E6798AB38941EB72784E47B196DF139089661F73BD09E39312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Stellar.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Stellar\Stellar.lnk
Size 1KB
SHA256 46ebf1fc446e73a85d1894ba596709e5a134a8c0940c0b7c4e241c720a8b2e69
MD5 efe2b2cb35f0aec1937dc622d5955845
SHA1 9b84130776133496733b81255bc33e005719327e
SHA512 40647fcffeabe04087d982225d2ffd6d24b673b8d01150e3f9e41fa0ad73d7c8bceb2520ce5642231a59322777e58e9baab529bfb2c44b438d15f26babe603cb
TLSH
T11941AF110FCA0766E373467BBE7686A1AA62FD10F5218F2F424A00C905F590555E8F6B
MD5 SHA1 SHA512 TLSH

Submit Download

MSIA0BB.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIA0BB.tmp
Size 145KB
SHA256 f34eff56497107449a836c4643d01ad0ede4750d4a5a12d606b690d9f04561ec
MD5 1b247e54c182f0ca11abd2a7cb6e81b4
SHA1 9b44def967dde00b1de64e576cf894413b0df28b
SHA512 96d655da4241abe4b50fbfae1ef44a6eb7ecd6431431fbd000527d3512dc8b0977d8b3062fbed9fdcd406944bd34e06dea07f36a19a542281df61a29e6080da8
SSDEEP 3072:U4n4dw51x0DKiSgWQkEIVcxsbcJWdI/72bCPWr+2sor9OPrs:Ulo0DS8kLVcxpJAIO+O91
TLSH
T1F6E3AE11B190C472EABF2A394470CB725B7FB930DF909DDB539806AA5E206C19E35B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 64379481b128e38a200ca280b820bc0427c1e3752761dfb0a2c3931abda62a1e
MD5 362e66bc5a4cd36fcd71f86aa231ce49
SHA1 c22d69100bed35da3c5dbbe955d1c3b097f4379a
SHA512 e24adc55b1ce801a5c1c1d1f9015cdaed84e681961834b428e7a90bc1fd6f26053391eea1918eba5a4273b8315a1f3ed662b3b1843c273ad4ef1fc8388e6db41
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 12280d0a12b565b83d4c2ecbc483bdbcb4d04aaa09c72e497a32c9f696c7d4d2
MD5 1d506606e99b169e060b4a3627157bfc
SHA1 d468f55de5939c169c7e72c4e5c24dc16f6c3119
SHA512 967bfff4233b8265046a426c17544962bf7424388ba0fc3c34c44ac6a3d07fd529a0fcce1017d3054b423d622d8345c23c3aef7e21baef2826b1556d13f36665
TLSH
T180D024173351013CCC1070330003750C1401C11F414FC004743CD51D7F440550F37451
MD5 SHA1 SHA512 TLSH

Submit Download

8641b6e7-eef7-4fe3-993e-aed95130ff70.tmp

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\8641b6e7-eef7-4fe3-993e-aed95130ff70.tmp
Size 6KB
SHA256 15d8ba8f3d9948f1e001316b4f67dbf857c116cfaaecba392a857c85f7222bc0
MD5 2ae6018b7101b0c904e5bf8537f5d469
SHA1 73549547f6a87b049c200a3b0a7b980cb3d01980
SHA512 e4ddaefb6b2fd12fa9023058de661bf5257e4bd340d519c16a38329bd66a5d2740215d569144d3bd2d72b7497addaf165bbf302c8e62993916eecd8637efc2ab
SSDEEP 96:st/k/dYdPQab9zik8o5h16ZdAs7/x+6Mhmueckmt1ejeiK+gwXQm28XM1C7K:st/oaVe9oKAsV+F4mtQjaAjG6K
TLSH
T1ABD195025F6879BB4CC6F519BA39BB02E2F5606271D11E58E7F8462C09EA6CD2317C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Cache\Cache_Data\f_000002
Size 110KB
SHA256 d790a2072437281533ae1992ebf0d5a6872789aa9857ea629734066e5f597505
MD5 b3887d72bf7aa8ef0a4da336a3e9efd2
SHA1 8c602fb140603c41e713f5f88c93f66faa3b4587
SHA512 52d637dcc6c0f900412ff33b24a5bd35ba467a3e946ee41b1e892ee3ac0c05c9dd8d745558a930d058c665c6afecd13aef1b6af0cd98b1704d51524abbc89f9a
SSDEEP 3072:MeK8Pqv3bmqvwp7+WRP/9hkUFPmAWD1oLSqRZm5Kl:MTOC/K/MUprWWZn
TLSH
T1B0B31267B98E075CEA700D7D29DCB88858A28F2F9072F4F24DDA504F1A198839D7CDC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Cache\Cache_Data\f_000008
Size 12.7MB
SHA256 a8c64ef5e49eba6abac13fa4c5041f7b19e26536fadfc69ff97fd6863ae5847d
MD5 72bbbeb4a5c3b07096e54848a0394e9e
SHA1 5627c2228dc882032806f27560cfa2f50809a5fd
SHA512 0083772597c262667d9dde98fe2f1a5a7eb4b456f752eaf9d3f7c4f5a9e4af768211fcf661c02565ac1b933a5ec8dbd97b3eac1a11cdf42181c9454b0b93c2ed
SSDEEP 393216:UERixV0CDIOKqaSOIAw0kXt7k6ablnF8hxydXDdBsQU:tqpEXSbAw0kXZk6RhxydJa
TLSH
T1F1D6331B9539262CFD9E4BA5410E8B117ADE8C61842E3601ED073162137FB697BEEF0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Cache\Cache_Data\f_000009
Size 1.8MB
SHA256 88d83e5451117dedbc3daf82fdc947108f37ca24239e7bf59975bbeb589463df
MD5 9fcd44601adbc3b4b674332a672525cc
SHA1 ba2ac86618fea3c058a98b3fa8284d0c7c25f73b
SHA512 63f776cc7e27f11f232145cfd6c7e52f84fb352a93fb4213785f1a4389b87d9e3f9c218b472e195b0b7fd2f3fa38a7265545576ca2de4296d1fd24afe4e396c2
SSDEEP 49152:taBFrAL3VR/jKQ+n7YBibdvobIURpVfRF64Og:twsLlFKvYBSdGIEpDog
TLSH
T1F68533A0AFDC9F397D57A81745022C8E4AE23B90F9258AC2D476C4E4752CB652F6C7CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Cache\Cache_Data\f_00000a
Size 683KB
SHA256 83ae56bee1833fd3190fa5d49098759520dcbca48fb9b358c88c6d1ef4f14acc
MD5 a4e733292c70b0bc1071417a1a6d629e
SHA1 fbdcc285657affd7aa56117041bb597271830f1f
SHA512 f45be5bfd54dc86500eb70e9d293b7d23182b073d4c7061ce523270649eac472e42d14fa03bc7198910d35f837b0c9956188aab6bf5548bd657516a0b940db5b
SSDEEP 12288:G4w22UCsoeIx8ocXJJrLMglZnSgI5eSXt7gN2TrFuJWZf08YUv56:nw2bseItcXrLMgMUSXVS2gMzJ56
TLSH
T133E433362614C4BC7298F4B522FFA15969BC64B01F3764F3E669A08C5F4B411DB28CF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Cache\Cache_Data\f_00000b
Size 314KB
SHA256 ed79a04c5ea00f1063ef7ec7e9858f38811e437229fa92608096a47a409b841b
MD5 e57b46111243862f892bbcf5d9f73f7c
SHA1 d56bcfd994589f147a9080819edda29ef7712b5f
SHA512 4cf6cfc8e8f0183211d1ae433fba984e9a8588a5a79bb258cf921c36b0e8c3fc8f0269488a0d0b0cbbbbf88f3eaececbdacc65434d58559cfbcdbfcb880e685b
SSDEEP 6144:n1tt3Sm+SdnNJ7tgIZBcgxTb/oDAxiUSiEjNEvllktpYz6noKUNbb3Cb86f7:n1td3+S5N7RugxTb/oE8jSqy6op3cp
TLSH
T1866423D7278073B22756042ECF2A8AEED19B328C52D1B0CA150B6DC25E4DFED9D918DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 305b4ac1dbe9aced264876d6e3e14002e50aa6ec7fe338cce39053498fa7be65
MD5 2a5cae3cdad7156e1565efcfb24ead20
SHA1 07f2604d8a49c6f9ae748ce5ecf938863749fa88
SHA512 d159f9bdd9fa97324aa23e2f375ef2e5469d23d825489bb652a8f2976d5d6d2b3d7c5dd65feea9b8df13666584e6bafb75cff9998ae1fb107dfd9a8fef4dca61
TLSH
T1E131CEB3C7E891BD482106F87B24691BDD2E050B621C3E0AD8D5DBDB67F1470E265E4E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5b4a73.TMP

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Network\Network Persistent State~RFe5b4a73.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Network\TransportSecurity
Size 188B
SHA256 2f2368364322de32b1196886f6bd9e05fc404a15c3d874e2ab63a76297354319
MD5 6f86b5fb3c439a57b79593607bc787aa
SHA1 7540e711d6c2e4bb918668e1344d4e4aeee44931
SHA512 ea34d415e3009b5c10174fad3a74cb9493b4e2a6758f62cc9c49727dad1c20d6c0585249f5803e74652c6a45c02c4dff4d71ac962f17f0cefadb890ead5150e6
TLSH
T17AC0C061403FF832A0394D310ECC7D419F36F030114254E8C14303FEB0C0176620B043
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5a9d5a.TMP

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Network\TransportSecurity~RFe5a9d5a.TMP
Size 188B
SHA256 d9bafa3d573ebac21606100dd9793fd8cc6db300d2e74463097f19efcd0ca6cc
MD5 767b344ebdc47cce978bbe77946cc9c0
SHA1 3c1f22b79a6bedf657ab6c133fca531e01671cef
SHA512 b5a0daa532e19f7baae29563b197f9b88d5a0eda9a118f08b1c426f80b6cda2d4104cb8a2291c9ceb3df10981f7d71caae23dca70cdd4559faa6e9c546acb4e5
TLSH
T163C02261403FE932202809212C84AE899E3BA0382182D4E8CA4303A8618017A6703062
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Local State
Size 15KB
SHA256 bd33a7f56ce1f0ee3feb800ed5275a705392752b880926105af78226a9ac464d
MD5 d321dcd3cc462071c1741edd43e7ea5f
SHA1 995b961ccaa2356dd094b9b9e1b5016c9c805295
SHA512 f9f7a73f37886fd4027b77a625fef021665b20f4ddd9e22d85f52f5fa978c3517854df3fdee5523d1f42c70090f3d53c2ce8a8a587868a4543fbb3991932f7ba
SSDEEP 384:Y+aQikB+z/xvxjg/qhEwNBSzL8KaUy0dIi9z4:X/UxvxjgC+rAEyGHF4
TLSH
T194729F3B55793E3395F3EA157959178BDEB894B2A0C27AB84ABD5F0A07C32880342D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Local State
Size 2KB
SHA256 8ebcc1e8c783f095b0c1395ad1b6a18b36afb073056821bc870fe3b5b398a3a0
MD5 567497b2b19f6e8fa9022867fa47348e
SHA1 3c73c7915beff0c05449e11387a3b58ec569b321
SHA512 2431a3df0eead5a417695503e8b1e30feb616c50f0aab976de04cf72bab1b7b8053105030a40aea1a20c853867a1dec59c4a1dfe7dec6c2deb377500c062a2ac
TLSH
T1B351F733A954ABB795F28A043E573F13CE7560B6EA921F11EADD0B0802D315D2382C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Local State
Size 3KB
SHA256 a01ac734e1c3746cbff5f51a8dc571809f3cbdb6c736898d576e05c4251ad5be
MD5 baafee0c8b85a7462bd3344094f747b4
SHA1 71e63c3a91ccbbcdabeaed0b3b6ff081bb42bc74
SHA512 b41e90127bd931872353b3c8c259871cc1152b36d2c405371f759df1abc9b5df9c7b089fc1743c93d57b5dc3067e23375b58876a42156acb1b9ab10851a315ee
TLSH
T1BE619637AAA4AA774DF2DA0579863B06AEA55037E5853F95D6EC0F0C02D729C1381C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5a2ced.TMP

Path C:\Users\Admin\AppData\Local\dev.stellar.launcher\EBWebView\Local State~RFe5a2ced.TMP
Size 1KB
SHA256 adc9217e97cb7e0152669cf0de4ebfa972517bc7bbcf014699b094f3f2b78482
MD5 d9fa442c4a4a0ea535aa5fe0d8acfcd3
SHA1 a8f263406ccb11b5904a5bb75c7afc5886f48226
SHA512 61d0fc4ea4deb298361bf0de8d8abe393b2cc0a704ac49769fb7bf9e7b0b729179312e5af3af6faa7705444c0b97ca377b9af806fdef84ba6798a1e6dcf7b90e
TLSH
T17121B773D6982BB3B8D166063393BB4B5D60207FD2524F01E2CE4B1812E308E664AC32
MD5 SHA1 SHA512 TLSH

Submit Download

e59ff65.msi

Path C:\Windows\Installer\e59ff65.msi
Size 11.0MB
SHA256 92d189b57f2e8f6af3b85651fa6a2ea7981f5a8957f1b2b860589c1e9c14a17e
MD5 ccf6798a247933732eb13435a756dd41
SHA1 c87bf30865bffa8f49bc901df2234127c85d857b
SHA512 11ef689fb1d82e62c5b40f2bd471ebca19a4c0a6b54135b89dd48208ee74b246b54730959bc2fd899a9c22b877ff162d369bb5f9a0d222d6a530eea328614c1f
SSDEEP 196608:Bn2rUwSEEptxD/AGbl96KE/HhRE+VC2dp6x0dAN+HhC3IPLcP54z:92rD7EpPD/nZks+E2rANKhC3IzcCz
TLSH
T140C633857003C552C04832B9DC1ACAFE1D3CAEBDE59458572FF87E4DB97086ACA948DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4232-241-0x00007FFE78E30000-0x00007FFE78E31000-memory.dmp

Download

memory/4232-408-0x0000026FB9DE0000-0x0000026FB9FA3000-memory.dmp

Download

memory/4232-432-0x0000026FB9DE0000-0x0000026FB9FA3000-memory.dmp

Download

memory/4968-497-0x00007FFE7A130000-0x00007FFE7A131000-memory.dmp

Download

memory/4968-496-0x00007FFE79000000-0x00007FFE79001000-memory.dmp

Download

memory/6140-258-0x00007FFE78E30000-0x00007FFE78E31000-memory.dmp

Download