6535091e16f95ce6e5b9f12e2dc996ae828fe7e62aad1d4d66a79960fe6ba858

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
428s
max time network
431s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Astro-Launcher-1.7.0.exe
Size 50.6MB
Sample260731-e2rqvsap8v
SHA256 6535091e16f95ce6e5b9f12e2dc996ae828fe7e62aad1d4d66a79960fe6ba858
MD5 15793b5083075d1a6186ad317f7a91c7
SHA1 2bb68ca90019b26d710a17f8353c46af23d3c662
SHA512 c6d054844677548b90efb012aca0a31face2d10d2c35ef65d5ee4063158bf367f5cf9fa4894d093ea772680a386f2f200407d65ebec37223cfd88c2ed416760f
SSDEEP 786432:82XMFSMVksfFp9TTfy3iK786wzkyBQFgzTUXeNw8m5lRmRjIlzADhrp3lPOZdP:DcFfksfFpl+RBwXzTUX0w8mxmxgOlGZt
TLSH
T11FC71256E2F900E8D57BC0B8C6575517E7B2344917309BEB66A48A692F33FE0AE3D310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery spyware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
38	3772	Astro-Launcher-1.7.0.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	Astro-Launcher-1.7.0.exe

Loads dropped DLL 33 IoCs

pid	Process
3772	Astro-Launcher-1.7.0.exe
3772	Astro-Launcher-1.7.0.exe
3772	Astro-Launcher-1.7.0.exe
3772	Astro-Launcher-1.7.0.exe
3772	Astro-Launcher-1.7.0.exe
3772	Astro-Launcher-1.7.0.exe
3772	Astro-Launcher-1.7.0.exe
3772	Astro-Launcher-1.7.0.exe
3772	Astro-Launcher-1.7.0.exe
3772	Astro-Launcher-1.7.0.exe
3772	Astro-Launcher-1.7.0.exe
3772	Astro-Launcher-1.7.0.exe
3772	Astro-Launcher-1.7.0.exe
3772	Astro-Launcher-1.7.0.exe
3772	Astro-Launcher-1.7.0.exe
3772	Astro-Launcher-1.7.0.exe
3772	Astro-Launcher-1.7.0.exe
3772	Astro-Launcher-1.7.0.exe
3772	Astro-Launcher-1.7.0.exe
3772	Astro-Launcher-1.7.0.exe
3772	Astro-Launcher-1.7.0.exe
3772	Astro-Launcher-1.7.0.exe
3772	Astro-Launcher-1.7.0.exe
3772	Astro-Launcher-1.7.0.exe
3772	Astro-Launcher-1.7.0.exe
3772	Astro-Launcher-1.7.0.exe
3772	Astro-Launcher-1.7.0.exe
3772	Astro-Launcher-1.7.0.exe
3772	Astro-Launcher-1.7.0.exe
3772	Astro-Launcher-1.7.0.exe
3772	Astro-Launcher-1.7.0.exe
3772	Astro-Launcher-1.7.0.exe
3772	Astro-Launcher-1.7.0.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5116	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299457105495167"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 7800310000000000ae5c65081100557365727300640009000400efbe874f7748ff5c65232e000000c70500000000010000000000000000003a0000000000c2b85b0055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 5600310000000000ae5c650812004170704461746100400009000400efbeae5c6508ff5c65232e00000068e10100000001000000000000000000000000000000a56a4d004100700070004400610074006100000016000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{10B60964-69EF-4163-9008-CF21CE1F4388}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 5000310000000000ae5c0312100041646d696e003c0009000400efbeae5c6508ff5c65232e0000005de10100000001000000000000000000000000000000f3e2e300410064006d0069006e00000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616209"	explorer.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2272	explorer.exe
3456	explorer.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3772	Astro-Launcher-1.7.0.exe
3772	Astro-Launcher-1.7.0.exe
3772	Astro-Launcher-1.7.0.exe
3772	Astro-Launcher-1.7.0.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
4252	chrome.exe
4252	chrome.exe
3772	Astro-Launcher-1.7.0.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3772	Astro-Launcher-1.7.0.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3772	Astro-Launcher-1.7.0.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2272	explorer.exe
2272	explorer.exe
3456	explorer.exe
3456	explorer.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3772 wrote to memory of 1784	3772	Astro-Launcher-1.7.0.exe	94
PID 3772 wrote to memory of 4136	3772	Astro-Launcher-1.7.0.exe	96
PID 220 wrote to memory of 1712	220	chrome.exe	101
PID 220 wrote to memory of 3704	220	chrome.exe	102
PID 220 wrote to memory of 3704	220	chrome.exe	102
PID 220 wrote to memory of 5116	220	chrome.exe	103
PID 220 wrote to memory of 5048	220	chrome.exe	104
PID 220 wrote to memory of 5048	220	chrome.exe	104
PID 220 wrote to memory of 4620	220	chrome.exe	106
PID 220 wrote to memory of 2728	220	chrome.exe	107
PID 220 wrote to memory of 4620	220	chrome.exe	106
PID 220 wrote to memory of 2728	220	chrome.exe	107
PID 220 wrote to memory of 3980	220	chrome.exe	108
PID 220 wrote to memory of 3980	220	chrome.exe	108
PID 220 wrote to memory of 2116	220	chrome.exe	109
PID 220 wrote to memory of 2116	220	chrome.exe	109
PID 220 wrote to memory of 4832	220	chrome.exe	110
PID 220 wrote to memory of 60	220	chrome.exe	113
PID 220 wrote to memory of 60	220	chrome.exe	113
PID 220 wrote to memory of 640	220	chrome.exe	114
PID 220 wrote to memory of 640	220	chrome.exe	114
PID 220 wrote to memory of 1076	220	chrome.exe	115
PID 220 wrote to memory of 3248	220	chrome.exe	116
PID 220 wrote to memory of 2136	220	chrome.exe	117
PID 220 wrote to memory of 3216	220	chrome.exe	118
PID 220 wrote to memory of 780	220	chrome.exe	119
PID 220 wrote to memory of 3216	220	chrome.exe	118
PID 220 wrote to memory of 4252	220	chrome.exe	120
PID 220 wrote to memory of 416	220	chrome.exe	121
PID 220 wrote to memory of 416	220	chrome.exe	121

C:\Users\Admin\AppData\Local\Temp\Astro-Launcher-1.7.0.exe
"C:\Users\Admin\AppData\Local\Temp\Astro-Launcher-1.7.0.exe"
1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Astro Launcher\Macros"
  2⤵
  PID:1784
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" "C:\Users\Admin\AppData\Local\Astro Launcher\Macros"
  2⤵
  PID:4136

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2272

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3456

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2740

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8ae0fc728,0x7ff8ae0fc734,0x7ff8ae0fc740
  2⤵
  PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1752,i,4094630395494243501,12717788241753321914,262144 --field-trial-handle=1960,i,3901876659412953671,7287156199021705110,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:3704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1608,i,13026253921108822176,13274453133309422941,524288 --field-trial-handle=1960,i,3901876659412953671,7287156199021705110,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,12253159043281212084,6109385866835021297,524288 --field-trial-handle=1960,i,3901876659412953671,7287156199021705110,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2400 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,3578923954037694496,4691012930510414036,2097152 --field-trial-handle=1960,i,3901876659412953671,7287156199021705110,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3348,i,3694554323816695731,5695971486506517587,2097152 --field-trial-handle=1960,i,3901876659412953671,7287156199021705110,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4464,i,17141706324203607358,10207656140924569750,2097152 --field-trial-handle=1960,i,3901876659412953671,7287156199021705110,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4420 /prefetch:2
  2⤵
  PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4656,i,530948740810491150,11580791680344209085,2097152 --field-trial-handle=1960,i,3901876659412953671,7287156199021705110,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,1792637985971684738,1733934411739835855,524288 --field-trial-handle=1960,i,3901876659412953671,7287156199021705110,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:4832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5844,i,16649050860529027182,11682347191333670732,2097152 --field-trial-handle=1960,i,3901876659412953671,7287156199021705110,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:60
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4760,i,13643553605813254123,6220154811211561320,2097152 --field-trial-handle=1960,i,3901876659412953671,7287156199021705110,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=240,i,3388124077944564090,7953652558940658740,524288 --field-trial-handle=1960,i,3901876659412953671,7287156199021705110,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:1076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6104,i,5826590266366225253,12447062049720782205,524288 --field-trial-handle=1960,i,3901876659412953671,7287156199021705110,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:3248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6096,i,8549984994373114492,11543007400733394266,524288 --field-trial-handle=1960,i,3901876659412953671,7287156199021705110,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3972 /prefetch:8
  2⤵
  PID:2136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6184,i,7175501804666728558,4649688749366322913,524288 --field-trial-handle=1960,i,3901876659412953671,7287156199021705110,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:3216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6216,i,8666915574636642573,4956615080653600715,524288 --field-trial-handle=1960,i,3901876659412953671,7287156199021705110,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  - Modifies registry class
  PID:780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6444,i,6741488913198371989,6001869504865060397,262144 --field-trial-handle=1960,i,3901876659412953671,7287156199021705110,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4120,i,13144489223602570726,1039688244700828857,524288 --field-trial-handle=1960,i,3901876659412953671,7287156199021705110,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:416

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f7befc6bf05e4a6815ce4c31e987b23a8ddc4e301127158812d7f02585a13b5e
MD5 d6c61724c093438cbbec0f4075bbf005
SHA1 814c268ef71e051b0d6e22f46bd4518453792382
SHA512 dd237c22431b82f23fb97b3ae1b10d0194d3ff721d14ee2a33af9ec8c914fa436219d172b0a3930f25bdd90370100ee504816562c58abdae94a72431a918a417
TLSH
T1BCE02BFEC961AD2B08FD071924580647E75423173B40466B3E3DD609CFB8B3A0986C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 e663e4df45870b324bcd2bc5defaf0d01ef6eb368f24e13508e44fcf5ec90324
MD5 cdd4bde61925cd51829321e1d3bd58ad
SHA1 843e7102ff40352f716861b298d69b3c4b443e29
SHA512 17c85cef4d105e8e098fd5047d475596e8d29b33b0a3d46ca8100e8d439382906aa436c7845ef10980c257ca23c573ee12d99aee3d55aa531751ee5fcbe19043
TLSH
T1DE513D93D9F1A014CF32857105682E6767A367A4C50ADFC729F0A82CE08FAF82E4709D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 336c60da808c9c3ec953d9e8bd780e8a048c9610993372d760426c9bfb541374
MD5 538d8f20e044955c52e7f679425d41dd
SHA1 1a8c661eed0cba078df63baf3cfcd27e7fb97029
SHA512 d4bac3985c0b94781b550834657d553b779e5b80d0469b7c3954dd740b35787a4d9e30cc8fad13ff154a0b34baebf0ca4952219308549633d2930c53fb58baf9
TLSH
T164512F83C9F1A014CF22417505A92D6767A757A4C50ADFD72DF0A82CE48FAF82E4309E
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c8213e0dc5ec1e08441aa651b554967ad8a18de5bc8fd0c75ef405e6f6b1381f
MD5 e56d73356292eca0458a34bb06629d8d
SHA1 8b637a7a8876cbb09832e793e60ff888e521e477
SHA512 e3641f47a3ff7535bcde33e4aeff820c7d5b92620952a9d2f3f326c0142cb22b9f912225f37736ab4c38bc5a3da0383e53d4b8998a87cb188eb211a7d8a1312a
TLSH
T1C14147B7C6D8CA6D890156E4A6152E2FCE690E24532C3C5788D8BF4F53E2971E20158F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 9c92e38061c040e3ce7e004839ce1dd9949c8a6e4e13762714df9fd67434ef74
MD5 b23d3a11145a490c6063869633384562
SHA1 f8ce5efeaa808c6fececb72d349f5b3fbd975a09
SHA512 6afe11172652b732e4117100dbba55770062d000ee69af310eb4accb1d3934fc064e939c23a86d1fe444804c998c27f50aa4c89fb4bbf0fbf2ded78f4114796c
SSDEEP 192:DEoXInqtEaIL4FZ7hWHzgQMu9fX8nQQTHaWHi/:DEoYnqtEaIL4FZ7hWTgQMu9fX8nQmHav
TLSH
T1A0D18AF393E4CA6D991252F0DA156E1BCE690920031C3C7689E4BE5B93F35B2E20179F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 07c81699b5cf42b3d77bda90a888c28393badbfbab56fd1718841120b0a15987
MD5 2c048df1759f476cc757f64a68a1eace
SHA1 66f7dafc9900c88fb21f548136be3645d73ba5a9
SHA512 8310c8f2d98c533a814d1ad6c0e8f8e9993d3eb9f4b002925d9b36bb1f086ce46e49ff8cb5b0cad2656d857dc49a13e5de19b5b89b15582ac970ce64cb5889cc
TLSH
T1E84147B7C6E8CA6D890156E4A6192E2FCE690E24532C3C5788D8BF4F53E2971E20158F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 ee63b9b737e22f9f153abdb0f0183e5855c4ca30d3d89194e81ddd7841326def
MD5 a442a3837396bc0e042783a4ae6498c0
SHA1 f7c877137df966b6ee0ab3d6f5d9b742fa9d981f
SHA512 3c13e9d7ead8f06e11a7dee38411cf13711d1bdaada2439d9293cbc5c433abb50c82aa1a173b5c8d984483f477405352b14124518fa7c235275d0ebbca10a290
SSDEEP 96:DEoXIn+P1aIL4FZ7hWHzgqlMu9f3H8nQQTHk3:DEoXInq1aIL4FZ7hWHzgQMu9f3H8nQQg
TLSH
T1A0C18AF393E4CA6D9A1152F0AA156E1BCE590520031C3C7689E4BE5B93F35B2E201B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d7fa1085d9f9d7c89ce4eefd3e3c833fb225bcb45ce02da1e7940157f3a67645
MD5 870b8424c5c927375e426389789ae595
SHA1 9f254511e18ea39661e92ca0d45db2e54e4ac461
SHA512 759eba074aed54f3f725456c32eb73ebe6a067307cb2000fa175727f5d3aaf984b3727ed586ea2be1ed6784c74b3933d73d5091784b95843523bfb3382aa9435
SSDEEP 192:kR47IP7cTiXkv7JympWPRpo4n95Hsb+WNn97t6TEokXcea23aNh8yIsnAUgraJ:kR47IDc6AB6Xl7wFyERXvaNGe
TLSH
T18152D72EA910697B9CDBC35AF9167763E7F5102635902E44EAFC8B1C14E79CC231742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 895f471c18b1e262872814e8a3590028a46e2a3f4513599a4da4327adfa461b7
MD5 c4d985d955db5eb65ddcd825cb8a7d68
SHA1 639a9a01794c924af01ad1d94dbed0773539e3a3
SHA512 267c86ab94448b45754e7ede7b398a516383efea521f88585d1510a9e661c88d7d16f396ed5948beb0ab1c7047a55929e1bc58275e41778dfc54c3a0c8499dd1
SSDEEP 192:kR47IP7cTiXSv72ympAPRp24n95Hsb+WNn97tpiIeYkXcea23aDhVyIsnAUgraJ:kR47IDc6+QUXL7wFzeBXvaDHe
TLSH
T11852B62EAA10657B9CDBC31AF9167763E7F5106635902E80EAFC8B1C15E79CC231742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 caab263b7cfc1d4b6f9fe4bf46d5a42d1cc48f0481a7f6e45e92a14df0db77c3
MD5 e7cfb90a9d7716125c9b1098a67ec7e9
SHA1 c06ebcdedbbae33fde55ee9a03ad37ca46790b64
SHA512 bc15417c588be64b95e2c9a544c9aa27a14b6754353e4e22148c63714b10a2087ebb1ab485e8add97fa6243497e1fe5392f79451a91430abb035e1901e4ee190
SSDEEP 192:kR47IP7cTiXov72ympAPRp24n95Hsb+WNn97tTp20kXcea23aLVyIsnAUgtaJ:kR47IDc60QUXL7wFb29XvaN8
TLSH
T1C442D72EAA20657B5CDBC31AF9167763E7F5106635902E80EAFC8B1C14E79CC231742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 51c2b3594d17206849d056bb3e0ede95eddd23c6d0f161fa8360f187aebc0736
MD5 17d74293892c8a8ae2d5b5c38a4a2ca1
SHA1 b8ba01b898babe7d6949a5f13d3dbb3ee649c40c
SHA512 cc822c4cc19fe7f3354b38dac2509c9e9a19397cbd4eb70507401739fc564936fe0e3d158825fa3cdf64bbcf4334d8038fc0644fa3264838694d2083b4cb8a0d
SSDEEP 192:kR47IP7cTiXSv7JympAPRp24n95Hsb+WNn97tJXYskXcea23aDh8yIsnAUgraJ:kR47IDc6+BUXL7wFXYFXvaDGe
TLSH
T19B52C62EAA10697B5CDBC31AF9167763E7F5106635902E80EAFC8B1C15E79CC231742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3b27d6419312bd845e19d1622066ce0f267af8b446f5b60032516e77833b4d75
MD5 38182f5acda3a4874464df66b75af9b0
SHA1 5d99f8b0b138c58a782a0695dc21875180899cb8
SHA512 761fe07e0000a4cf052281a2a1be843577e7a9e62a17014216a142e86ce5d7859381896001b2ba2767163c60a4ba4eb20db81838ee6c99dbc106ba2a270ce203
SSDEEP 192:kR47IP7cTiXov7JympWPRpo4n95Hsb+WNn97tjxUtkXcea23aNh8yIsnAUgraJ:kR47IDc60B6Xl7wF7USXvaNGe
TLSH
T14552C62EA910697B5CDBC31AF9167763E7F5102636902E84EAFC8B1D14E79CC231742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f33f43a35d603a9d58b406ab1fddb73c7282997904f8cdc5eea14dc02cd1ccaf
MD5 bc5aebcbab47ae6e284d1bed2d5487ba
SHA1 2e04857ec822224d64d391cd60cfe50be0189f0d
SHA512 598eae4b05d99b65206cdc1acb1c96142796e48fe1dc1b7803fcbcc95007a2c0e311ca781bd8a6449b18b8ee7becf36289dbbe4cfbae834566474678e89b0fd0
SSDEEP 192:kR47IP7cTiXGv7JympWPRpo4n95Hsb+WNn97tNVsjkXcea23aNh8yIsnAUgraJ:kR47IDc6yB6Xl7wFhsgXvaNGe
TLSH
T11252C72EA910597B9CDBC31AF9567723E7F5102636902E44EAFC8B1D14E79CC231742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3f24044203e83f8e4314468833a28253ac99c73c827a74ebf2b2a6cd0cf37def
MD5 86be3ff83cd35dbe35b38db511974886
SHA1 2a7556b74b84c3e79264a9646ce8345593802762
SHA512 24b7e3536d1214efd6f14f4815cb0753b2b9a656c2163e1d1109d5ebdd37ece6a0ecb244c6bb6e4fa8d6afeda05b288a24fd55fb2d67f3b2e6a8944a8ee03a84
SSDEEP 192:kR47IP7cTiXsv7JympWPRpo4n95Hsb+WNn97tLhclkXcea23aNh8yIsnAUgraJ:kR47IDc64B6Xl7wFDcaXvaNGe
TLSH
T13052C62EA910697B9CDBC31AF9567763E7F5102636902E40EAFC8B1D14E79CC231742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b5e8b58066c3288900c019b8dbd56d16dd7bdd5ea9070a0a6aa071943bc4681e
MD5 3921983356b85ef6e764191af8c4941d
SHA1 5da2fd3762ddd1dae6f7c00cfd92b19ea2308acd
SHA512 5f78e0cc59df73c3e16ddf3fc1eddc7a7ec0342073d87047d8d1cc52a0e9fc822c4c1cdf0f0262f4ec54ead5044bfb82be8c1e8eb14bbd7819fa1de7151e28e2
SSDEEP 192:kR47Ii7cTiXov7JympWPRpo4n95Hsb+WNn97teUw4kXcea23aNh8yIsnAUgraJ:kR47IUc60B6Xl7wFzwhXvaNGe
TLSH
T15052D72EA910697B5CDBC32AF9567763E7F5102635902E44EAFC8B1C14E79CC231742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 4b4dbb5e0b9122c0ecacdeb33a8ed7a5376b56d960dc9f5e33faf46839ed6278
MD5 9b4bd8c3e44267a1d1d827c194767fe6
SHA1 d41161068aee0af7970285a5815cd009e0ec95d9
SHA512 ca5ce783aaac97cef1e406e1b24c3744bbeca63d24e656bec1dd48f9493cf0eca29739faea0811cadff6f875f7f638f3903ace8c2ab10d4c8399b952ceec8758
SSDEEP 192:kR47IP7cTiXOv7JympWPRpo4n95Hsb+WNn97tv8c5kXcea23aNh8yIsnAUgraJ:kR47IDc6qB6Xl7wFaceXvaNGe
TLSH
T17452C62EA910697B9CDBC31AF9567723E7F5102636902E44EAFC8B1D14E79CC231742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d5983e49cb94fcec35d5987fa9306a1025c040e7f5ee4460c1e8ad389831cd0a
MD5 2c7e11b7b10a3746efd76a2a3581e919
SHA1 1af3136beb5658effeaff9c236d7945dd27a442e
SHA512 c6e52266f3da04d3c47a66ee16daf0c8651b121472531ce90df16aaa50874561f1dc00f67be8f171335861bffb8d4f2264fe628a64bc4dcc3d693f212575fc0d
SSDEEP 192:kR47Ii7cTiXsv7JympWPRpo4n95Hsb+WNn97tguw6kXcea23aNh8yIsnAUgraJ:kR47IUc64B6Xl7wFXwTXvaNGe
TLSH
T1D052D72EA910697B5CDBC32AF9567763E7F5102636902E40EAFC8B1C14E79CC231742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 402243a101f6f1210e326a8be0c88f4722aa8b8dc0d347b043fccc0438b7c18d
MD5 428abc8cc429d99f5f89284670d89d4a
SHA1 0d361802ddd34ef3a74099601f4a857c229ce6dc
SHA512 41c2cb4a36c4051c629de7d58de39fad958fb67751940254e0f38f73fc16429fc85fdc8ad30f9a3276b4906d142818fe0d15a326d120875f9bbd34b26b73977c
SSDEEP 192:kR47Ii7cTiXDv7JympWPRpo4n95Hsb+WNn97teUw4kXcea23aNh8yIsnAUgraJ:kR47IUc67B6Xl7wFzwhXvaNGe
TLSH
T1DE52D72EA910697B5CDBC31AF9567763E7F5102635902E44EAFC8B1C14E79CC231742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1239cd96272ce95b6a458d424bee6353c7290e4c01b846f954f84d0e6f486c65
MD5 3063d36014bfe568fde76d7f0a97583e
SHA1 ca19f754991d9fa3acdb624663cfaea73b524936
SHA512 aeeb3ea383f3e076d3592fafa5fc6b08c6a73d24188e0269a104d7e8a8b842510eddd2abb49c0a1ca3ecc24cdb99ff6225f061939fe5b91814437b81504f6a31
SSDEEP 192:kR47IP7cTiX1v72ympAPRp2/95Hsb+WNn9702kXcea23aLVyIsnAUgtaJ:kR47IDc6FQUXo7wF0/XvaN8
TLSH
T10042D82EAA10653B5CDBC31AF9567763E7F5102635902E44EAFC8B1C14E79CC231742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7f15f5e06307cec414ebb5a4579a188c08596b4a0ee418ca8714eb932d383f02
MD5 545b9f24c4fee7b6329ae57d2f0900ed
SHA1 8caeee064a74dc090d0ab52e33dd34df66f7eda0
SHA512 47ef892d798c270f2be4d265079a5959e51dfcc0767e33f3a1abdbe75b919257aa9fca93a76efbde4400e93da5fdc7c61deacf15e4f465c69c3bb56e83adaf6e
SSDEEP 192:kR47IP7cTiXbv7JympWPRpo4n95Hsb+WNn97tcyy+kXcea23aNh8yIsnAUgraJ:kR47IDc6jB6Xl7wF7yXXvaNGe
TLSH
T11E52C62EA910697B5CDBC31AF9167723E7F5102636902E84EAFC8B1D14E79CC231742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b69cdec2b3c0db544e60b140d491a0858df2ab4a9ee3dc830ee6b0d88797ff23
MD5 f8e5598be13c6fed4998998a090a501d
SHA1 ea0d5954b6390e92298036b9e32f732cb1c531ab
SHA512 7a894d532227e6c4543f1bac87b266dcae12661d5a11a4b336a4c3e44dc0107ecc61c5085190c35bba86610a31a453914fa1e9bbb436f719ec33205b95252f4e
TLSH
T101B0124080029501C00206F8118224987124BF19A60B270293E0A922882A1A08024051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ef67.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59ef67.TMP
Size 96B
SHA256 cf5f289684577bb3530a737ce7093ac027fb5dba61b621c569596ffa318aca6b
MD5 b4af7b0c45e3ed3456be78e166ab02c1
SHA1 3f785b5e7b86d666b4283c4bd7d73b36e98950b4
SHA512 55c6b9edbd3efc7891231ded5cd713a9272f9e5108552e07e082b2c514a666a9dd66c1a7ccb3f21975a80cb74b8b16054b372dbd3c7f83fc146ad29ee2390c4b
TLSH
T119B022C2C20323E2C08203B038888AC830E8EF22CB030202B3F02E22EC303208020020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 97ddfe5829e657264d58b16ce6e145f1c5df539378f87ad832368214323d8408
MD5 5e007d7a6f000657086a9bde3eedadbb
SHA1 c7d1f7bd977536fc16f94e9f37182f13d10db224
SHA512 a4814af2e0bf4ccc2710446bcb9475be85b0d944c7c292ce1bdecb2884c88dce25aa06d46828d262e94eca62eaff413a9c47e1e2d83155d2614e59cca33a0f81
SSDEEP 1536:ToQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:pqfd7NtZL8cHQRZEQ6Spsk
TLSH
T15FC30237DBC21F339D92CB60B9530FD697F644A99034D301AA6D77BF6C83891694289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 e385172ebac384680bf94af9af063e242008b2bf9a9d114665f61a51c18a73d8
MD5 8225c0ec8f945629c19c1a730ef5588c
SHA1 cea567a45e10aa566f43ceac47eb441242aac284
SHA512 6f02cf09922a8324df46b0cbe483efb46095e6c718a60caebeaacd48c39a9b561f8d97c289476d65dafbda11b3f16cfd074a652fa58555f11c47aae270187a57
SSDEEP 3072:5/UuOpthq8s9UcbjmcFtFRvdaA8cpB9rhmoz2BNZ3dAN+Kqqfd7NtZL8cHQRZEQO:5/UxnhyHltj38EBTmnC+/qZ/ZLW3Exv
TLSH
T1E5342372AB972E33DEC5C778652716AF67F288A95038C509E7F82BE75C87C121111C9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 277KB
SHA256 f3c95ba7a2f303bd346dfe7f4ef18e2a39f18fc44066ca46e3ca7b24a3ecdb26
MD5 69dbffad78db7b505fc106ced410586a
SHA1 fee2ac3c16c839aa74f82676f52cc1313323c68f
SHA512 f5221f637404fdcb8e7a42d525f851c293b3a526b4a2900d741a5c4a0d67d5648bd8d12429fe0565542f822d269983833850149047d3ebb34213444f0e4136f8
SSDEEP 6144:UMZM6x/STtqIMUxnhyHltj38EBTmnC+/qZ/ZLW3Exv:e8SM/8ESB/qZ/piQv
TLSH
T139542375EB433D33DE89CA3C9527166E5FE298EB8438C948F6F43AD75C86C525502C88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 011dfe99ffcd82b59f097309d58e8d6b76888e817a91df864f00bdc17ef72252
MD5 ea0caaf774242ee0d0e90da22c6c230f
SHA1 3eb4089bb3f85a8b5cce42bba3fae60eb7127a22
SHA512 0f72bcd97cb5b946db3c131328ef2a98afa63bfa528bce5443ae1e45139df8fc32c6884386a676b2a53b0b1334c9542c8c749870f0e4ed18879fb58e3275ef9a
SSDEEP 3072:ArUuOpthq8s9UcbjmcFtFRvdaA8cpB9rhmoz2BNZ3dAN+Kqqfd7NtZL8cHQRZEQO:ArUxnhyHltj38EBTmnC+/qZ/ZLW3Exv
TLSH
T1A3342372AF572E33DEC5CB6C6513216E6FF288AA5438C509F6E83BD76C8BC115502C98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 e335ce77bf857d4f02ea3c5fc75430172a4ac67fd58d9c712177c6b628282570
MD5 d2784e5684c6e5483ae600c5e0323f03
SHA1 706decc67f0d45939cb99febed1c81b53ff43390
SHA512 77fa6a175b1aa2776b511f256ce0c87531eab9aa453c80d9ef93a11efe611439567ed255c50a239cb2b6bfaa7eee5dc06dc4575658a979e06a7ef88a0a535509
SSDEEP 3072:u/UuOpthq8s9UcbjmcFtFRvdaA8cpB9rhmoz2BNZ3dAN+Kqqfd7NtZL8cHQRZEQO:u/UxnhyHltj38EBTmnC+/qZ/ZLW3Exv
TLSH
T182342372AB972E33DEC5C778652716AF67F288E95038C509E6F82BE75C87C121112C9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AstroLauncher.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Astro-Launcher-1.7.0\pu6Db9kHnWbc4E36k0sEHjJSavOzAnk=\AstroLauncher.dll
Size 4.7MB
SHA256 f80683ac255bf215b06213a3f9467cec322744d5a330076655ce7a2fee037605
MD5 841bf5d423cdd3720a32c465f10e9941
SHA1 b66efd38284609f0cea27240b53fa0a08060cc99
SHA512 6a3eb7e39d2657fd023b9d5a12909897bcabf68b0cc9a5009b0b0181cd911dc463c71598417e7472aa50d018b4cc6846f8dac0c613cbb8a89760b2a6436c75fd
SSDEEP 98304:qdzSYvIJgGuA1Vkve8H4t/vLuCWK6NuSDD8fu7tYLbazSCz:OIfuQVkWHt/v6Ch6p/8WKj
TLSH
T18936336833B44D02FA3F2B7891B50B308F72515E3965E6594CEAB4ED93A67407E123B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.Concurrent.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Astro-Launcher-1.7.0\pu6Db9kHnWbc4E36k0sEHjJSavOzAnk=\System.Collections.Concurrent.dll
Size 269KB
SHA256 6ffcd942293576dbd3ab66ca6ef2ea0428f9e84bdacec63316bc5c069041f37c
MD5 d44f5a7649fa99f886674f33b214462c
SHA1 2cb6f57a33e4b497ce04ab75d2ee3fb860485d1d
SHA512 a51f19f34e07354fac8228e8af6a1abd06619b6ef466f13e9ac239e7ed75d63a129030b64ec895d17c6ef597c19f4316fc2d01f95361d9c0361c17d0f0eec3fc
SSDEEP 6144:hPA2Hvj4tByYOTblcFe4khyO2qIykwXLy:hI2vj4tBypHfhD2qIrE+
TLSH
T174445B2163884F12FC6F897D9593D514E2B6A8530322C2DF0274A9849FDFFD2AB77522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.NonGeneric.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Astro-Launcher-1.7.0\pu6Db9kHnWbc4E36k0sEHjJSavOzAnk=\System.Collections.NonGeneric.dll
Size 101KB
SHA256 aba7167d2e95ee23a55a03586588eb01ca3e63942ff2e1392936692bc337c194
MD5 9a208dbc9f6ea15911a634abde78edd8
SHA1 df9f0a91436b7d9afe573100603f2b400a4a9659
SHA512 173b3a02b0cfae84b4f7af22a6de582521024b806321d9e754176891664705ec1cf82e2dc725396255d05697e73e3647634da8a0c4420c13aa875aca5a464b55
SSDEEP 1536:lWd0tJVDX9LuIbwNC5IQ7XVrMZqz9AZWTUdOoz6Y:lg0dzNuIc+IQLGZqzKZAoeY
TLSH
T19AA3182673D80322C69E6BFC81938A01E6B5F4D26713D1DF1618A9CD1F9BBC2D6B2147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Astro-Launcher-1.7.0\pu6Db9kHnWbc4E36k0sEHjJSavOzAnk=\System.Collections.dll
Size 253KB
SHA256 f0fe3fc9cecf713d5c29a2fecdf6aafc50b41efb8130a56af54b8c9330c1ffc1
MD5 5e013ce9a5a3cb2840b4a0d56f86c849
SHA1 ce783a1bc6c03b5082059d6935cecfed6944da8c
SHA512 8041a3486e1e72079a111c2354f242dd74a43ce1ab4e5dc76b05e24e17bc2654f1ad462358be14e2ea2bcc921e79a17c3ccdfecd2398783f95ed0d499989afcd
SSDEEP 6144:SnxoXLkDXDiKNYX8qTKfAyryS1rIgH3iPt:axCkDXDiQ+jTURrhFXi1
TLSH
T119444A2A778C4E12F56F457EE663C012D7B390A34712D2CB06BEE5840E97BC2BEB6055
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.Annotations.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Astro-Launcher-1.7.0\pu6Db9kHnWbc4E36k0sEHjJSavOzAnk=\System.ComponentModel.Annotations.dll
Size 193KB
SHA256 9f8d4aaea363b146b5484e663d817f0390ff20583b397c124411c50210338ae3
MD5 220f983bea1b739e8377675444638699
SHA1 a2b93348725ceafe8fa7d83c928eedc092a6039e
SHA512 c325b1c959dff345b13a140c20f3103fb7f556ff13b68caf80dfe7f08b26d4e6a2de911b1cfc834b2867a4913a8acc0721295589587b3d281beb1b2de7a44ca6
SSDEEP 3072:fD/LFZEiJ4MxIQdCLlTXqMx3XNpemMWParD5/oE5bF6oaszQBB:bLEPMSt6MfpezWParmszQn
TLSH
T1D4144A3663D80616F7BB0678C9226921CBB3B8966722D6CF9554958E0F537C0FE32362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.Primitives.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Astro-Launcher-1.7.0\pu6Db9kHnWbc4E36k0sEHjJSavOzAnk=\System.ComponentModel.Primitives.dll
Size 77KB
SHA256 3dc8bfbf3b542c45646a7057d3e945374c7b85db69c37f2a16794e88091a5b06
MD5 32ca30c430324b105ded9c880e2e9453
SHA1 1f0945383954c26312190f2059d71ef1591e95a1
SHA512 02c242e540dd9ff34ef8da2cb9f0d33adc17f8fefc7bf804a7d5904789d95bafb96d9dabceba70c92c6029bd2fb92252515315b9af0c12711dfe5120078473d1
SSDEEP 1536:+95/UZMu4zhd+Cv8A/oqevD2olsOnbktXzDv:+w43+S85qKD2omOnIv
TLSH
T114734B1823EC0126FBBD46BC9573A821A575F6831713D9CF4AA0D90E1F5BBC2E27152E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.TypeConverter.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Astro-Launcher-1.7.0\pu6Db9kHnWbc4E36k0sEHjJSavOzAnk=\System.ComponentModel.TypeConverter.dll
Size 729KB
SHA256 534f82e18158a5bf76019b847a1f91dc8f54fb8075561d7678dfcab89c315382
MD5 7d5b13bd8e7b8911c0829c64e3f96db6
SHA1 a021ea71bed936351d56fdb2cadf8cfe6a8123da
SHA512 8bacb8788691c92f12f3df5910ba30f3228021dafd3f1b34a6203d7f23a86bd1766e1c03e9682bc88a6156a55b4ce54c65b5a3996f2ebcb445372bd22ab5ce1d
SSDEEP 12288:DHbWtrT/lAqmrIofhCXvdb+/ipZ7DvBEFBiXMS/e7QLohk+xLRxo:D7WtrxlmrNfhCXvdb+/ipZBEFBiNeMSW
TLSH
T181F45B559BD84A05DABF8278D672C801D570AC83533A86CB19D5EFF51FA3FC2D23A122
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Astro-Launcher-1.7.0\pu6Db9kHnWbc4E36k0sEHjJSavOzAnk=\System.ComponentModel.dll
Size 29KB
SHA256 d912b7e2d421a49a4eee9730764047f058a8d72c9b3618dcc195d6f427b55ae8
MD5 c561bcd4e57dbe2b16b4e294795c0a40
SHA1 8f3fb4dab0647f8c2245ce6006fc4398437f3bc5
SHA512 bcbfc4a08ae86a8fd4022a54aacc8cd34401dfc7bb1c3905a15588cfd15036fb2349f342356f708def2b96bd1810864bd0cbaa89943153b2db429e4a04bf70ac
SSDEEP 192:CW461WVqhdOk7+ASB7x0Yu7lWF+GBTBWseaAWAvkpTsX01k9z3AZTCJ/0b:CW461WVqhn+J0YMIlNKv6oR9z6GJcb
TLSH
T1DED26EA6CBA88213ED9A5E7056BDCB877D3DB3C54E02866B1196F1090D937C4EB3017E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.DiagnosticSource.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Astro-Launcher-1.7.0\pu6Db9kHnWbc4E36k0sEHjJSavOzAnk=\System.Diagnostics.DiagnosticSource.dll
Size 405KB
SHA256 8501928426904a1b660447cb5cdeae888ec61a850395910a050fb33ba2541a14
MD5 8e2716fb1500a1dc46b2e03f963026d2
SHA1 756d4e8c141751db68006cfdca6675dcac0e189b
SHA512 c10b56888cbdd5481e833d43adc798b6adab8edb3d6e6100ccba761357badef2fbc10f7f9f5fef20c77f5f3749a73612f9442c79bc9765177fc97b38cf69000d
SSDEEP 6144:GsBTEcoc/FGFasNt2l4ru2jKw6xtQ7/tvjETqCZ03EdZZj4MKkf:dBTf/FGEsNtM4q2jStgjTc4Ml
TLSH
T100946B24E3D40D72CE6B9979C1DBC431C172924257D2DBCBA900ADD8AF1FBC1AD3661A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.Process.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Astro-Launcher-1.7.0\pu6Db9kHnWbc4E36k0sEHjJSavOzAnk=\System.Diagnostics.Process.dll
Size 329KB
SHA256 4ca86970668d670a579db1c5733144048d1e52c2bb2e0892c86f665e39883f8d
MD5 897a74aba264763a5dd538d26b6c6473
SHA1 3a11d0853c4833ae9135f07eeee9554307604566
SHA512 1665540bd61d83a4e14652b33150ea2c01143b3237816efeb7b0d06610de70bbfaef2d6aae8d6bcf3d6cbb2d2b81053dcaaf614e467667b508ca3bf937c26b1b
SSDEEP 6144:svkD/qaP75vD9eEIdghrT9jb3b41PlmFEEZTdiX2J9:sMD/qAeDdqJg89
TLSH
T140748D247B980506FE6E96388C63D502EB78949707D1EBD743A0DBDA3F4B7C2E632116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.TraceSource.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Astro-Launcher-1.7.0\pu6Db9kHnWbc4E36k0sEHjJSavOzAnk=\System.Diagnostics.TraceSource.dll
Size 141KB
SHA256 953bd83cfa994f088c5dd326c1746dda1db937c9311c3e58f74e030c3190bb1f
MD5 a13f08d56314a49a0c56364907c6f536
SHA1 21fc500cfc888ce88650b79912f404e4ebd2551c
SHA512 03283d44f9d7fb875700ca157fef4b44d4a4cbb494fb44d4da55c96d68035c8d1bacbff0fd0f8acea0e75cc1b14a750823f23146a72b0f22ba53ce7e1fd18362
SSDEEP 3072:IdiUYBg1TeY0dpwQn60x7cftbgZ7eId1DT5DFHHg:zBg4Y6aQn60x7cftbgUalm
TLSH
T1F7E34B26739C0507C76E87B88563C702E6B3E4870302D2CF5AA6AD591ED7BD1FEB2485
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Linq.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Astro-Launcher-1.7.0\pu6Db9kHnWbc4E36k0sEHjJSavOzAnk=\System.Linq.dll
Size 529KB
SHA256 1b81642c1ee4f21ebbb57213c14e50df59aabcd7bf91de2eebdf4c0d9f32845b
MD5 7d69cbd4f96ebaab18b74203e37f5a59
SHA1 23c4ba0ebd3ae3a8e18e43854e1261d682cc6af8
SHA512 c7b3edfe8bf9f85115950da6aa6b010ebc9a1327ab99fbcd9313de89655f1cd8d15ae4f5cb16e2c52ae2da693c9d41a88a23ff98d55948dfda51d86622e2eaa4
SSDEEP 6144:/NYb3/ypY1hh8r4bdhR+JU1/0kxryufbFHJMyS5IHuYzfhMxjCkoTcK:1Yb36S1hh8rwdh8UxeEvAEImH
TLSH
T173B46A2493B80F07C2AF86BFE553E151D7F1859283A2C1CF995DEE961E93BC165BB020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Memory.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Astro-Launcher-1.7.0\pu6Db9kHnWbc4E36k0sEHjJSavOzAnk=\System.Memory.dll
Size 153KB
SHA256 4d6fe7d23c06b4e81748d83a1314218f31bb1e4ce9b6d1ebc7ba8a78a342833c
MD5 4807ee6fb0ab7ed7d308d67657af7ed5
SHA1 c8eb5f273d03097957cd99eb1cd28bd3defa5981
SHA512 15c4cca2bda3fde1de51e2783afe7dcb4f4d430a16d132594cb4fbe46ebde25eddccea27cab9de2a6e5b83d7aaeed6de2c2f7bf5a7cb3d1dcd494227a5a99725
SSDEEP 3072:hsyymN/j+0sbFbqX63vwZuIBo7M5F8966oYdACBuqmwvhtTihdNj:gmCb6oIBo7qDGACBuwh0
TLSH
T12DF35B17E2980657DA3FDAFAAD225302D7B36142672192CB4CE4DA441E53BD0FF738A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Http.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Astro-Launcher-1.7.0\pu6Db9kHnWbc4E36k0sEHjJSavOzAnk=\System.Net.Http.dll
Size 1.7MB
SHA256 8a7638d615e37d1b271c526979ee36b56c1b56193a33f5929dbeb29d1fa6d6e5
MD5 9ad75ca671ae18a8608aff8bd7fea9b5
SHA1 4168ec4f395f3ecf040b16297e7ba8930be6eb92
SHA512 51fc0770f8735b22d50f9e6db275245eac332c4cb4cfa22e1549cb91325fb706cb80b61a795399d10a5d86169dccd6b99cb5b6f35468c107ea4d057601275090
SSDEEP 24576:2tbStUEPt/z8tbT0SV+6hFE3iZdf2+QdJuIy616Ub4Pl5:2tb3EPt/z8tbT0SrvE53Et5
TLSH
T1DA858D09A3E88616D72FC67D856B4453C675E0878702D7CF1984FD983E537C2BA3A22B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.NameResolution.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Astro-Launcher-1.7.0\pu6Db9kHnWbc4E36k0sEHjJSavOzAnk=\System.Net.NameResolution.dll
Size 109KB
SHA256 53a3215b359e108f0315e81e4a1c4d9981d5bd3e1adc3891f598dcfd7e4609dc
MD5 e8f2953df4a4e44366a9d27248a88a7b
SHA1 4ecb2966ce69d14041a05368b78572f83e5594ed
SHA512 ce0d6f4cbc6d587ecce53194e8aa9031d59765ec7259606bac6fc066fb1a3f8ffe88543559a5bbf5b1a3e4cb41000c6eac6e9c4471e2938fba48e99d8a4d2d4f
SSDEEP 1536:+SA9vC8kXWSR71kvhqI7+mRJRKaR4RZDFsa3lZGUox0szhp:+SWC8kXW0BkvUMtjRXKvDGECU+B7
TLSH
T155B34914B3D00661DF7E59BC8A234E4AE3B2F0C24B21DADF1989D54D1F937C6B23256A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Primitives.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Astro-Launcher-1.7.0\pu6Db9kHnWbc4E36k0sEHjJSavOzAnk=\System.Net.Primitives.dll
Size 225KB
SHA256 ffb439ee971575c80749639eaa2593194de95dfc18eaaaa4011df9a39fb64181
MD5 973a3e46e93102d5c1ba0e1429b88a73
SHA1 2283b2c5d854004650cabc0bfedb4c14e1bea654
SHA512 7bd445d4d45b6f10b1509a2c5980cf6f3d8d812def745dbfe54b328b123836f3b7364f18e577e999483f55b9fffecaf1e553a0f2295c14de5910aaf0786fc06f
SSDEEP 3072:gwtBNI7bgkZrgyBHSchuzeQ4X1Sji6uJQ+Y6MFotKXxloV2O1weRx:X7I7bgkZrB0cgeQ0RJNtc0V2YXn
TLSH
T16D346C2A73D44E03F66DC5BEC657C502D372A9425B11D6CB86A4B78F2F837D1AE32122
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Security.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Astro-Launcher-1.7.0\pu6Db9kHnWbc4E36k0sEHjJSavOzAnk=\System.Net.Security.dll
Size 653KB
SHA256 4f471c45207ae53ad01cb0d16798c0cd94fb29a8253989da8c2f771e6db5e7b0
MD5 31a77cb4b0854d94e5530ca07b30665f
SHA1 272180c2f613fa578d5498aa3c766f5ee76784e0
SHA512 b0c15fef7cb7e1581d0cf2a9dac7d11be101b6b2de8a6dbdb249d2431c19fd6932ad45d118d004364fb54b1cfad46c25f98bc1ceb19f24de8794defd3f63d4aa
SSDEEP 12288:b+afG3x4q0UTs4NmHRquQZhaDcscj+Ctk6p9uMmBaYcuS4:b+4GTgfyh3jK6fZsZcM
TLSH
T19BE48D15ABD40B25FAAF873891724461D2B1A887F712D9DF0684C88E6F57FD28739323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Sockets.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Astro-Launcher-1.7.0\pu6Db9kHnWbc4E36k0sEHjJSavOzAnk=\System.Net.Sockets.dll
Size 533KB
SHA256 096c5ca2b8868c50991f183f0cbf8b32326cbf197f9a6cebe132c5ab63513d24
MD5 be82bc91373496b7e66ed884b4dc42c6
SHA1 2bdfcbcf5eb9c14205bf610709e25e8086fe6f5d
SHA512 694b8c80ba239dcc8b4cc90a2deb52611b8bc9de248ad6505d3c0f7a92b4891466a2fdf003c60db53425535da572ff968f0bad3bbc77c85a983df8e074821957
SSDEEP 12288:LZSV7iKFtxaGNUL2Sdr5Nzv0SAu9FWc1APTE/0NYo:LZS9i+txaGDSzxAu9IpEsH
TLSH
T1F4C44A1567E40E06DA2F967CCD134042E7F0A5861B42D6CBC494DADA3F437D3A77A1A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ObjectModel.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Astro-Launcher-1.7.0\pu6Db9kHnWbc4E36k0sEHjJSavOzAnk=\System.ObjectModel.dll
Size 77KB
SHA256 015061c7fea90ceaaabe2669db8b8110249295e19a6a571363c8a581ad9ba7dd
MD5 d10b29dcb31dc4a40d6d4ba7dfbd5547
SHA1 68f2112e206fa2da19e20b8b6dfca1495017abad
SHA512 43ab0eb7b84e9ff279d1cf1c5fb991806fe6bb4554a83a623aec37094be70b221cf6e64de3f94c067dee8b9269fa89cdf701fe248ec194b835ab5fbfb006b5ef
SSDEEP 1536:OXtGEl0XKXrgcCGfN2QSsMWrHGI35uzEl:Ovl0CrqQN0yHGIJug
TLSH
T16E738D18A7C80727EAAD067DD1E25822F135F6E31323CACF45E5D14E0F93BD2663616A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.CoreLib.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Astro-Launcher-1.7.0\pu6Db9kHnWbc4E36k0sEHjJSavOzAnk=\System.Private.CoreLib.dll
Size 12.6MB
SHA256 7f48a9493a1d9f6c64a51c3ec357cf8534874ea62240a54c2a1570a5913148a4
MD5 3f64c06a7c0a7aaf48e7f95b11e16e59
SHA1 09022ca6e7be1ea52d1cc54af362ec7d915f74a3
SHA512 5214985658e7a6e3dba89154f57fb759884dc962ab70b5e19189cab2d288cdd459e69265f36dfadd64f41fb03f1ae4588e18c1719f360fa8efcfb113388e1b58
SSDEEP 196608:zmhH8mtl5F/v/u5ks5OtsFnyQvoNT/k9B5f:lglb/vG5L5OtsFtoNTaJ
TLSH
T186D69E11B3C89F16E56EC27DC2635285F3B1F4A2135296CF980DEA882F13BC15B7B265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Uri.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Astro-Launcher-1.7.0\pu6Db9kHnWbc4E36k0sEHjJSavOzAnk=\System.Private.Uri.dll
Size 253KB
SHA256 7ce81174fdba93a1e12c596ea3e1ad4bcc9e798710292e1629cbe827ee34458b
MD5 fad0d4747aa546861652bcb7d37237aa
SHA1 96c67f217aed07466e4a1b571286939fbab6fa58
SHA512 bf8ba7d5bc35c3b7ef71b7c2d26217485c495a8963c45101e910ac70c4072cc44e019fe0332a10152bca50ed43d5e7f959dc848e7c3c9cecc38b7dd4b38c4bd0
SSDEEP 6144:1fAAcZQInBPKCeDc6Ci9MG3CMeVmtG+FsGu6MyN:aFODciMG3HamtG+fuVi
TLSH
T1A7448C25E3844E67F73DC2B981D3D112EAB270665315F7CB0AB5E1821F177C2AA36863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.InteropServices.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Astro-Launcher-1.7.0\pu6Db9kHnWbc4E36k0sEHjJSavOzAnk=\System.Runtime.InteropServices.dll
Size 93KB
SHA256 74a2dd12e1c0f3d9aca3f11e160a1de7a5bd4447ed8be3071377217a516f6874
MD5 67e5ef7bb29712cd647c9117ae76e48e
SHA1 0d590615d7d2216ff8a6c6b45f9e15586f4a141d
SHA512 41541cd2bab6517e79e71480289ab85d8c401238d359326267fcbeb25aac928081bd7a9f3e807c8d256b6572ea0eea76647cf71dccd7445e4906d38163914940
SSDEEP 1536:nDA6UupEelCtJfKS6+67NspnSPM+l5+ZkmVUKWH0ozkt:nU6p3lCto+dSPM+rCkm+N0o4t
TLSH
T154935A2437D84666CA2A473C8C375D50D9B2F6C613A2E6DF5781885E1D9B7C0C3B23EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Claims.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Astro-Launcher-1.7.0\pu6Db9kHnWbc4E36k0sEHjJSavOzAnk=\System.Security.Claims.dll
Size 97KB
SHA256 20dbae23f8943877ef1b9890bc2d6ae3a2716fbb32e26eb124ad435e9e534737
MD5 1c0629c16174d240b790218b72e25a81
SHA1 aab1f7c51f2c8d0a5159bb38c3ddf74dbdc55a42
SHA512 9fe0f5f09cbf80c44571843e54ddbdf4a55a958ab2b2cc1b5374feace80a6d61414eeedf9f37514742248a7cdb09a54a9a35a5240bc97fec259d69225172be49
SSDEEP 1536:jT22/as3w2pm4X+bX5SdluDQu6O/UJxOQwQ7rzUU3q2bP6xLrSjYF6zhP7U:j6I3LpmG+bJS7uPGMXSsF6q
TLSH
T1E9A33B6437EC4222D2BE4F3C94D19909E9B4F9825762C7EF0A39CA4D1E87BD1D930A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Cryptography.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Astro-Launcher-1.7.0\pu6Db9kHnWbc4E36k0sEHjJSavOzAnk=\System.Security.Cryptography.dll
Size 2.0MB
SHA256 a998a46e2379d65412d54bb6f55e0eb5f16c3d856228882311f011c870c668b4
MD5 3aeb519528a9c9261221d8020025ad9e
SHA1 3072366c21d4f244c2f450fb1547d952ba5545ad
SHA512 25ca2f6458932b3a3942723466d84b68865efbdd8dd32c23b024eba8a78c5a0d9f3c52b28c9fd32c7e7f3ca63457650767e0f350e61cbe522ed434f04a5961de
SSDEEP 49152:RmRKWpxajTJDMgmJE2JjdQLxObmpwXa41f:RmR0JQgey41f
TLSH
T177957C18BBE44B5AD52EC57E83234402D570F58397829BCB2689CB592F53BC2C7B6363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Principal.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Astro-Launcher-1.7.0\pu6Db9kHnWbc4E36k0sEHjJSavOzAnk=\System.Security.Principal.Windows.dll
Size 181KB
SHA256 37858ee4c9cc2d07c175d379321d86851e3e89f2278593153cd12f5e33c6655b
MD5 14435461924442e2324c8e5392fcd8fd
SHA1 917c29c0304fd51c978b13cc2b8fa3d1d20b521f
SHA512 d6bceae746cf95bd9aecf44edd26985fadc1663bbc8f268b0fbce2121aa822fcd27cda16e3628c311e6e3e44ee5de8462d6de595ec794aae03e4ab77ecdaa89c
SSDEEP 3072:SRkZDNCLsCTyRdtl63xJYrwr7oDi1Jo82TOK1BguZ4o:lULsC6Ll67YrOoDF82rPjL
TLSH
T1FA045C12A3C8090BE6AF967D81639601D6B3A45707079ACB5590C9DA1FB7FC2FF32253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Encodings.Web.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Astro-Launcher-1.7.0\pu6Db9kHnWbc4E36k0sEHjJSavOzAnk=\System.Text.Encodings.Web.dll
Size 129KB
SHA256 a6bc1ad954c3213bba9b0e27a3aaae8321adfa0642ec679bf4452f7819c8ad54
MD5 b50bebd09bd1eb336c005e78757812e0
SHA1 c1aad99c5673ab6530fa7a2b0201ae9d8c508052
SHA512 f918bdd5998b7af2a3dab9b86d9396e91060837683b23917258de6dfa10c52daa5682288b5b219d8b72983bb7cae65abd284edf8d194ba506bd9b33e9134b269
SSDEEP 1536:ImTABQlE37y4m3E5T+zpq5D3lhjdPTp8K76+d05HzdyRNXV5pm4+SqUUkzG:ImTOQlZF3E16qvZ5N77uLINl5kSqUUki
TLSH
T161D35D10B3CCDA49DB2D9A749153A2B6E5B6BFF6032293D7156474481FB32C4B2BD0E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Json.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Astro-Launcher-1.7.0\pu6Db9kHnWbc4E36k0sEHjJSavOzAnk=\System.Text.Json.dll
Size 1.4MB
SHA256 a5deaf26b38846d1f6e904faf4fc6ce50958b1ffb6369f4505e9f6dfc2b37fe2
MD5 9352bc06014a153db4665c44b9d7d786
SHA1 63fb020d34d4e68441bb7745ac88b154b8842ac7
SHA512 d29e1a180ea97beccf524070e5a1c240b06e4b0fc2b59fdb8e42888602c33ec4e7ccfa7486d9ac237d88a872cb1143f4af32c0cb4cc14b030130e0d90e7d8374
SSDEEP 24576:Ptsm4uebl7dAfc1mK9U5MDv8rwAAjuR5K9Ge6RdWU3IM8cVnMBHlJSuS:1BCmK9U5kv8rwBg5oGT8cd
TLSH
T12A657D05EBD88717C52ED379C0B3C112CAF6E4225B11C3CB1464D9AE2E937C6967B1AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.RegularExpressions.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Astro-Launcher-1.7.0\pu6Db9kHnWbc4E36k0sEHjJSavOzAnk=\System.Text.RegularExpressions.dll
Size 997KB
SHA256 6989d5ed58e0c9a7c0f1208496f10607240d4af91886026e661ffa879288e617
MD5 2bacea8c6c98c345b5bdf0ccf81f016f
SHA1 38cf36971ab885404dd86cfd0091397610db5473
SHA512 0600725db864c6bc81fa74ca26cb0285b7b5a96c863c289fd397bc0683b48c33ba45035af46bc467f885a358bb0d863014d2eb867ce273a70cc22ab7161f48fb
SSDEEP 24576:Qx/ds+Q+B/b44HO2inDiv67tAEehjonQfR:GQEb44HKivIehjc2
TLSH
T18F256C1593982F42C22FA23EC4978602D7B16C57636987CB4950FAE61F3B7C2E6F6113
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Astro-Launcher-1.7.0\pu6Db9kHnWbc4E36k0sEHjJSavOzAnk=\System.Threading.dll
Size 81KB
SHA256 76900e5c96b72e6e74477a90897f86c9f8b78eb2169010298cd4aecec5466ae3
MD5 a512c2446cdc301ba4598d5f5963bfaf
SHA1 7b6a72484dad6c24cb4b3f157bffa4c9b0aa9ebd
SHA512 19f4fe27372e1d4d9373b594013b6557c0fcb74641921c3e47e7ccf5d5a09bd3b5bc5fc0687fe658dbe1d382df5bdcbc458312f0a5ef6c5371c50d9b8bcc319b
SSDEEP 1536:U+goICPLFImrmODZcUBeZ8j0GEH9wdN3SGRm3LGgCRzy:U+go9PLCFtZ8j0GEH9wdN7R4GgI+
TLSH
T1F0835A1A7BE80416FA7B47F9EA729946C472FCD20710C6DF9059900C2E67BC1DAB2277
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

av_libglesv2.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Astro-Launcher-1.7.0\pu6Db9kHnWbc4E36k0sEHjJSavOzAnk=\av_libglesv2.dll
Size 5.2MB
SHA256 9b203e40323b49dad29546a52b8b67d200bba8ff4cab9709a79cede23ba847d4
MD5 11a4a07f31e4a91fff678c019b7736af
SHA1 9912e11aa9c351be136474e0d0975e7964b1e124
SHA512 4197cd706c7abb4782f05ba73177a018299365060c6368305b030f21733f3209545bc7d8f61968c79b24088ced4acc4eda92044821fb8347c3370bc6925a4bf1
SSDEEP 49152:FJ2uagzq2YgAoS2tNydAOlzwn56aCqQ2iUAqC2rCnsZ1LT/Tq2XEoxEf6m8s47eF:9PTjAurCnsZ5T/lXEonmn56AL
TLSH
T104467C03F39690DEC409D2B9874B8622F776B88507257ADF229497242F77FD06B3A724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libHarfBuzzSharp.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Astro-Launcher-1.7.0\pu6Db9kHnWbc4E36k0sEHjJSavOzAnk=\libHarfBuzzSharp.dll
Size 1.7MB
SHA256 eb76238c9e8e41d44b5a5b18167c4c5b39ca5db4277af5dbe92d730f0fc14a7d
MD5 e0c86bbd88d6b8f5643c1ab1c050a4ee
SHA1 f6c72b1fd89d0f9e3d7825a0450ae0c0af092c5a
SHA512 023a1054d7516ebb99b46ca3f9a17b1ee00e55a46356586513fdd45c42bd6ccca16139a8e93e7a9bc533afa5abed121cb5fd40474bfb27bca22da3598ebef694
SSDEEP 49152:MG+tDvarn9O+3KVv/s0upzEpOqw8k25Pj4LneMdTaGVW:FS2be5Pp
TLSH
T1E3859E4AF2AA10E9D9BFC074C666950BE7A274050314DFEF65E08A95EF23EF5167E300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libSkiaSharp.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Astro-Launcher-1.7.0\pu6Db9kHnWbc4E36k0sEHjJSavOzAnk=\libSkiaSharp.dll
Size 9.0MB
SHA256 9a0d95e8caaa852c70d085af6a40a744242172ad9ea3fd6bc7599875a8a1dbcd
MD5 ef1fabce43fe32ca83260481253f5476
SHA1 ad988af9826e5aacc7b8e5ed6d220b229d70060e
SHA512 f73b56742e43b169177ff49f639c50f98a417f91175c70f7348bde1c7570c2838c181a59b628b003eb2618d75da920a449a724cccaec1dae8b9a80d5aac386f6
SSDEEP 98304:4GKXmtfLM9j2KAdTzwlrdyc8HgGTngmY6+o/:cXmlLMvGsIaGjb
TLSH
T19B964A03B66B64ACC04AC474834B99665E2038CB0B35BCEF52C5A1393FB9BF46F79615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/2272-315-0x0000000006500000-0x00000000068EC000-memory.dmp

Download