91e2721bed1bbe9cc02bdcc956345e14fcb58f57d93ba40956416f1304ba2d06

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/07/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_5a0cc0bcf7275ba808f608cf2aefb148_hive.exe
Size 3.5MB
Sample260711-e7mdbsbx3q
SHA256 91e2721bed1bbe9cc02bdcc956345e14fcb58f57d93ba40956416f1304ba2d06
MD5 5a0cc0bcf7275ba808f608cf2aefb148
SHA1 819aec3c4eed0300b60001767bf292160db296a0
SHA512 615baac7fbf4c1e765ddde3883ccc6bf912b7ace2668152784ff91e35bcda027c7567f63f6a098b5d815e26fb78eaf2300314364e8d9db20b0d3374e47ad4752
SSDEEP 49152:L5wqglujg4i2mv1PdGqL+vyUOJlN9FySvZ3NvkW8EX/tMfA5gMmpsaHWC49LvVkW:twVQkXKvyjdtR3FzZCfA1mRoVvStt
TLSH
T18506332CB40EF876D294107D0EF5589CDF5DB22EDCA247CB53AEE03E857194D24A8272
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery spyware trojan upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 13 IoCs

resource	yara_rule
behavioral1/memory/4572-0-0x00007FF6ACF70000-0x00007FF6AFAFB000-memory.dmp	UPX
behavioral1/memory/4572-239-0x00007FF6ACF70000-0x00007FF6AFAFB000-memory.dmp	UPX
behavioral1/memory/4572-501-0x00007FF6ACF70000-0x00007FF6AFAFB000-memory.dmp	UPX
behavioral1/memory/4572-521-0x00007FF6ACF70000-0x00007FF6AFAFB000-memory.dmp	UPX
behavioral1/memory/4572-525-0x00007FF6ACF70000-0x00007FF6AFAFB000-memory.dmp	UPX
behavioral1/files/0x0008000000024726-552.dat	UPX
behavioral1/memory/4572-561-0x00007FF6ACF70000-0x00007FF6AFAFB000-memory.dmp	UPX
behavioral1/memory/4572-562-0x00007FF6ACF70000-0x00007FF6AFAFB000-memory.dmp	UPX
behavioral1/memory/208-703-0x00007FF714680000-0x00007FF718D47000-memory.dmp	UPX
behavioral1/memory/208-816-0x00007FF714680000-0x00007FF718D47000-memory.dmp	UPX
behavioral1/memory/208-848-0x00007FF714680000-0x00007FF718D47000-memory.dmp	UPX
behavioral1/memory/208-866-0x00007FF714680000-0x00007FF718D47000-memory.dmp	UPX
behavioral1/memory/208-867-0x00007FF714680000-0x00007FF718D47000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
208	AstralRPG.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-11_5a0cc0bcf7275ba808f608cf2aefb148_hive.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AstralRPG.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4572-0-0x00007FF6ACF70000-0x00007FF6AFAFB000-memory.dmp	upx
behavioral1/memory/4572-239-0x00007FF6ACF70000-0x00007FF6AFAFB000-memory.dmp	upx
behavioral1/memory/4572-501-0x00007FF6ACF70000-0x00007FF6AFAFB000-memory.dmp	upx
behavioral1/memory/4572-521-0x00007FF6ACF70000-0x00007FF6AFAFB000-memory.dmp	upx
behavioral1/memory/4572-525-0x00007FF6ACF70000-0x00007FF6AFAFB000-memory.dmp	upx
behavioral1/files/0x0008000000024726-552.dat	upx
behavioral1/memory/4572-561-0x00007FF6ACF70000-0x00007FF6AFAFB000-memory.dmp	upx
behavioral1/memory/4572-562-0x00007FF6ACF70000-0x00007FF6AFAFB000-memory.dmp	upx
behavioral1/memory/208-703-0x00007FF714680000-0x00007FF718D47000-memory.dmp	upx
behavioral1/memory/208-816-0x00007FF714680000-0x00007FF718D47000-memory.dmp	upx
behavioral1/memory/208-848-0x00007FF714680000-0x00007FF718D47000-memory.dmp	upx
behavioral1/memory/208-866-0x00007FF714680000-0x00007FF718D47000-memory.dmp	upx
behavioral1/memory/208-867-0x00007FF714680000-0x00007FF718D47000-memory.dmp	upx

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-07-11_5a0cc0bcf7275ba808f608cf2aefb148_hive.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-07-11_5a0cc0bcf7275ba808f608cf2aefb148_hive.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134282181197931149"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-07-11_5a0cc0bcf7275ba808f608cf2aefb148_hive.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	2026-07-11_5a0cc0bcf7275ba808f608cf2aefb148_hive.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	2026-07-11_5a0cc0bcf7275ba808f608cf2aefb148_hive.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	2026-07-11_5a0cc0bcf7275ba808f608cf2aefb148_hive.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5012	msedgewebview2.exe
4348	msedgewebview2.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 5012	4572	2026-07-11_5a0cc0bcf7275ba808f608cf2aefb148_hive.exe	86
PID 5012 wrote to memory of 3980	5012	msedgewebview2.exe	87
PID 5012 wrote to memory of 560	5012	msedgewebview2.exe	88
PID 5012 wrote to memory of 560	5012	msedgewebview2.exe	88
PID 5012 wrote to memory of 560	5012	msedgewebview2.exe	88
PID 5012 wrote to memory of 4800	5012	msedgewebview2.exe	89
PID 5012 wrote to memory of 3872	5012	msedgewebview2.exe	90
PID 5012 wrote to memory of 3872	5012	msedgewebview2.exe	90
PID 5012 wrote to memory of 4404	5012	msedgewebview2.exe	91
PID 5012 wrote to memory of 4404	5012	msedgewebview2.exe	91
PID 5012 wrote to memory of 4404	5012	msedgewebview2.exe	91
PID 4572 wrote to memory of 208	4572	2026-07-11_5a0cc0bcf7275ba808f608cf2aefb148_hive.exe	97
PID 208 wrote to memory of 4348	208	AstralRPG.exe	104
PID 4348 wrote to memory of 3540	4348	msedgewebview2.exe	105
PID 4348 wrote to memory of 4028	4348	msedgewebview2.exe	108
PID 4348 wrote to memory of 4028	4348	msedgewebview2.exe	108
PID 4348 wrote to memory of 4028	4348	msedgewebview2.exe	108
PID 4348 wrote to memory of 3572	4348	msedgewebview2.exe	109
PID 4348 wrote to memory of 2296	4348	msedgewebview2.exe	110
PID 4348 wrote to memory of 2296	4348	msedgewebview2.exe	110
PID 4348 wrote to memory of 4500	4348	msedgewebview2.exe	111
PID 4348 wrote to memory of 4500	4348	msedgewebview2.exe	111
PID 4348 wrote to memory of 4500	4348	msedgewebview2.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-07-11_5a0cc0bcf7275ba808f608cf2aefb148_hive.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_5a0cc0bcf7275ba808f608cf2aefb148_hive.exe"
1⤵
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-11_5a0cc0bcf7275ba808f608cf2aefb148_hive.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AstralRPG\.webview2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --mojo-named-platform-channel-pipe=4572.4604.9320719828999885244
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AstralRPG\.webview2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AstralRPG\.webview2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffdf81fb078,0x7ffdf81fb084,0x7ffdf81fb090
    3⤵
    PID:3980
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AstralRPG\.webview2\EBWebView" --webview-exe-name=2026-07-11_5a0cc0bcf7275ba808f608cf2aefb148_hive.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1740,i,16587864087225020487,7172351128381033074,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1736 /prefetch:2
    3⤵
    PID:560
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AstralRPG\.webview2\EBWebView" --webview-exe-name=2026-07-11_5a0cc0bcf7275ba808f608cf2aefb148_hive.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2052,i,16587864087225020487,7172351128381033074,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:3
    3⤵
    PID:4800
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AstralRPG\.webview2\EBWebView" --webview-exe-name=2026-07-11_5a0cc0bcf7275ba808f608cf2aefb148_hive.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2376,i,16587864087225020487,7172351128381033074,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1720 /prefetch:8
    3⤵
    PID:3872
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AstralRPG\.webview2\EBWebView" --webview-exe-name=2026-07-11_5a0cc0bcf7275ba808f608cf2aefb148_hive.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3648,i,16587864087225020487,7172351128381033074,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
    3⤵
    PID:4404
- C:\Users\Admin\AstralRPG\AstralRPG.exe
  C:\Users\Admin\AstralRPG\AstralRPG.exe
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of WriteProcessMemory
  PID:208
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=AstralRPG.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AstralRPG\.webview2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --mojo-named-platform-channel-pipe=208.4584.6537969092011777619
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4348
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AstralRPG\.webview2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AstralRPG\.webview2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffdf81fb078,0x7ffdf81fb084,0x7ffdf81fb090
      4⤵
      PID:3540
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AstralRPG\.webview2\EBWebView" --webview-exe-name=AstralRPG.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1864,i,2302649322773285688,13845729143245448912,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1856 /prefetch:2
      4⤵
      PID:4028
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AstralRPG\.webview2\EBWebView" --webview-exe-name=AstralRPG.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2160,i,2302649322773285688,13845729143245448912,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:3
      4⤵
      PID:3572
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AstralRPG\.webview2\EBWebView" --webview-exe-name=AstralRPG.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2396,i,2302649322773285688,13845729143245448912,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:8
      4⤵
      PID:2296
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AstralRPG\.webview2\EBWebView" --webview-exe-name=AstralRPG.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3520,i,2302649322773285688,13845729143245448912,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
      4⤵
      PID:4500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b0bceb79d52abab6dbb2c92685ee00a79168641fe4bf713f1b1351ebfa2a2f56
MD5 e2b242f19e6880ffb4af1df1299b75f2
SHA1 0cd17b58924ecbd8d06bcbb081d44dc0072d6a9d
SHA512 404253eb11130cd208435bd8764077e51d3b458cb318c1a87a458efd6c178b56d5e213dfa3301becf60aaa3d2b689608f00b5233148d2d7cba52ec474a2b7cfd
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 28fea7c6374d290f6c1d1bbb6f9d49b77e22950c7366d894128b8c1561073063
MD5 100564628d75c785707b7d2e45decd5f
SHA1 b4b49559b7ababe461a76f5b4dc62604b209ce6b
SHA512 b5ae1328d65436e238cda2f1ca9b678c71bbcd592d3a702b7a0fb93c9772d9f72cec35f80477f350c74a4fd7d44f972dc1d53e92c23d2cc1d1c19a73441d75f2
TLSH
T165D0122776035634C41021331412F1480842C10F400941407428862F6BC44600906491
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 cc380a5290bdbb145b19d0fd9f4353429c5a541adeea4453154a58b99cc4da35
MD5 9f57547707689fb88f8abca2ae456388
SHA1 bf4923ee39fbef419f5aeb82955f29993709617e
SHA512 9e0914fdce0e09c22c76a5df329d92b9b4968766410223a8f2422c1b51ac5ca3d080735b8d3547fc57b01d64f58d3558ca5365c7758a859084782734f358d298
TLSH
T1AFD02B27F212573DD41070730151F1281E03B20F10064015B42C872EAAC94E70B818F1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 47f790020fd7a4a66ea16d59af4c0a211a3463b5a2448647d83bfed1f855ba02
MD5 9462d4c93d99f5773138347396f16673
SHA1 a52cf4ff51454d35f632eacff52f81a79e603b92
SHA512 1a24ca139a5e99aa79326899d9647a9bdbfc0f1ca9d6b2d68a916098d7021e9acc1225c7108ca09284b99fdc9eb80fcabbc2ec24dec5796f59b6e0fd87cf51cd
TLSH
T129D01267F6115A3AD12434720191E5552A82620B2096416AA828877E59EC89756994E1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b648c0983ba87a299a6b3cd8cadc12a4aff1baa61f8df5498246eed53db45a78
MD5 711f12f7a4e1ce61658927d1d021619c
SHA1 cb5c21363bc482997c36a49ff2976cf5ead4c680
SHA512 b8f5bd50b8ea47ce7a5a24f40335dc7912c81ecad5443f4f06ae6193a2512fbd2464d05b157f668a78f6d34e6015a044ebf6f6a412ca620518a1b8331c78ee5d
TLSH
T1AFD02227F601663AC02034320040E0142B82610B2086422AA828877E5CEC88746984E0
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 fda301dd2815fbf7c735d2c4ce864b37ed995a12c68ce9da038063938bc0c2dd
MD5 9408e46870bb5aa6f4d1fd45550bc7f5
SHA1 71ee49fd5f5c2c0804609f505faf33ec9f44172f
SHA512 976d114051f74473b6bbc45940e7ada76a5049be9304c0b2fdfad155cdb529fb0719d331b6fe220a7ecc4f21a0cf3bc362b5a67157b6df0d35f48fc57c37b86b
SSDEEP 6:/F3XGuqKkKtKkNYujylCzKl/Kwa5raDf:d3XyKkKt/NYuCCz+/Kwka
TLSH
T1B21392ACB2D10E0FD7A7017C8856A370E3B1C920EE2477E3292CFC52688A39E030D030
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 cc59901c4fb59af917e2ea9a34d6b93c0c9c7a5fcdfe0a1159b5f9461dc9018e
MD5 baf274b709cf94726d0b67d3db758e65
SHA1 ee050e478994c51f777f79f8fa28d9913742115b
SHA512 ee336f40b04feac82837d87cc4792e8ba4f695fdd7772447ea160fe7150ade3df1b40b76536c6a746fe0d3c205f5669296c3b283d8608d5f9687589f3be262f7
SSDEEP 24:GD2weFXDFFbe1ehdQxBKnfzlv7sIkw4llnxao2RFWL9LNL0djweh:W2weFXZ2eXaBKnt4Yahxpm/ue
TLSH
T1834495DE6741D050C8B082F66D673668EA3F10ADF679E797DC39D884C8E338B3640204
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 c1c3511a5a089d3ce6a576a87227ad0409a28140966c616fc3f86af07aa808e1
MD5 64abcafa651d30c7a17f0f97512864d2
SHA1 8258ad2bb0ef50efb71b313cd56217d80cd8cd9f
SHA512 e1b072cacd7dccdfad9a3e050ea2cbd5f8ca432077cc877d7bfa0b4b9288351b9020483f94e5aaa7accf22811fbdc299b1fcb47da43aeeaf5e344d0e8762eb14
SSDEEP 192:phSRy48g6Pl7VAu+ayEYm/rgwiPl7VAu+ayEYm/JgwiPl7VAu+ayEY:pEA456Qu+JEYmoQu+JEYmGQu+JEY
TLSH
T132163BD70F74F642F962EE70ABC4ED2D3DB05692BD929483E50A81ED09E0BC11B8645F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Cache\Cache_Data\f_000001
Size 38KB
SHA256 ba344451eab25b217a165363b1982048a5e5830a0daf36577973955a04cac793
MD5 166202cc391c71a57730bed12cbcb159
SHA1 76388dbfe374be06fdc6f9ba38d3f4e479025eeb
SHA512 9f4d1c14aa729e837b964898a1dd27e99ff674256c43326aa982cc0c17fa8b0d71a0b7df627f03cb4ac6ec7f22f0a19d65302743ff09187ce81414dde74c43e2
SSDEEP 768:lxbc6Qon+A9wOfdj2rELqjOmaLqLqKeI+00t0xIj:layndm0j2cqjOmGq+tbUIj
TLSH
T1D9030284FD6A02D8C7FC1F6EF25A9F28272C2078440B6A9C44A79A6BD5975F84DD3330
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Cache\Cache_Data\f_000002
Size 20KB
SHA256 63b14e3ef0966785438b8947380dfbcad178cbd3c6a5ed2172672ca0d8b839ac
MD5 fd4986b86093b8a3a9741457f6a37303
SHA1 c15c26d255937c0b1a47b6d641ee6a2de4392f6b
SHA512 e2cbf9114b042c7818674b88b33d50d9aee1d5916fea130c45b9b3aaabd633ba47d0fedd9ccfd1d59bd846e0b5bd2734753532dca3002e3ac474aa60bec66482
SSDEEP 384:Yzb9yuV1JBCAg2k1UY3dpP7nqoJOEIeFdcZUqWZlAUuTqZgb2wc5KW+:YzbwJ1BvjnqoJOIGU1UUu+Ith7
TLSH
T1A992D08400843FB9B1E492FF0954F77C3C5B5F446672CBE58AACA194ED09713AA91B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 caa825759cfa73b916a8f2d419c3cc7cd6127fe40d34f31dece4aee7226cd8a3
MD5 8fb78124c45a5659012aa91602716cda
SHA1 7b214c3e16d9a9671665b3242c9e953b1607f7e3
SHA512 877a7b24c4ba730544e9a44e754177fb2c340485c49bf5c89d92994392e6d947a8154321f7559d57011fde987e896f6179cbc0d6295326d32c273886cc7f280b
SSDEEP 3:LsFlklNllkll/l1rRKLs011n5l9lXlWNtl:Lsk3lEtRRIszN
TLSH
T18144016D03811D06E9C012BC948297241734C451EB1BC7831308426118937900F4A540
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1afe9cacc9803fd2_0

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Code Cache\js\1afe9cacc9803fd2_0
Size 528B
SHA256 a385b9c53ce166ef4d83d5f1e2303bf38ded30ed10f573309a75ac9f84f1f167
MD5 030ab2d35b398a1fbd06e6a7fbfe1677
SHA1 ebd9be872adf96d985ce0c8abad791cddd259915
SHA512 8eed69020aef5247e032a71f19443adcb1336cae0a1f7ee0d853e09ab219745a49a9a74cf7865135b9a1fbf4506b4290b390e964de85877ed1b528442afab0f3
TLSH
T1F0F0DCAB78E08E61C8E384F5CEEF10988304E9EB5E7A4603C19B58F16244D44B83390C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 fbfdd6ccda3483f92408005a9f3d4206f229502fef46181c44f1458f1d4e4d82
MD5 0d197772bed46841f11f1ab2c5fabeb7
SHA1 67d1cacc2379e12d4be4fe3ef55807fd205ffb08
SHA512 28e9b6d8ca0cff201343b80995162cc1951538c8e4336b189135835f8fdab8043705bd53935547e93dc11fe97b384329a8ec6f9d55896dbd546adab6bd663b09
TLSH
T11BC092508B1308D0C7AE03BD95FB57CBB2B04CA8BE2F5EC023D540F278AA38847A1109
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 aaf1886a41d620cf6e0ed194b50de75095874c3fa1fe06e4379edcd7027aab51
MD5 ca25679a58654c126820322248ea0df8
SHA1 f3b7537fa5f932cd3e192be2b48179f65a15614c
SHA512 25c1569d07057d0e198901190ff6e5781dda26b8dcbdd2004bfd372abc7716d54b7874dccd5d7e214baa1836a48a059053a66ff036d5a18ce740d0390133f882
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 b1234564c1e1639bd2a80180b0e90d825a6f40273bd0c126bfa0d3a05311f852
MD5 2962262ead090fb9f0604bed4f562c3c
SHA1 c6839f6d1e9c3a4192d7b020ff38f3392306df8b
SHA512 93a70c4f76fdf00a07bd1a7058d8e22be902ad0bab3925c569b411d0c968982b88c9ca6aa302960721bf9d419ef812b07370ba4cb8312b6d97f95884c977c7b9
TLSH
T16BA0021092D10891DD550378604147487792DE64563183A350EE91A9DD6A2D18392110
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 456f669d537a30f5946f3e7fbf1592982646bda6f8481ae881d3f2cb94071051
MD5 b00d5090714774ca2fdd024a87ff49dd
SHA1 b2228f3ffad515d5ad26e33172ae373798ac724d
SHA512 b9133b17f388aab7f1c10bb0aeeffa559644783b573fbe5eed7bb95ef2064ad26cb98a44f1cf1751cfaa176920078574694e8c39d7ab3efc56cc1b152125bbbe
SSDEEP 3:LstlNllkll/lw/l:LsX3lEtwt
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Favicons

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Favicons
Size 20KB
SHA256 46b5ecada4edb2585f87953f7847aefc938be2404b9d9455c772b97295b7b1cb
MD5 babd43551f1b29eb82e221460676126a
SHA1 e9bff307613a14b35830893bdb6d1ecc931b425d
SHA512 5ab681c170dbd1d374bd66edd02cbe21272819ef7389ad1e886bcba112deb91eb68fa930747986da5ca794881939570013e38edd9f8e6f718f7d202e74a82f41
SSDEEP 24:LLipxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:UBmw6fU1zBmI
TLSH
T1C292EE075E383407DBA10E7D366B18768E3FE26C5FA29C94347410618CF9482D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\History
Size 184KB
SHA256 30e6b17dbcfb9730f6137505339f057c47152827ab97ea9887eb963dc84fa716
MD5 e3298098e974a6fd8ebcb83b8f32416a
SHA1 71b5ba9d9633f5048a575aede6b126e26d448687
SHA512 8760091597acc928ce23f14b2165dd9adf058bddf75862bdd694245661c2b3fbafb2f5a295e08381a903dbc19e373e5a6dae7b6c38dfed96dc661268ca828747
SSDEEP 96:HB4W1fejzH+bF+UIYysX0fxQp97bEHt/DfLjLqL/9ibgI4VgNr2jWRk/E0kI:HB/qH+bF+UI3iWGVbWN3qL/bVgZQW3/I
TLSH
T1DA04FC5E5F643212CDBD913668E745B3587DF03F8B236AC66C6508B0CEE2652B02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Network\Network Persistent State
Size 821B
SHA256 b73fe05bbc69630cd3a52085be83fd68fdb48b0821c2fa9ffc9aab0653d655b8
MD5 b07d1c4066384515bffda29599147d13
SHA1 9548ee436229bca1aeba35ac94212ae2a91524b4
SHA512 320fea06d561fed3fc101df872cf8b7f309e097152cb04f0da81be765b01b8f7d337bb80ef948cddf33745eea9b55c212752ce5c27568e3d031bf11076727f46
TLSH
T1EA016BB2C3D4C67D884522E42B247823CD2F041A52382927CDEAFBEA5BE1475D710A0F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe596884.TMP

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Network\Network Persistent State~RFe596884.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 69dd238ad0b20622bad10977b9879572d9a55e0020bcb8918224a2d169c626ec
MD5 5191c562c2b52e2c48d10706c2a2d45a
SHA1 d31169540f380d721718210e882af359e00e0351
SHA512 2e16e83df30885762c76ee0f05772bef6e771c938ca36a18c6a28153c3e6abd9133401b93cd3828347d0b0ae11098552339858f69ad1c554f57c3a2a529301c3
SSDEEP 48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBrm:uIEumQv8m1ccnvS6i
TLSH
T153F27DEE0B19B614C4E49178E6C509C77D7E102D8B96AFC59EEC06F1FF821A2AA38115
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 bf2c4f076d1bf67f64db8c68cf0b110cda59f42c2318c0f00b0fe51d7cf5af3d
MD5 5f30d5c9867cfe7100170c7be0b1b43d
SHA1 a68773e89263dcd16b76e9ae342246951172d5d3
SHA512 cd903ed092b98e6641b81d8212b978ce783aeff09942c5faddf4529ca0357d2e660c8ec847e9f1b59ddd03151aeca1c3522298f80d8f2dae5e7cb877a7f8cc41
TLSH
T19AE0689340BAB46B212819AA1E807C062E36B030018258E8C642827CB0620EBEE42433
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 a52353ad97c98a8645caa14520c1882e71681decf77112456f2fe5a0e33e0d25
MD5 9af7f587b2a882d9ae4a2ce5ab891a61
SHA1 4507807931c37935bcc351cedbf5384682804783
SHA512 a099e37fa9a9e71f893b6c843ea698d0cf413117c03c3e67ff341d9ecf4bc15e7f094f9e48d1c6db2c914229be26dd9b4407eb77dcfa2c6a1fff3e722e30ab65
TLSH
T1AFE020D7407EF57720281ABE0DC4BC461F77B538419158E4E793416C60501FB4A47436
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5959de.TMP

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Network\TransportSecurity~RFe5959de.TMP
Size 189B
SHA256 c30754091719d57b2231c223ea9b84f86e00866e213c40c77219125e31e21f31
MD5 c57ba7082abd4b4742fed1571785bc45
SHA1 3d516b2954e9871e83cafdf44f6e85435fd94784
SHA512 791fee55f768ff03ff3c7e5a00ed581dc5ace44d7fd34163ac00ddb1547ddcdcaf033324a0cb4c459bf4cd8f000019efc24978656656f4fa562bd78f05d28d5c
TLSH
T1FAC080DB4079F4B3106C67FE1884BC575737617891A01DD0EAE7417CB0815EB1F91831
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 19e1e0d60dc0a70455014fec98b5e4b73e93a80651600368745ab0d4a49c9529
MD5 4203aba60fd9de5b4232fc624db3f817
SHA1 1f07dfc552d6b509c83c36cb05986007ce29e250
SHA512 6240f8ef505e093f0ea99306adfa90969b3de094cde08b61076bd2c737763c0815108f532ec17e766fe15f9b1bcb9d82096f799ef04d50c3ce2305d8247bfeb1
SSDEEP 24:TL33lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:TL31DtX5nDOvyKDhU1cSB
TLSH
T15EF2469BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Preferences
Size 6KB
SHA256 76904b558afa1fa92f094cf4d1fde8109a8c157055d0990d71f4f72d23d433f5
MD5 9362029a41e53c2758c52f302e0a24d3
SHA1 91809a2d25a38a51211e57b015eb70c7bff55497
SHA512 889eb44eed7299464f64b3db9c7ebf38635c329a4666dd3adc53d5df1099b04384efe35d5db0c967cb73a4003439a1385ec5cf456687a4fe59908e6f27facac2
SSDEEP 192:stn10dwg4AifFsZ8paIcnL/S+WiQnWrpwYnDN5QCHQJ0M8:stOdkhS/Vbwz8
TLSH
T13CD1B7039F2469774CC7E619BE35BB46E2FA206262D10D98EFFC871C09D66DC620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Preferences
Size 7KB
SHA256 127b6b91fc38d0588219bdaf7c46446b7e6e430b4febd9d7a92c7eb0ef082f3f
MD5 f1c48d884881f223d4799fbcee3a62a1
SHA1 b5b8311fd1678367bd8fc927318333bb20a3b3d3
SHA512 1788de6b6dd32578ce9f87812159d1ab6fbdf72e0e40e94ff37420be2e6b90976c592e6415db1b8db8d42a99aa89dd92b80771843a602d2526e556da4ccd65b4
SSDEEP 192:stn10EwgIce4iffsZ8paIfnm/S+WiQnkrpQYnPNN5QqLpJxKCMC:stOEkNj8/V9QOyC
TLSH
T1D5E1C9035F28597B5CC7E659BD75BB56D2FA202262D20E88EBFC871C05D66CC220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Preferences
Size 6KB
SHA256 6d00496e778d02f05ec6a82f6a146a1ee805b18d7d8ba1638df0dc74732f5a66
MD5 27fdfda3ebac536864eae1161def0df3
SHA1 2110e7d49adc1c7d51a5068784dced45f9c1df5f
SHA512 392ff7f5bb6665b1a638b34d64203facfe02d4450110dedd767ac02f28ad35fb5b16c39037ca6e3d7559db975176ea1ba08741e602a2e8c6bbaa917ef6176077
SSDEEP 192:stn10dwg4ce4iffsZ8paIcnL/S+WiQnWrpwYnDN5QqppJxkKC:stOdENjS/Vbw4C
TLSH
T1DBE1C9035F2469775CC7E659BD25BF56E2F6206262D10E98EFFC871C05EA6CC620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe595375.TMP

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Preferences~RFe595375.TMP
Size 6KB
SHA256 996039b28750f40b39f22dbc5eeb051a1c778309ec821a257bafc2b38d27fd43
MD5 f89fbba9a50f968b1ad84997cc88f23c
SHA1 9dda01243ee69d7927ff6d5b18385709230efb11
SHA512 d55bc57de03e6cc7c9a0e6d82f31a56ec4ab3e16f074328323fe00ee4d65a1900289c4dbc4d2845d57145b48edcd64804d2d865b539a69d1e75ef7000a349a09
SSDEEP 192:stn10dwg4AifFAZ8pFIcnL/S+WiQnWrpwYnDN5QCHQJ0M8:stOdkZX/Vbwz8
TLSH
T1E4D1B6039F38697B4CC7E619B935BB46D2F6206166D50D98EBFC871C09D66CC620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 e87b3d155c7582d4c1d889308b58f84e8fe90a1581014b21b785d6694bd156cc
MD5 a156bfab7f06800d5287d4616d6f8733
SHA1 8f365ec4db582dc519774dcbbfcc8001dd37b512
SHA512 6c8eeab3ae6fb0d5be7758cca521665b216f31aed1aeeeaf121c99dc9f0192b385de0da36e94f90dd4a9bbbac6be2c5a55d2f284a24ccb7dec2c5302fb9b027c
SSDEEP 24:TLekLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T66LopFMatSaw/auUOt8B
TLSH
T101928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE929ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 17420fa8389b62be78a5eaee1e25919c3c14c023715c13af53799aeab88bc274
MD5 28d50f24c74f3e22557eed96da2afa0d
SHA1 eeb7830c12de93d1b689d166041e7f650a90bd65
SHA512 33ae38e0419a7ebff6861908a2817233037d0e65f2761594ca7eb83c424fac0bb6722e2820a85f7d7c3334f383b0834e8640acb13483d5c47acfa8739f4ddd36
SSDEEP 96:HllriwUPlf/ROoKOpkF5d1lriwR7sMaTEv9V5h5pg5+eedsLElnNymXrAcq:HPGwAWGGGwh9l4ElnNyRd
TLSH
T173D1C4A74A6DC535BF448EEBDC293ECB89A600DF88D64C0A97D2C44807C2EFC10DA495
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 3eca4ef3d3c091bc5cc8f270649913dccf1d6c62e16aa4e12f47c56b75bbd9b6
MD5 5c21bf09ed9614e900e9107bab3922a6
SHA1 3f48a0abe85836d449b8f201c744d5f3e732be37
SHA512 a1bc000b61c6d945100d2552e03d5b191caad5e01b3ffdac39661988ee5590386e863db788cc29023728a6050078c7a9d060d16caaa4061eddc2abb4465a4387
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 f8e7cd835195e4eff7855d20676484ca75f7e7e4fe5b13164fc926b365e1dea0
MD5 b581f0ff8f8aa3371ae47b48c95329e8
SHA1 4f588efadf3675f3526cbe762c50eb8e79d9f2e5
SHA512 e0a79452acb39838afea8ce34e05c7e5cde68f2a786fe4423ddf2588fc6047339e8e4c3140d7e0447f938b2266f52b9ddbdcc0f40c495d833b47b3f27d7996de
SSDEEP 24:TL6xgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg89oIPq81fBG:TFOIy4m1b3fbUdSo2qSB
TLSH
T16513AA0F1E187551D1BD0235E9E64E6B2E7E204C9B8369D125F01AF24DE251C9D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharedStorage

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\SharedStorage
Size 4KB
SHA256 1fe8f6113488865c546d2faa55b21482662ce4be19d4f505eeefa09bc3131489
MD5 b9263bbf24428aaca95d04d04f3aeb6f
SHA1 5346015345f6df766df4bc9b42da076f6fdd440f
SHA512 5bc2978bc96e1347500db552e2a2dfd9e5df25c8e16d3ab57e5519de43cb9c08f5aeefd1a6f6947d7fa253505918763b932f622636fc2a7a429fa72a5b49c7cc
TLSH
T1EE810440534000F1D05407F755D1130C0F07D3D4D5410F0355010041CC51D445C70FC4
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 d564a865676cc8f14d9d8b639d7aa17ae3a078b0d40287955bcde1eebdaac0b6
MD5 2632fa88fcd2780d760f69e317b4a366
SHA1 512d5950150bced83744171988ba51f3ab355f0d
SHA512 67ec20b77e56a0e57e242bc589677ddcae4c5a2cc3a0be59ae5d1536e857c9313738d89ed89b58727e829711cafaab7a3b9eeaf832c2c3067699cb8d6f16cd8e
TLSH
T17BB01248B700830AC1C904350592CB857340F013300DC827CCA4FF241C1D5A47F008E4
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Site Characteristics Database\LOG
Size 289B
SHA256 f0769cbb542c6a35541b2ee53bc373e5f934a3bb961df9baa15408c96b51c162
MD5 80f619ccd8246d69a467259051eefe0e
SHA1 20c63bb41c865b80eca71212b70771db03584f51
SHA512 4fb243af48f2afb826beccc32337183897e3eb4214f4fdb9d40e80c5871f81149ad4a6914ec85ffda33fa203e1b074fba3a5fa160ba84faf1aad2313b23d40e8
TLSH
T10ED0CD321E9E8F3F46E249EB5132A34DC666B000FE9C66151F7DE754320F404B196543
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Sync Data\LevelDB\000003.log
Size 46B
SHA256 a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a
MD5 90881c9c26f29fca29815a08ba858544
SHA1 06fee974987b91d82c2839a4bb12991fa99e1bdd
SHA512 15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Sync Data\LevelDB\LOG
Size 267B
SHA256 30b6bdf16f7756a936e641df4541d91bbd293c1b654d1ed09561a2dfd702c17a
MD5 679382c753f23dc278a8c46cf924f072
SHA1 d98297145b2571482a39784a1959ec995f56665e
SHA512 4972851e943053363e3350fd20b2f3c3c280b9d290e2509946d3e671d174d18dbb513800da404b4f465d9b8957b3221ee8a9101cf4c2758bb16a05978cf111c9
TLSH
T16FD02B724ED88A3649D18DD78632570EC6BCF800FB8D3B098F7CE524390B004A178183
MD5 SHA1 SHA512 TLSH

Submit Download

Visited Links

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Visited Links
Size 128KB
SHA256 2aba67e32b23dfcae3068eeaa670e5a80d31dc0572cf89a74f348a206c9c0f13
MD5 781055696823f3ece5d2556222638306
SHA1 8bba4a6dd18e6c4d5b54d8dcb5b74e0f945e208b
SHA512 3f3e7dbddf3ae073d347fa2f7551cc616159ceb5532217b7f6788e8e60e241e86a50714ed4801f1425f35bae3951fddbb64cf5aad283c2af55eb92e552adfff3
SSDEEP 3:ImtVuoiT6elJYIt:IiVuoiT6eHNt
TLSH
T141D3045D51410405CC34103454014F4F4514FD301511C0CD03350513CCD550751034C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Web Data
Size 216KB
SHA256 2a7b3bb5ac287c4d5fd81c76626b1e8e15f32f34d2b37738fdc98fa6ad43baaf
MD5 4ebc7325aec489f53e4635ea414d14a5
SHA1 c85641375cd9bd4a26922883598a02e8861a6bec
SHA512 a2ad8a907e9d3405fefc533ef4ae65fcb32615914163af646c6af02a412df1d3a2250d0ec8e04ab5d04b6d8453122d43d97aa3340358fe5e7c748e9e2117fb74
SSDEEP 192:njQLsS6Xuv9PhDnLUMjA03VpQYouZtuQKIqJZWTVTdhsrV0dwe:nEL3CuvrDnwMjA0FpQY5Z0QKIqJE6K
TLSH
T14924440A7B746001EDA6E9721CB080771D3C61AD8F22E6826DB254694DF6853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\shared_proto_db\metadata\000003.log
Size 792B
SHA256 50672ec993a7bb841317afcd853e3c91ce7f636d6f199c93a5e1059c7fa2e22c
MD5 71151d4bbf20d0f79eb63bea1531c253
SHA1 1ac45783aa99b0fa706338d12c81174cd25730cd
SHA512 6add52227d0c2065d26084d347a29c1d7c585c34b699a8ad217d4833cec87ba3e36d29a64d1242beaba1094360c0494072d597a593d44d656eee29dd8b8f6d18
TLSH
T1E40124AAF330C129E2948935607E670A5738D044AFF4CC0F04B614246FF76002E5B3EA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\shared_proto_db\metadata\LOG
Size 279B
SHA256 04644a94bddf107ddd818f0ffccaffdf91eba1798492bda24a0e1740a3032637
MD5 0c40f0682ced8fe70c577c377c6e5db4
SHA1 1f9a6812b4526a8329a2cdb82de2e9173e1fe21a
SHA512 bfdb7d80b58ea745faa892ba45dae94937c8efbacdb1147261be783a19dbf5d19d53432b7225e01400bd98064280db8e15286e34dbaaae6410f4bb41ea9adcd9
TLSH
T176D0C222BC688DAF49F249E74032038DD3197841FF482F090FA5CA18250B005B59A143
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Last Version
Size 14B
SHA256 06205ebe5acf3073d12a4ac419377a3449e6d6b5fa7fa2b1c4201f007c4ddd91
MD5 96fb5f155aee0f8cd88274656c58ca83
SHA1 1fe86d9df188b0f86ae2d8da8f7c1ef663258baf
SHA512 fee0061ef23ef3fc35d050501b47db921f490c2aec2a016304c9f27228d3ecf7df9641fd681d9babd275ffd3dbd20e33e38fa5bf583c2852ffcd4b04bedf015c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Local State
Size 15KB
SHA256 e81ef3d0097a95ded34e4cae2903a54f8f98ab7677dc8e5f250d59f2e6f9d910
MD5 1530831d6bc503a578ac40824f973f37
SHA1 76046d00e63efe7f40cc1ea25fd046a69cf0a422
SHA512 cae52712c6c8261880592a83c0acd7750bc76f134acb0cb20ad76504992fefc9c451a81b2aece74e63088131c109aa46cc579fd55e05537c0280744c7b0d7f8d
SSDEEP 384:zesrv+89zHqlDNP9oid6NbDO525ZjA1bfN2:Vrv+4UNbdFYZjA1TN2
TLSH
T105729E33A66C97336DF69584F48A2A0B7B74609691C20BD4DAD90F8D429F4DD2317E23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Local State
Size 1KB
SHA256 5368f9641b02bcdf25f6c4c0ad3a83eb2fd26930e87d276e08fb739d62da8bcf
MD5 2b23ad697bdcfbe79ed2cccc648dd5c1
SHA1 004a78f40614fbd947fb0115abdf1827d095d851
SHA512 7d2aef007e663b2e118034ee3a5f33caa2b75489339875c119401aba569d38181842c787732fed1d9b542e4f2a1b4ae8eac59c41785f7ea8d7ff6ec07ac47f50
TLSH
T11C3165739B805F726C82A585B5C53FC66E311075D1560E8467DD0B1C03E749C652AD37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Local State
Size 2KB
SHA256 70b0b7f6bb1642eef5497e3d738be78e08ee3e65e6fb0fcc3876308cb8db4b51
MD5 b41d7e5b936a4d3479a032403c24933b
SHA1 9602b59fa09d7d4f85ee9732d8dd901d79b05844
SHA512 ed69e6045f733296d0cf870657a92f1d16bff3139ade83f3c82cca4d00607fcbf0074de71091f1244b29e26cea6260f0169c6b640c7ef41697390184c437c97f
TLSH
T15751A773AF049A7798D39684B9893F92AE3560B5D6572F80ABDD0B1C02DB55C3302C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Local State
Size 3KB
SHA256 420e573aacc84bdfdefaf9dcc0202ca97c9da984fb952f5e61f12664c1d0547b
MD5 773be3f15123e429be70477f830097b2
SHA1 2ce6f567e5c2a4d791fe314827d7687434997b8a
SHA512 a9571f240e71a04de93b56bad60f4802962c8bd9dfc6c90fa5c9437698fd2c5a2fee9aed20f89c67eb92714997d8a27399a1e4cebdddaccad5a78ebff960c8c4
TLSH
T191718437AA64E9375DE29944B8C93F46BAB55036D1963F94DAEC0F0C02DB69C2302C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Local State
Size 4KB
SHA256 a8ffb13256edc54f421bf5f12ef9d851c72b1a6d43571a3ca622f8fd540f5cca
MD5 00e1a7aeded38eff8739ccb364533e02
SHA1 321fc91eebf49fa2d0aa621cf70468d5de543bac
SHA512 146b0cd7ee89f7d2ae9f5783e28a169c747be1102e924d96ae7b910c20ed26c92794f382d8dfe9e63a5fc54b333096d695487a9abf89f3b5c77e9dd3abc631e5
SSDEEP 96:zuqobNkCETfHQDk58Frh/cInURoDotoin1hPDnsuBRKVZ/h6KAZs4Ta6lqa:zTobNbg8nooDUDnPrnsORyZ/Lga2
TLSH
T11781A5276A649A375CE3D944B9CA3F46A6716033D1963FD8DAEC0F0C02DB29D1302C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Local State
Size 17KB
SHA256 bc8a5ee41e97d8df17fea7e74ef88b1d80e4be6b854f2299bf591d7828a80fd0
MD5 64b069d5a8ad1a6990306676f3e49cd2
SHA1 1c837a33f8d9a47446df3421d6b5fb8d22890e0c
SHA512 2d01bf4bc939c46013360f6e5aead62ca68608e00423536987a9a094c1637afb763bcab3b45634a01da3496afdce18d5b83dd710ee1fe91b5ed6eb75f6190a2d
SSDEEP 384:zesrv+89zHqlDNP9oidw3NbKfo2+7DSSjA1bfN2:Vrv+4UNbdwtFSSjA1TN2
TLSH
T144828C33E668EB336CF29684B58A7A4BBBB4215251C60AD4DDD91F8D428F4DE2307D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe584dbd.TMP

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Local State~RFe584dbd.TMP
Size 1KB
SHA256 a12b68a06de80ef9c4bb4e6a8bf0918ed25c293ccd1cfc20756b973d4e983476
MD5 046941db7a8fb1c9d4a06a492f985c07
SHA1 176e44cc9b1d8227dabac82bda7e1d9b21e246d2
SHA512 38536fff2dacf90b1a22d998eee79c25a8422b5dc73e948919f9b84b61aa77e242bed57b9b2e3fb2d62439867f22344cd824f01b6de6f101d9ffb1e59006eca2
TLSH
T15E219573CB856F7378819485B2827FC62E7050B592150A48A7DD071C03DB49CA52AC33
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\ShaderCache\data_1
Size 264KB
SHA256 410f6c54c9811cbf040638ed8a9ee950409f9a622d2f6e174cbc856ab45d0840
MD5 ab37cf2f9437ffb897556d037ec54fd0
SHA1 bfac5195047e08f063e72f24f23f67d938922545
SHA512 7c8178c7db3dcf3acbb87892f93001bef9e745c4d46cba1d8c2744808c83d94c11ad53267958f5c17b206780a306645e13d3853668974d5d1eaac0e0dd286819
SSDEEP 3:MsEllllkEthXllkl2zEkl6u:/M/xT02zn6u
TLSH
T14C4404047FC00405C70017344011C7540371D455051157C3345104335DD55410D00010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\ShaderCache\index
Size 256KB
SHA256 ddf5a343fe8d7633e1533b7f850d5d035f09fce405e4711aaa998317d5246510
MD5 78d5d645e6e1a862c03fd4003a0f0e85
SHA1 282cd4e329d8f810deb296c6cf1f825d912b4646
SHA512 c6503195f989ccbfba7c2e09600998b2831853ebe3b291e2c9682f60dc56b46edf54d62a351f3c35c1e1355ac42731e507efb346ad9930f2d5f1cc915347006d
SSDEEP 3:LsOllllklkXlNt:LsUlPNt
MD5 SHA1 SHA512 SSDEEP

Submit Download

AstralRPG.exe

Path C:\Users\Admin\AstralRPG\AstralRPG.exe
Size 14.1MB
SHA256 bc025a1b8e88ead35ff190da3426507735736fe1ea5c1296f67b629fe494124a
MD5 d29670e88c985ea553cc6c17740fa12c
SHA1 3cdb32644cfcaee5ade9babcad99d85215a180d0
SHA512 8805588cc288ef99ff4bd87f36aaac50ea8cb7ea08c6b3f99e5369e5684ee46887701f3adb85b23d570005fdca8e42a995b945606b33fb4fe3be88ce30ab071a
SSDEEP 393216:4IYrY8CUzW/tnZuwpHto0qR0be6GTcBSAilbeMy7YaWl9Zk:oY8bz0ZlxLpqdQB1iNeVkVl9Zk
TLSH
T16AE633F096EFF78ADCF918B51551EB4E28FB24FEC404A3E44897144F9D99C5A002AE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/208-816-0x00007FF714680000-0x00007FF718D47000-memory.dmp

Download

memory/208-703-0x00007FF714680000-0x00007FF718D47000-memory.dmp

Download

memory/208-848-0x00007FF714680000-0x00007FF718D47000-memory.dmp

Download

memory/208-866-0x00007FF714680000-0x00007FF718D47000-memory.dmp

Download

memory/208-867-0x00007FF714680000-0x00007FF718D47000-memory.dmp

Download

memory/560-26-0x00007FFE14080000-0x00007FFE14081000-memory.dmp

Download

memory/3872-77-0x00007FFE14190000-0x00007FFE14191000-memory.dmp

Download

memory/3872-76-0x00007FFE13AD0000-0x00007FFE13AD1000-memory.dmp

Download

memory/4404-152-0x00007FFE14080000-0x00007FFE14081000-memory.dmp

Download

memory/4572-239-0x00007FF6ACF70000-0x00007FF6AFAFB000-memory.dmp

Download

memory/4572-0-0x00007FF6ACF70000-0x00007FF6AFAFB000-memory.dmp

Download

memory/4572-501-0x00007FF6ACF70000-0x00007FF6AFAFB000-memory.dmp

Download

memory/4572-521-0x00007FF6ACF70000-0x00007FF6AFAFB000-memory.dmp

Download

memory/4572-525-0x00007FF6ACF70000-0x00007FF6AFAFB000-memory.dmp

Download

memory/4572-561-0x00007FF6ACF70000-0x00007FF6AFAFB000-memory.dmp

Download

memory/4572-562-0x00007FF6ACF70000-0x00007FF6AFAFB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads