2e4342fc1117141b6f3d6366d9a64ae3a57683af202bfad0e90f3ae11839eb19

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
07/05/2026, 18:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AstroCommandCenter.msi
Size 12.2MB
Sample260507-wyl5msgw7w
SHA256 2e4342fc1117141b6f3d6366d9a64ae3a57683af202bfad0e90f3ae11839eb19
MD5 b68abbb3094c91521db24a60a750618b
SHA1 0181256a2c8840ff05961c6221fbe73d4191a6bb
SHA512 b18498e20ddfeac5dc7488394884751f893b2f281a5838d40411414f3c8e1c894b43e62c166caf621d8aa3daeafa6b6bc38d5139ad1c1ed855f3e646eccaf966
SSDEEP 393216:a27s9vyhLVYck1RITtrsGuMOyha+wIGs:ah9vuKc0IfOylwIG
TLSH
T16BD612359A96D526C36ACB78DC2FF7000B79FD1C5F2DD83099EA76BA96B46C42483403
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5800	ASTRO Command Center.exe

Loads dropped DLL 11 IoCs

pid	Process
2772	MsiExec.exe
5800	ASTRO Command Center.exe
5800	ASTRO Command Center.exe
5800	ASTRO Command Center.exe
5800	ASTRO Command Center.exe
5800	ASTRO Command Center.exe
5800	ASTRO Command Center.exe
5800	ASTRO Command Center.exe
5800	ASTRO Command Center.exe
5800	ASTRO Command Center.exe
5800	ASTRO Command Center.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	784	msiexec.exe
3	784	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Drops file in Program Files directory 36 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro MixAmp Pro TR\Astro EQ\NATURAL BASS.astroeq	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\qtplugins\imageformats\qsvg.dll	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\Qt5Core.dll	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A50 Wireless (Mimas)\Astro EQ\STUDIO.astroeq	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A50 Wireless (Mimas)\Astro EQ\A50 MOD KIT.astroeq	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A20 Wireless\Astro Profiles\Astro_A20_Wireless_default_profile.agp	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\qtplugins\imageformats\qico.dll	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\Qt5Gui.dll	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\Qt5Network.dll	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro MixAmp Pro TR\Astro EQ\BALANCED.astroeq	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A50 Wireless\Astro EQ\STUDIO.astroeq	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\libeay32.dll	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\Qt5Widgets.dll	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\ssleay32.dll	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\quazip.dll	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro MixAmp Pro TR\Astro EQ\TOURNAMENT.astroeq	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A50 Wireless (Mimas)\Astro EQ\MEDIA.astroeq	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\qtplugins\iconengines\qsvgicon.dll	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\Qt5Xml.dll	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A50 Wireless\Astro EQ\A50 MOD KIT.astroeq	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A50 Wireless\Astro EQ\MEDIA.astroeq	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A20 Wireless\Astro EQ\PRO.astroeq	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\forced_fw\mimas_190705151435_tm-35155_tr-43_rm-34843_rr-43.afw	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A20 Wireless\Astro EQ\STUDIO.astroeq	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\ASTRO Command Center.exe	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\qt.conf	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro MixAmp Pro TR\Astro Profiles\ASTRO_Default_MixAmp_Pro_TR.agp	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro MixAmp Pro TR\Astro EQ\ASTRO.astroeq	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A50 Wireless (Mimas)\Astro EQ\PRO.astroeq	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A50 Wireless\Astro EQ\PRO.astroeq	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A20 Wireless\Astro EQ\ASTRO.astroeq	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A50 Wireless (Mimas)\Astro EQ\ASTRO.astroeq	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A50 Wireless\Astro EQ\ASTRO.astroeq	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\libssl32.dll	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\Qt5Svg.dll	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\qtplugins\platforms\qwindows.dll	msiexec.exe

Drops file in Windows directory 28 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e58056a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2A7706F16B1EB014E8737E5B6B5D6770	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2A7706F16B1EB014E8737E5B6B5D6770\1.0.226	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2A7706F16B1EB014E8737E5B6B5D6770\1.0.226\msvcp140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2A7706F16B1EB014E8737E5B6B5D6770\1.0.226\msvcp140_2.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2A7706F16B1EB014E8737E5B6B5D6770\1.0.226\vcruntime140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File opened for modification	C:\Windows\Installer\e58056a.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1020629D3F4FA39E.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2A7706F16B1EB014E8737E5B6B5D6770\1.0.226\msvcp140_1.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File created	C:\Windows\Installer\{1F6077A2-E1B6-410B-8E37-E7B5B6D57607}\ProgramIcon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{1F6077A2-E1B6-410B-8E37-E7B5B6D57607}\ProgramIcon.ico	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7F836A5E9F397153.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1F6077A2-E1B6-410B-8E37-E7B5B6D57607}	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2A7706F16B1EB014E8737E5B6B5D6770\1.0.226\concrt140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2A7706F16B1EB014E8737E5B6B5D6770\1.0.226\msvcp140_2.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2A7706F16B1EB014E8737E5B6B5D6770\1.0.226\vccorlib140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File created	C:\Windows\Installer\e58056c.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0DECFF80B00BB9C4.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF420F4E4510847CE7.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6B2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2A7706F16B1EB014E8737E5B6B5D6770\1.0.226\concrt140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2A7706F16B1EB014E8737E5B6B5D6770\1.0.226\msvcp140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2A7706F16B1EB014E8737E5B6B5D6770\1.0.226\msvcp140_1.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2A7706F16B1EB014E8737E5B6B5D6770\1.0.226\vccorlib140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2A7706F16B1EB014E8737E5B6B5D6770\1.0.226\vcruntime140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
784	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ASTRO Command Center.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ef718e858b035fe80000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ef718e850000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900ef718e85000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1def718e85000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000ef718e8500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770\PackageCode = "8D0A275532114CB45AAF96D07F54472A"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770\Version = "16777442"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770\ProductIcon = "C:\\Windows\\Installer\\{1F6077A2-E1B6-410B-8E37-E7B5B6D57607}\\ProgramIcon.ico"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FE3BCEAD0CAB31C4D957678A3D29F91B	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770\ProductName = "ASTRO Command Center"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2A7706F16B1EB014E8737E5B6B5D6770\ProductFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2A7706F16B1EB014E8737E5B6B5D6770\VCRedistRelease	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FE3BCEAD0CAB31C4D957678A3D29F91B\2A7706F16B1EB014E8737E5B6B5D6770	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770\SourceList\PackageName = "AstroCommandCenter.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2A7706F16B1EB014E8737E5B6B5D6770	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770\SourceList\Net	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5800	ASTRO Command Center.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3532	msiexec.exe
3532	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5800	ASTRO Command Center.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	784	msiexec.exe
Token: SeIncreaseQuotaPrivilege	784	msiexec.exe
Token: SeSecurityPrivilege	3532	msiexec.exe
Token: SeCreateTokenPrivilege	784	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	784	msiexec.exe
Token: SeLockMemoryPrivilege	784	msiexec.exe
Token: SeIncreaseQuotaPrivilege	784	msiexec.exe
Token: SeMachineAccountPrivilege	784	msiexec.exe
Token: SeTcbPrivilege	784	msiexec.exe
Token: SeSecurityPrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeLoadDriverPrivilege	784	msiexec.exe
Token: SeSystemProfilePrivilege	784	msiexec.exe
Token: SeSystemtimePrivilege	784	msiexec.exe
Token: SeProfSingleProcessPrivilege	784	msiexec.exe
Token: SeIncBasePriorityPrivilege	784	msiexec.exe
Token: SeCreatePagefilePrivilege	784	msiexec.exe
Token: SeCreatePermanentPrivilege	784	msiexec.exe
Token: SeBackupPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeShutdownPrivilege	784	msiexec.exe
Token: SeDebugPrivilege	784	msiexec.exe
Token: SeAuditPrivilege	784	msiexec.exe
Token: SeSystemEnvironmentPrivilege	784	msiexec.exe
Token: SeChangeNotifyPrivilege	784	msiexec.exe
Token: SeRemoteShutdownPrivilege	784	msiexec.exe
Token: SeUndockPrivilege	784	msiexec.exe
Token: SeSyncAgentPrivilege	784	msiexec.exe
Token: SeEnableDelegationPrivilege	784	msiexec.exe
Token: SeManageVolumePrivilege	784	msiexec.exe
Token: SeImpersonatePrivilege	784	msiexec.exe
Token: SeCreateGlobalPrivilege	784	msiexec.exe
Token: SeCreateTokenPrivilege	784	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	784	msiexec.exe
Token: SeLockMemoryPrivilege	784	msiexec.exe
Token: SeIncreaseQuotaPrivilege	784	msiexec.exe
Token: SeMachineAccountPrivilege	784	msiexec.exe
Token: SeTcbPrivilege	784	msiexec.exe
Token: SeSecurityPrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeLoadDriverPrivilege	784	msiexec.exe
Token: SeSystemProfilePrivilege	784	msiexec.exe
Token: SeSystemtimePrivilege	784	msiexec.exe
Token: SeProfSingleProcessPrivilege	784	msiexec.exe
Token: SeIncBasePriorityPrivilege	784	msiexec.exe
Token: SeCreatePagefilePrivilege	784	msiexec.exe
Token: SeCreatePermanentPrivilege	784	msiexec.exe
Token: SeBackupPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeShutdownPrivilege	784	msiexec.exe
Token: SeDebugPrivilege	784	msiexec.exe
Token: SeAuditPrivilege	784	msiexec.exe
Token: SeSystemEnvironmentPrivilege	784	msiexec.exe
Token: SeChangeNotifyPrivilege	784	msiexec.exe
Token: SeRemoteShutdownPrivilege	784	msiexec.exe
Token: SeUndockPrivilege	784	msiexec.exe
Token: SeSyncAgentPrivilege	784	msiexec.exe
Token: SeEnableDelegationPrivilege	784	msiexec.exe
Token: SeManageVolumePrivilege	784	msiexec.exe
Token: SeImpersonatePrivilege	784	msiexec.exe
Token: SeCreateGlobalPrivilege	784	msiexec.exe
Token: SeCreateTokenPrivilege	784	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	784	msiexec.exe
Token: SeLockMemoryPrivilege	784	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
784	msiexec.exe
784	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5800	ASTRO Command Center.exe
5800	ASTRO Command Center.exe
5800	ASTRO Command Center.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3532 wrote to memory of 2772	3532	msiexec.exe	79
PID 3532 wrote to memory of 3036	3532	msiexec.exe	83
PID 3532 wrote to memory of 5800	3532	msiexec.exe	85

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\AstroCommandCenter.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:784

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 14DE795F8C3F4EFEC6B5E72D13E89B0D C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2772
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3036
- C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\ASTRO Command Center.exe
  "C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\ASTRO Command Center.exe" -show
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:5800

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58056b.rbs

Path C:\Config.Msi\e58056b.rbs
Size 22KB
SHA256 7130454e7e1104accfdacb95d5d297b460303c050b51c440ea59194739572ae2
MD5 3dbe2adb43937cbf6eb08bfc204ad20d
SHA1 50300cfef11b42988f04bd944c622e3d10e3194e
SHA512 a92ce24eaccb7da23eebf2b9345c6c3ec60fafc5b2a67229f9be2e4be2590c29bbbf0bcc014d56581dd1ed685cec31a0b4eeb5a33c0921e529d233954366b6e9
SSDEEP 384:HUuHwE0YWA9RClRnPsd3Eu3SSYbca6x/xvCuCd:HUSNCXnPsd3EuCSYbca6pAuA
TLSH
T16AA23543298282F6F8D355B1BBD30F2933B25F70936E051F0ADC297A7D87B862671295
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ASTRO Command Center.exe

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\ASTRO Command Center.exe
Size 2.8MB
SHA256 991e558129af98765cba4f02b10fa5cc4d537e2b6bb4bd3032ca010832eb2dcf
MD5 c0e64bd79e071c17ee1246180eb4b373
SHA1 e0808d7755d13563e212d927d6f36b8c07984c3d
SHA512 859de816b14cd6af94defffb315eadde1886ec67ee1db62bc3f90635a127b9ae8c06bda28c257860547ff68a238ddc16169888da45bb538945d35eaf6fc4ad4b
SSDEEP 49152:8qmYxHOi7v8Ow/Zs1h5e+ZHkJcLbVL/sU6Zj:7mYxH52Zs1h0+DLbqU
TLSH
T18FD56C312E5AC426D32693B99C6FFBA1872DBD0E0F18A8F3B4ED356A57745C11DA2013
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Core.dll

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\Qt5Core.dll
Size 5.1MB
SHA256 b967ade09a9338320e0db4e5da11a2ac396950f0eed689b28bd31686b7baf018
MD5 b517914bd1779b312611b5a52b0ef24a
SHA1 5d7ee138e70eca65d35a76bd2285453a764daaf6
SHA512 cab8a6a8b4c8eca738348812e530e5b186a88a08f65949753e6bdcc3c7bf1ffa79fa48ae718be4173b14ca4a3b6fbb0af240c800fbd426989d8a0ae7646425f5
SSDEEP 98304:53QkIHj14FdDhqJsv6tWKFdu9CjzHveRnZyxEdm4:5gdnJsv6tWKFdu9CjzHeH
TLSH
T196369E917F978176E5A2D270C87B671F4029E9024B1245CBD3DC360A9A79AE13F3B70B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Gui.dll

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\Qt5Gui.dll
Size 5.7MB
SHA256 ab160992f30dc69b97feedd2fcaf7528a56fc98a3f30a166c1076589340ac8be
MD5 c4a857dee5656921baba1e19d2b099b6
SHA1 7e3e634d5b2f101ea2838ec2c13158113ce33e62
SHA512 8456610a8d84606ec5784dca12b1ed34ceee6e7c716871db4165fc0ca9042fae097fe0c37afb645eab860cd09d1d559fe6a8040a980387ef425d9af366441e53
SSDEEP 98304:+8oNJzx4w24LwWotu+PNlwL9PmEZ23CeG:kBbUuCPwNj2Cb
TLSH
T1DE563BD1B1827173C9A2D2BE670F663F9077A956C34483C38699AF8554703FA0F7BA06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Network.dll

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\Qt5Network.dll
Size 1.1MB
SHA256 ddc9894e36231d749265155ba02f2d70ec5e006cea34010750b220ce49ce391a
MD5 a00d38af148cc8a6481ef182f86b77ed
SHA1 76b401ee60ca094d3da04524401e5d6eb80d3bb6
SHA512 0bfc7d1ad67d8ba837a76f91876ab4cf452712017d0698bdc4e4c6496b084829bd03d93f76ab6a9bc0793b8ba1216fef9de927b849842ed362e135715ef5b9fd
SSDEEP 24576:TNfY4/b8d22Gmou3ZjRkjZgUPiV69DrOMxpqDc0EGQVzKa+:7Ad22GrziVaSDckf
TLSH
T1CC355B62F38304F2F88951B5891ABF7BCA3BB214471656C7EA0C6EC6D9917C1193F1CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Svg.dll

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\Qt5Svg.dll
Size 265KB
SHA256 50d06d42a71101e6fb7589676a67a0d763f39fe66dddf3d036b08aeaaf5dc71e
MD5 0e8c3d38a0a28a3de3dab77da32d412a
SHA1 714b244a8cd86cb25eb7245ffe122582013a092f
SHA512 1ce342cce2c0987d4b8677fd466e783978336bc6cc1519a86a52846a752e2a3d7b45ddc00a02847f49e08b4bb231be29aa1e7fdab7a050cc165605ee9ebc28fc
SSDEEP 6144:O4II9g1KI2MdfiJl/13VytiQ8y8DvEt/Q7FYxyFUUv6Wa32VXxWFaHKXh:OP/V6Jd7LKR
TLSH
T1F0444A52B2430DA1D68DE378785F2B2BDA3AA14203798FEBC2999C2179253F05DF7345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Widgets.dll

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\Qt5Widgets.dll
Size 4.4MB
SHA256 4a12866260ff266eeffe0b4d8eaf27ed064682f00e8907bd53956f446e23c496
MD5 eb4aea9ff7c75da2a4925e83f8defe3e
SHA1 efa4566fb9e7a4de722a177956dff0f43d88638a
SHA512 42fb74b3a1e08e2652c8a0459eb04e3b21446f82be4c07736a08d2d20f681781201154c9e48dadd55118c8ed2b53e324ef1708e36e169458ddaa57d21d6a4cd3
SSDEEP 98304:n1CmFlF05UMNO1ulAjhDfTbz7quDp+bXa6gYzdkSPD1UZlH6uV75uDdHBclxooGJ:Rf59iJ5n
TLSH
T136267D93F6C242B1D8D6C178495F6B63CA36B0CB4B9552E7D38DEF4664202E02E7F246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Xml.dll

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\Qt5Xml.dll
Size 150KB
SHA256 398f670ea5dc065e7796346bca1c2ad5d2c01b1325a93e82ef921f5f36769d06
MD5 d2ec84fdfea3f694a3b8415e1dc61ad2
SHA1 511fa6f7e2e3d9596542f91cd297eacec75f499b
SHA512 deaa75577c7e2553f16499977d170831ca87a140bb0d7a1ea515f2c6df0372c180acf416aee720123351e8eb71c534585bb509c13b073ba332141b643b60ad8f
SSDEEP 3072:TcxDXrgrVb0x+ULoJ0yDqM8NlJ0cJnIGUAH22lt54kxzEs:gxDXrgxb0AHqyD6lnXt54k1
TLSH
T1BAE319F2726542A2F0B382341C5F5A3EEA7FE91C43B542D3E35D6D2389246E15E3B246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ASTRO.astroeq

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A20 Wireless\Astro EQ\ASTRO.astroeq
Size 257B
SHA256 d19a8df35ab05a9f6b1653986ea454f9308f9305b80d22d7294af3baba6ce590
MD5 74ed038bf1561cead10d247658ed5a7b
SHA1 7df3470bf18f6e75c176c121bde9b2b6a3e332a2
SHA512 06d1b58d3de257a0112a92d35ffdde2f01748182cff96cc1da7da082e051dedaab9d951d23dec8a763631eca13c26742b1050b5e18b192ad11a5d769951d65b2
TLSH
T16DD0928A440A905CDACF68FC9C21DCC901A1ACA56FDBDB35506BB11E3E90F5110D8085
MD5 SHA1 SHA512 TLSH

Submit Download

PRO.astroeq

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A20 Wireless\Astro EQ\PRO.astroeq
Size 259B
SHA256 5da2890323ce3d7bb0fd05aa998e5128e8571be0338c57462a4eb7ec841cca24
MD5 3c4e408a75ca1fe1d2f66d88a7efede9
SHA1 e6d217b94fbedceca803b5e6151c5f0c60ec7d98
SHA512 e7f8e54e85027ec7120125227d70cbfb85abd748c83182a3bdf9462b817fab921a46616cb0b3e21ec5287abfd37fcf362590138a3fc1bb425482c59785c64d49
TLSH
T151D0928A051E90ACC8CF05FC8C41DCCA01919C6AAFCBD775516BB51C7AD1F5210E8081
MD5 SHA1 SHA512 TLSH

Submit Download

STUDIO.astroeq

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A20 Wireless\Astro EQ\STUDIO.astroeq
Size 259B
SHA256 4793f9cfd1727aa2f58dd21d2c3d73b6fbe287c704bc4a975e78bd60d0d6a62f
MD5 d50f1e9df1b08bb84a682683910350ba
SHA1 05e04e2687effc7754924fadc1cbd586773fd474
SHA512 c65a9281767c4549e492e5b9cdcd4e0b0e7c0602107681866c65956063672fc8520095399dc75e718e55048c8f9480c66493af65d27dc37f77fdd7b6bfe7846f
TLSH
T1F8D0928A042A91ACC58E15F88C00DDD915919CAAAFCFC7B5806FB1093ED8E6100ED845
MD5 SHA1 SHA512 TLSH

Submit Download

Astro_A20_Wireless_default_profile.agp

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A20 Wireless\Astro Profiles\Astro_A20_Wireless_default_profile.agp
Size 1KB
SHA256 a8d230a3bb890696212749dc1a8ded5ce5ea6cf3edc00d6ce366db4c57c2f607
MD5 6c452236d81d531e20edf370ef2c7b02
SHA1 92b9f5eeac0e7be162837e1994b9b540f3ceb76e
SHA512 3e953e24e250fc85baad32d2ea9227672bed1a985802d9a565660a87c5504686a35d1991d617128a9d05006a63c4eeb365b65e54832483d93b394e967b5ce5b0
TLSH
T14D31A2854C8A907ACF9FF2F44A16C68D88A074D457CA873343F7B58E95A0DE71398D42
MD5 SHA1 SHA512 TLSH

Submit Download

A50 MOD KIT.astroeq

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A50 Wireless (Mimas)\Astro EQ\A50 MOD KIT.astroeq
Size 275B
SHA256 4d85e0bc052c25e30d83f6fe13618594c8cbb1bccb66d8916c238ba3882e39e3
MD5 f4c24b12294f030c1afe8019c5371374
SHA1 6b24679f345377bc8f3cd286fd36ad8010b10ef4
SHA512 64ff556ca57f6c0655fd9f720191327fe36e95c342251b19cb8919d1c0d0c50897ea34bf499e85ebf522ae38eb40395a234f1918f14f338e584210ad01874433
TLSH
T17AD0928A855F917CD9CF18F08D10DCCD0690AC269BDBE77490ABB53937A1F9110ED081
MD5 SHA1 SHA512 TLSH

Submit Download

ASTRO.astroeq

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A50 Wireless (Mimas)\Astro EQ\ASTRO.astroeq
Size 258B
SHA256 6c6a1bd6098e389b978d5751aaf8ca233c12811e5fcf1b05e8edc9085e049264
MD5 a4ec82ffb0baf3ff721f750bc267caee
SHA1 35e181df8afacb462a41a7349867caf5433c7d1d
SHA512 41354cae528f63c5d16897035622b07f11fd73da86019056d945b3117aa5817aeef831aed5d791831d5ebf7a585c3a7749a8f3c072271775036a3bc693c25941
TLSH
T1F7D0928A042AA1ACC98F15FD8C01DDC915919CA9AFCFC7B4806FB1093AD8E5110DD845
MD5 SHA1 SHA512 TLSH

Submit Download

MEDIA.astroeq

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A50 Wireless (Mimas)\Astro EQ\MEDIA.astroeq
Size 260B
SHA256 d1156ecfdeff0f9b199da73b3877cef824bebeb0a73107a3c6df86d45ec0c799
MD5 8584d442ee006bd720c42e346f08f0d5
SHA1 c1f5bf00c72a3fd6c4eb26dab8fe2769590ba55d
SHA512 3397b251cf013603721f9c2f53916916a67934d6f02146b815dfc61ea30d5d6dba6ad014e0eccfb11b7b5139f9f72865cad93e25c055492f8174433f621b9062
TLSH
T18AD0928A091B50A8C98F15FC8C11EDD901A09C66AFCBC735512BB5197BE1F5110E8041
MD5 SHA1 SHA512 TLSH

Submit Download

STUDIO.astroeq

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A50 Wireless (Mimas)\Astro EQ\STUDIO.astroeq
Size 258B
SHA256 e7779509dce27f5a4198271753915af7ab19ef69e8ae36d70ec4a6a7cdb671a2
MD5 d1534fc240dc3a9818b3e160f423dcc7
SHA1 c8e83b222aa0a0ed988ff259c0547ba11e98808b
SHA512 a704f6c06c40b1ffeb9b29fa431293f2363b9561068333aad3ecf1fdce9972a5b5fa9c746b11ad4ed2862296d70eab2b8ba6b9da5799cfc10527dd620ae8da5a
TLSH
T16ED0C98A440A904CDA8F54FC9C21ECCA01E09CA96FDFDB35506FF11D7DD0F5210E8085
MD5 SHA1 SHA512 TLSH

Submit Download

A50 MOD KIT.astroeq

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A50 Wireless\Astro EQ\A50 MOD KIT.astroeq
Size 268B
SHA256 9b95bf57573bfede771cd463dd2f4488c8ae93a0fad44f62d642d1c4903fc15b
MD5 8fe09ee8c59179e8800076b838aac24e
SHA1 bb369ff11f8085ddd496eb0559c8c88840ac0a5f
SHA512 12e20c9ddb570a7b360d26ae2a3a9efb994c30dba08296faf7186302005565137610827dc44384fc938049f1b5e9c6033b9b0a5b6e775c97f6d64498fa053f09
TLSH
T108D0C986455E857CC9CF14F89C50CCCD05919C624FDFC7B5916BB51E3AC1F5210E8054
MD5 SHA1 SHA512 TLSH

Submit Download

ASTRO.astroeq

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro MixAmp Pro TR\Astro EQ\ASTRO.astroeq
Size 261B
SHA256 41284d782467bcbc483dfee9ea12fc97fe8f38c2e5dfb47aa7162fffe5645d9c
MD5 9ab341e4dedebced907846c05313d7af
SHA1 c9f2a435f5068707bea4e9b205eda32b093bd4e8
SHA512 ff1d0e646b8796a7b0cac781094610b5f6ca273e7c73c497eaaa5dc904ce2596431d5053571974345c07d54e96339133a5699fa546741edd0e79be504c7d8a4f
TLSH
T17FD0928A052A90BCC8CF15FC8C01DCC901519C6AAFCBD775512BB11C7AA1E5120E8081
MD5 SHA1 SHA512 TLSH

Submit Download

BALANCED.astroeq

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro MixAmp Pro TR\Astro EQ\BALANCED.astroeq
Size 262B
SHA256 01bb52ce11faf443124bfa29c20f34bb4ce71378a92d1948519a7cb86a6083c0
MD5 e8a252616a3cdfd768961046b6ecfb14
SHA1 4d30d2ed8639201f804a2f8dd261eaab19827571
SHA512 1dc5cb276a78f9cdcb20be5eb9d8279afb2c4d29ca3f7cbe92d781530270c5403d6fdea30ae381178222e41ab67683d0c0fef3eb6fc7a2fbcb8d375b5d5cf00d
TLSH
T121D0928A050A406CC58F04FCCC50DEC91251AC2AAFCBC774412BB1193AD0F8510EC080
MD5 SHA1 SHA512 TLSH

Submit Download

NATURAL BASS.astroeq

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro MixAmp Pro TR\Astro EQ\NATURAL BASS.astroeq
Size 264B
SHA256 f4983943e97ad985f4454a1db9f4a21436d7137bc7fa99f918f1de7366fe39c7
MD5 ed9f51cecde56fafd2abe469bb50fbe4
SHA1 49ae6c0e7ab11b95b74ab637a2b831f460e8665b
SHA512 76da39953489252b72be5ce02b9e9ce501e15dbf175c8636f7d7809160db816337c6dfc27c58f94cb0715b73999154bbef3becdc5dcd9a141acc834254469f4f
TLSH
T176D09286490B6098DB8E10FD9C25EDC901A09C6AABCBCB74412FB2197EA1E5110E8081
MD5 SHA1 SHA512 TLSH

Submit Download

TOURNAMENT.astroeq

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro MixAmp Pro TR\Astro EQ\TOURNAMENT.astroeq
Size 263B
SHA256 75183fac94ca4abe1169a2069773a8359c23d0cb274a8402983e2823b965184c
MD5 15b704b7f14e34dfbbf3d9c5244c9f19
SHA1 4bf60596e02bae354bbf2a2e4eddd0ca4324bc61
SHA512 eeb05ee3de821ab11659e39f509c7f4b80c4649465c391d85b5748796375068be035db3b05a0d706ccfd459c5e6311777174f7044d0febfb7e6b266f78dd31a4
TLSH
T185D0928A042B65ADC68F15FC9C01DDC915919CAABFCBC7B4816FB2093AD8F5110ED855
MD5 SHA1 SHA512 TLSH

Submit Download

ASTRO_Default_MixAmp_Pro_TR.agp

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro MixAmp Pro TR\Astro Profiles\ASTRO_Default_MixAmp_Pro_TR.agp
Size 2KB
SHA256 f4d298382370ed52428694f1617aaf956c8fef7b36f9f763855d41e0cce299fc
MD5 cf0565a7ceda382b62f3e74051d990f2
SHA1 5df1fd744277bad50ea7fc47b0f2e15949083d5d
SHA512 77d2534521346be3074a65668c020458d0c991473dc04508d50a11f412381eb6606caf83f7925aad55f09d2df35d4bc2aadcbf86f88e172b651737d1a037f367
TLSH
T15641BE454C8A907ACF9FF6F44A17C28C49A074A157CA873B03F7B58E9AB0DE31398D46
MD5 SHA1 SHA512 TLSH

Submit Download

qt.conf

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\qt.conf
Size 30B
SHA256 6a5af4838e31c4fa4183deba6b2ee4db51d0bede8d5531a3b4bdddeee1e3d131
MD5 dc09a645c5ba9eb20f93ca30fa7ba4a5
SHA1 fc6bfee49329370d477340c9b488491dbc1dcee3
SHA512 d2f6744ac437c603795d8fd9f666a0979cfa3ec9c3a1bf496e82e04e95d5b2da953aee01fd79f38560515a41b14c87d777aeb14445365d6750408484fdd1a572
MD5 SHA1 SHA512

Submit Download

qsvgicon.dll

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\qtplugins\iconengines\qsvgicon.dll
Size 34KB
SHA256 d9e295d76a5d73c33da67a0326c2bd43b90b7b4e19e03a4637c4a0eab6b3ce04
MD5 cfeb113baba89e047269a103cd60e8c8
SHA1 8f4d01ae36870566f3642910dc3288066f9fd27c
SHA512 57332e93a71101196d0cb5411b7c1f3aee00f7b2887e33bdfbe06a872dfa5afe0db9099927ddcddb1463dd7a59f78eb68fb246fbb6e77d6164bad57f89480565
SSDEEP 768:oE7X1LJChKSkvyOLvVkxeZvhMgpEk41tmmzA:3T4K7jVk8ZvhM2Ek4fj8
TLSH
T1A3F24AE2662910E3F2569630355CEE27C83EFBB01BC1C5C7D72B5A5958563F27E3820A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qico.dll

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\qtplugins\imageformats\qico.dll
Size 31KB
SHA256 4862df5f6eb95a35de772d6fc339d6bf611b5f7b197d4edfba3e2bd42f4e8510
MD5 95660dcf5679a1a75af9e6b22e40db3e
SHA1 2f07377ae459b60fa6e26813c8c491564e608ffd
SHA512 d7b3de6ed65780d5d98c7310aa0bc48c8ce7ec1c593adc8d34e2c9a48181fdf26782e0a700807be9b5d6ad1d9a72806d69811512a7e9abaeac3253279462c683
SSDEEP 768:sfCWKJEH+0wYyCqPWHy37BejWoC56sMumzgz3mfb:8l7+0w0QWHy37BejNC56sMLIWz
TLSH
T1B4E25C41EB1A94F3D6578A70199E9737DB38BA604FC18787ABE386112C563E33E3420D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvg.dll

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\qtplugins\imageformats\qsvg.dll
Size 26KB
SHA256 2a1b19e014563e3b3ccda0025604f94c08427598cc8c534f18b12a3340b27ffc
MD5 d0783c4c78a86c6470b90e39c9065b74
SHA1 4c9ed41b8d292f4104a72a365a903af3559907f0
SHA512 4397fc387026781b5a3da42e776518629ab9f0423a194e7d760c4feb80eb9712aa6e262a85ca1b93cc9f78df1ca136615bfd1ecc58604a7d47e305b020b44e01
SSDEEP 768:759K0WZmBaxfz0Yu646rA9fJ0hTBmFmzI:CBZmB4oYu646rUh0hTBmg8
TLSH
T17EC26C43F71A54B3D26B96B42698976BDC3DF1504BD2DB8B9F1386441CA83E12E3820E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\qtplugins\platforms\qwindows.dll
Size 1.2MB
SHA256 2565fe1111bf0ba6b98683030b8da92f77da877d0a981f712184e4ce5018b723
MD5 85aa93ec804343839e9710de5bc728f1
SHA1 3186488ae25d55249898ce968c911dc48bda3950
SHA512 d54cdc252436b7f71f83bd9af2f9bdacfe2f9d478a4502959498fa3eb7b8cb822cb5caf1d68297cd95c97a64c2706373fe2cbce22e620ada6b731dd9bad199ae
SSDEEP 12288:uYCQWyni5LoUmhY4or3D8kSqjPfmK7UpOVpYAlCRegIe5ZpzNAoKu15XSxDyfEWJ:fniF3z39xPePpOkaXze5ZtN4bZa0c
TLSH
T1D0459F41A77245F1E4891774035EAB3BCA39621C0727C5D3F3947E92F9222E36A3B35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

quazip.dll

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\quazip.dll
Size 124KB
SHA256 e12aebf9e54c4f34916510dee073fd42da81997f4b89397bd3982519c7088cb6
MD5 bf25d7ddc32e8684bb05e45faa6de075
SHA1 285da75da5b0f2e543f80108041ebec9080e8658
SHA512 8e4e555d1eb65e847937c0dcccc5d891ccf7942eafcabb4e3354d4b21f498f230e2c99285d100194ba661a03a14677b263a662024801d6de04cfecd6c3321883
SSDEEP 3072:QaUme2MXALa/STXghuqcSj4aZWbquwalk9GZ36/N8:Qv2YcSqbquwalHiN8
TLSH
T1A5C35B52762B81BBE59D507C0C2C872FD22BD7B98F5682C3E3195B5608309D3EE35197
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5
Size 471B
SHA256 ce2282e13cde406bd7c9d499a8cc4879b0d3c5f6532f2cff998de6c58f60733f
MD5 cdd93857625630c2bcaf6944bd470635
SHA1 bcd753925c8fad49dcfb16a918d9a2ab749cc25b
SHA512 345113a94701dbd51fa64fb1fc2b0c4c62cb715954c9002d6f0994913f28e8cf8e50c5ff46eb5650d166690547ef8ecc191635873bbe4bfdce8fefe3ef23cba4
TLSH
T132F0DC3A283BA469A4520CE82FE688E83693644E0DC74813A8A837D04E55BA0B14E814
MD5 SHA1 SHA512 TLSH

Submit Download

66AE3BFDF94A732B262342AD2154B86E_3533FE5C58CA5A208C0D7E1CA4587D40

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_3533FE5C58CA5A208C0D7E1CA4587D40
Size 471B
SHA256 485d9d690fe31b41b1f1aa558975976b8491e27804f00d97e5dab5ba1ede6ed6
MD5 d51bbfe8108f3b622f1e46dc0af22faf
SHA1 d13b4765303b3eccf14c1098bb2a1c1ef4c9488d
SHA512 590965c2df9641ef09f67c78f3970fe78e37ab033bb1af69234b75dd5ef42f3855e3f6b14525551d60084781fed780569cf58d7e6712b5261aedf16974dff876
TLSH
T15CF0DC2664F64814884AA818BFD891777662616900CC0E536A297D0A151EBBA6A2EEC4
MD5 SHA1 SHA512 TLSH

Submit Download

42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5
Size 404B
SHA256 bd851315bf6915349aaf0f30b185d959372a70905e53b720163af0954fee072e
MD5 6f988684fb16696f8c3af409afaaa6f5
SHA1 34d842fda9c34e526c199f176c35ed5fdf6fa442
SHA512 d789d94ec6f8723cfbb658f88140be3ffa1b31bd055349a761d45af59a6783f943dabecba2d801c721afcfc7454a4fc1a43ec151bdab6f83be3cad7833ac9715
TLSH
T199E0C01017FF611EF560BB3403D590A99F05F1012C6457B90480411FAF01E104C31834
MD5 SHA1 SHA512 TLSH

Submit Download

66AE3BFDF94A732B262342AD2154B86E_3533FE5C58CA5A208C0D7E1CA4587D40

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_3533FE5C58CA5A208C0D7E1CA4587D40
Size 400B
SHA256 5b69ebb95a7624cad1b06cdeb2490793335b33854a87beb24a8b7e06414d170b
MD5 97280d93fc1f26096354f5922d331693
SHA1 cf5b8a9285d5c2d5059b85d59cb78a3a02cdc7ca
SHA512 36535b7ae70559b6f8c77d5c383ad699d981d5192bdb61f53e2ae59c05a09323639f12f9f3d2c4b3437c2f3f14afe60a72efe775018d2412da89479239021502
TLSH
T1F9E0262422F682ACFAE4A83547D9A0A28A39F340394087AA014060087F11A80CC67B3B
MD5 SHA1 SHA512 TLSH

Submit Download

MSIB5B3.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIB5B3.tmp
Size 113KB
SHA256 aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7
MD5 4fdd16752561cf585fed1506914d73e0
SHA1 f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424
SHA512 3695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600
SSDEEP 1536:YImZwomOndvrhsgz56GoiFmntw1ebC0fsWk0FlcdOJKJpPpxyNokVbY4:jewOdvregz5L/mxb7FUOsrPpxyN7/
TLSH
T19EB37C1275D0C072E8BE0E3D45748A715F7E7930EF648AEB635812694FB42C0AE39E67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58056c.msi

Path C:\Windows\Installer\e58056c.msi
Size 12.2MB
SHA256 2e4342fc1117141b6f3d6366d9a64ae3a57683af202bfad0e90f3ae11839eb19
MD5 b68abbb3094c91521db24a60a750618b
SHA1 0181256a2c8840ff05961c6221fbe73d4191a6bb
SHA512 b18498e20ddfeac5dc7488394884751f893b2f281a5838d40411414f3c8e1c894b43e62c166caf621d8aa3daeafa6b6bc38d5139ad1c1ed855f3e646eccaf966
SSDEEP 393216:a27s9vyhLVYck1RITtrsGuMOyha+wIGs:ah9vuKc0IfOylwIG
TLSH
T16BD612359A96D526C36ACB78DC2FF7000B79FD1C5F2DD83099EA76BA96B46C42483403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 548af7fcc9e5d9169e6df9ad3e0bfa2f7f63006fb4b3e24e218d7272589e0cdd
MD5 c9db73da6a12b0e5359f805b718af90a
SHA1 dd4bef20c9f92d89775e19df9a2f163acd36b980
SHA512 e2c5f6c877fe46b51d72fed89348a574b5da449ce49eb8a07b69c6749769a1c016d18ad6a79a0e4207702d0d8dde3c3feb97b0c5d57cff3d59cba34b585f9d82
SSDEEP 24576:wZ1mSpt5doO/vvTL42z+h03afaVfw4XZ2GANn50jKIKYkv3i4YS+7LZEP:G
TLSH
T19447A42436F92100E7F79E3CACF0AA63493A7D5B9C15DE8D45411B4E0922BB1E872F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{d7b346bf-cb0d-43ce-b454-389409865305}_OnDiskSnapshotProp

Path \??\Volume{858e71ef-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{d7b346bf-cb0d-43ce-b454-389409865305}_OnDiskSnapshotProp
Size 6KB
SHA256 a4182da6de680f87ed81dcc840d0c9df9480e4695244433a3d67cb43ba5794b5
MD5 81f5fec84e6eb8caed714a1b090f271e
SHA1 c742e30d4287bc5e1dfacdea076ff3505ea23847
SHA512 fa5839e55555c176657f3a79ad1a7cb8658a9202b95084d9260186ab0e0fb76d00447b8d549c2875d4477c8a7a693b011ffd98f6356cc2b205356a1f63a41a58
SSDEEP 96:FLRvfMFDD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:p21b++ZVmN
TLSH
T16ED18A085AE54311E2B3AB7129F18557A877B811FF33CB8E0198238E2670A11F935F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/784-8-0x000002CE401F0000-0x000002CE401FC000-memory.dmp

Download

memory/784-9-0x000002CE408B0000-0x000002CE40D1C000-memory.dmp

Download

memory/784-167-0x000002CE401F0000-0x000002CE401FC000-memory.dmp

Download

memory/1120-18-0x0000026CD5100000-0x0000026CD556C000-memory.dmp

Download

memory/3532-169-0x0000017405980000-0x000001740598C000-memory.dmp

Download

memory/5800-170-0x0000000005720000-0x00000000057FA000-memory.dmp

Download