5c3726a606c637bc87abd6e77eaef6fd08c5f2466205c2b7553cb3b1683e9411

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 07:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ASTROZABAL_1.0.0_x64-setup.exe
Size 21.6MB
Sample260810-h4m28stdkg
SHA256 5c3726a606c637bc87abd6e77eaef6fd08c5f2466205c2b7553cb3b1683e9411
MD5 b3fd791d52b288bdbf3113894c96621f
SHA1 5bd967070dbef5a5370767802262a91e9379ab7e
SHA512 170bac62903ad897e35781147cfcd24f1503a00cc02ca7bee4e9b03fdcdd970f7a29a4d37776cf5ea19702a4bdd922fa5516b411e230917cad48b05503c29785
SSDEEP 393216:tJa7XX3OiZf3LEAlb0unatasE46i0F+UXvQsWiSuDYL+wqFBZIbzD/sfXFxxQ:tJaLXlRAAcUYsrxLBZuEFQ
TLSH
T1DE3733C2B234D5CBCDBD9A32CD21986454166ABBCF79C91697A0083B6014FD6FCE287D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3028	astrozabal.exe
2872	astrozabal.exe

Loads dropped DLL 7 IoCs

pid	Process
8	ASTROZABAL_1.0.0_x64-setup.exe
8	ASTROZABAL_1.0.0_x64-setup.exe
8	ASTROZABAL_1.0.0_x64-setup.exe
8	ASTROZABAL_1.0.0_x64-setup.exe
8	ASTROZABAL_1.0.0_x64-setup.exe
8	ASTROZABAL_1.0.0_x64-setup.exe
8	ASTROZABAL_1.0.0_x64-setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	astrozabal.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	astrozabal.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	astrozabal.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	astrozabal.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ASTROZABAL_1.0.0_x64-setup.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308200179924849"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies system certificate store 2 TTPs 11 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\022D0582FA88CE140C0679DE7F1410E945D7A56D	astrozabal.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\022D0582FA88CE140C0679DE7F1410E945D7A56D\Blob = 0f00000001000000200000002f7265a1d1385e1decf7419f774976c48609c250c025d3aa5d73c3f9efc845fe0b0000000100000038000000480041005200490043004100200054004c0053002000520053004100200052006f006f007400200043004100200032003000320031000000620000000100000020000000d95d0e8eda79525bf9beb11b14d2100d3294985f0c62d9fabd9cd999eccb7b1d53000000010000001f000000301d301b060567810c010130123010060a2b0601040182373c0101030200c0090000000100000016000000301406082b0601050507030206082b060105050703011400000001000000140000000a4823a660a4920a33ea935bc557ea254dbd12ee1d00000001000000100000007fd52fb9e073588a3e1099811be860a8030000000100000014000000022d0582fa88ce140c0679de7f1410e945d7a56d2000000001000000a8050000308205a43082038ca003020102021039ca931cef43f3c68e93c7f46489387e300d06092a864886f70d01010b0500306c310b300906035504061302475231373035060355040a0c2e48656c6c656e69632041636164656d696320616e6420526573656172636820496e737469747574696f6e732043413124302206035504030c1b48415249434120544c532052534120526f6f742043412032303231301e170d3231303231393130353533385a170d3435303231333130353533375a306c310b300906035504061302475231373035060355040a0c2e48656c6c656e69632041636164656d696320616e6420526573656172636820496e737469747574696f6e732043413124302206035504030c1b48415249434120544c532052534120526f6f74204341203230323130820222300d06092a864886f70d01010105000382020f003082020a02820201008bc2e7af659b056796c90d24b9d00e64fccee224182c847f7751cb041136b85eed6971a79ee425099767c147c2cf911636623d3804e15182ffacd2b469dd2eec11a345ee6b6b3b4cbf8c8da41e9d11b9e938f97a0e0c98e2231dd14e63d4e7b84144fb6baf6bda1fd3c591885ba48992d181e68c3958a0d66943a9ad9852586edb0afb6bcf68fae3a45e3a45739807ea5f0272de0ca5b39faea91db71db3fc8a59e76e7265adf530942307f382164b35989c53bb2fcae45ad9c78d1dfc9899fb2ca4826bf02a1f8e0b5f715c5cae427b298981cb03a399ca889e0b40094133dbe6587afdae9970c05a0fd61386712f7669fc90dddb2d6ed1f29bf51a6b9e6f158c7af04b28a0223880246c36a43bf23091f37813cfc13f35abf11d1123b543229e0192b71802e511d182db1500cc6137c12a7c9ae1d0bab35046ee82ac9d31f8fb23e203004870a3092679155360f3385cad38ea81006314b9335edd0bdba045071a3309f84db4a702a669f4c2590588658556ae4bcbe0de3c7d2d1ac8e9fb1fa3614ad62a13ad774c1a189b910f58d80654c597f8aa3f208aa685a677f6a6fc1ce2ee6e94332a8350840ae54f86f85045780081eb5b68e3268dcc7b5c51f4142c40be1a601d7a72611d1f632d88aacea2459008fc6bbeb3502a5afda8481846d6904092900a845e6831f8ebed0dd31dc67d9918555627652e8d45c524eccee30203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140a4823a660a4920a33ea935bc557ea254dbd12ee300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201003e9048aa6e621525667b0cd58c8b899dd7ed4e07ef9cd0145f5e50bd689690a41411aa686d0935394009daf4092c34a57b598449299774c8071e476df2ce1c5026e39e3d40533ff77f967610c546a5d0204b50f4353b18f4556a411b4706683cbb090862d95f5542aaac5385ac95563656abe4058cc5a8da1fa369bd530fc4ffdccae37ef24c888647461af300f58091a2dc4342949b20f0d1cdb2eb2c53c253784a4f0494419a8f2732c1e54919bff1f2c28ba80a393128b47d62362c4dec1f33b67e776d7e50f09f0ed7118fcf18c5e327fe26ef059dcfcf37c5d07bda3bb016840c3a93d6be17db0f3e0e197809c7a90272224bf73776ba75c485035a63d5b17505c2b9bd94ad8c1599a7937df6c5f3aa74cf0485949800f4e2f9ca2465bfe062afc8c5fab2c99e5648da79fd967615bea38e56c4b334fcbe47f4c1b4a8fcd5308868eecbaec963c476beac3818e15e5ccfae3a2251ebd18bb3f32b33075487fab4b2137bba530462019df1c04feee13ad48b2010fa0257e6efc10bb790469c19298cdc6fa04a696994b72465a0ffac3fce01fb212efd68f89bf2a5cf31385c15aae69700c1df5aa5a739aae9847f3c51a83ad9945b8cbf4f0871e5dba85cd4d2a6fe00a3c616c70fe880ce1c2864741908d342e3ce005d7fb1dc13b0e105cbd120aa86749e39e791fdff5bd6f7ada62f030b6de35754eb7653188d1198ba	astrozabal.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\022D0582FA88CE140C0679DE7F1410E945D7A56D\Blob = 190000000100000010000000c86502c60cbe9a28cd602fdd632da3bd0f00000001000000200000002f7265a1d1385e1decf7419f774976c48609c250c025d3aa5d73c3f9efc845fe0b0000000100000038000000480041005200490043004100200054004c0053002000520053004100200052006f006f007400200043004100200032003000320031000000620000000100000020000000d95d0e8eda79525bf9beb11b14d2100d3294985f0c62d9fabd9cd999eccb7b1d53000000010000001f000000301d301b060567810c010130123010060a2b0601040182373c0101030200c0090000000100000016000000301406082b0601050507030206082b060105050703011400000001000000140000000a4823a660a4920a33ea935bc557ea254dbd12ee1d00000001000000100000007fd52fb9e073588a3e1099811be860a8030000000100000014000000022d0582fa88ce140c0679de7f1410e945d7a56d04000000010000001000000065479b5886dd2cf0fca2841f1e96c4912000000001000000a8050000308205a43082038ca003020102021039ca931cef43f3c68e93c7f46489387e300d06092a864886f70d01010b0500306c310b300906035504061302475231373035060355040a0c2e48656c6c656e69632041636164656d696320616e6420526573656172636820496e737469747574696f6e732043413124302206035504030c1b48415249434120544c532052534120526f6f742043412032303231301e170d3231303231393130353533385a170d3435303231333130353533375a306c310b300906035504061302475231373035060355040a0c2e48656c6c656e69632041636164656d696320616e6420526573656172636820496e737469747574696f6e732043413124302206035504030c1b48415249434120544c532052534120526f6f74204341203230323130820222300d06092a864886f70d01010105000382020f003082020a02820201008bc2e7af659b056796c90d24b9d00e64fccee224182c847f7751cb041136b85eed6971a79ee425099767c147c2cf911636623d3804e15182ffacd2b469dd2eec11a345ee6b6b3b4cbf8c8da41e9d11b9e938f97a0e0c98e2231dd14e63d4e7b84144fb6baf6bda1fd3c591885ba48992d181e68c3958a0d66943a9ad9852586edb0afb6bcf68fae3a45e3a45739807ea5f0272de0ca5b39faea91db71db3fc8a59e76e7265adf530942307f382164b35989c53bb2fcae45ad9c78d1dfc9899fb2ca4826bf02a1f8e0b5f715c5cae427b298981cb03a399ca889e0b40094133dbe6587afdae9970c05a0fd61386712f7669fc90dddb2d6ed1f29bf51a6b9e6f158c7af04b28a0223880246c36a43bf23091f37813cfc13f35abf11d1123b543229e0192b71802e511d182db1500cc6137c12a7c9ae1d0bab35046ee82ac9d31f8fb23e203004870a3092679155360f3385cad38ea81006314b9335edd0bdba045071a3309f84db4a702a669f4c2590588658556ae4bcbe0de3c7d2d1ac8e9fb1fa3614ad62a13ad774c1a189b910f58d80654c597f8aa3f208aa685a677f6a6fc1ce2ee6e94332a8350840ae54f86f85045780081eb5b68e3268dcc7b5c51f4142c40be1a601d7a72611d1f632d88aacea2459008fc6bbeb3502a5afda8481846d6904092900a845e6831f8ebed0dd31dc67d9918555627652e8d45c524eccee30203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140a4823a660a4920a33ea935bc557ea254dbd12ee300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201003e9048aa6e621525667b0cd58c8b899dd7ed4e07ef9cd0145f5e50bd689690a41411aa686d0935394009daf4092c34a57b598449299774c8071e476df2ce1c5026e39e3d40533ff77f967610c546a5d0204b50f4353b18f4556a411b4706683cbb090862d95f5542aaac5385ac95563656abe4058cc5a8da1fa369bd530fc4ffdccae37ef24c888647461af300f58091a2dc4342949b20f0d1cdb2eb2c53c253784a4f0494419a8f2732c1e54919bff1f2c28ba80a393128b47d62362c4dec1f33b67e776d7e50f09f0ed7118fcf18c5e327fe26ef059dcfcf37c5d07bda3bb016840c3a93d6be17db0f3e0e197809c7a90272224bf73776ba75c485035a63d5b17505c2b9bd94ad8c1599a7937df6c5f3aa74cf0485949800f4e2f9ca2465bfe062afc8c5fab2c99e5648da79fd967615bea38e56c4b334fcbe47f4c1b4a8fcd5308868eecbaec963c476beac3818e15e5ccfae3a2251ebd18bb3f32b33075487fab4b2137bba530462019df1c04feee13ad48b2010fa0257e6efc10bb790469c19298cdc6fa04a696994b72465a0ffac3fce01fb212efd68f89bf2a5cf31385c15aae69700c1df5aa5a739aae9847f3c51a83ad9945b8cbf4f0871e5dba85cd4d2a6fe00a3c616c70fe880ce1c2864741908d342e3ce005d7fb1dc13b0e105cbd120aa86749e39e791fdff5bd6f7ada62f030b6de35754eb7653188d1198ba	astrozabal.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280	astrozabal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	astrozabal.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\022D0582FA88CE140C0679DE7F1410E945D7A56D\Blob = 04000000010000001000000065479b5886dd2cf0fca2841f1e96c491030000000100000014000000022d0582fa88ce140c0679de7f1410e945d7a56d1d00000001000000100000007fd52fb9e073588a3e1099811be860a81400000001000000140000000a4823a660a4920a33ea935bc557ea254dbd12ee090000000100000016000000301406082b0601050507030206082b0601050507030153000000010000001f000000301d301b060567810c010130123010060a2b0601040182373c0101030200c0620000000100000020000000d95d0e8eda79525bf9beb11b14d2100d3294985f0c62d9fabd9cd999eccb7b1d0b0000000100000038000000480041005200490043004100200054004c0053002000520053004100200052006f006f0074002000430041002000320030003200310000000f00000001000000200000002f7265a1d1385e1decf7419f774976c48609c250c025d3aa5d73c3f9efc845fe2000000001000000a8050000308205a43082038ca003020102021039ca931cef43f3c68e93c7f46489387e300d06092a864886f70d01010b0500306c310b300906035504061302475231373035060355040a0c2e48656c6c656e69632041636164656d696320616e6420526573656172636820496e737469747574696f6e732043413124302206035504030c1b48415249434120544c532052534120526f6f742043412032303231301e170d3231303231393130353533385a170d3435303231333130353533375a306c310b300906035504061302475231373035060355040a0c2e48656c6c656e69632041636164656d696320616e6420526573656172636820496e737469747574696f6e732043413124302206035504030c1b48415249434120544c532052534120526f6f74204341203230323130820222300d06092a864886f70d01010105000382020f003082020a02820201008bc2e7af659b056796c90d24b9d00e64fccee224182c847f7751cb041136b85eed6971a79ee425099767c147c2cf911636623d3804e15182ffacd2b469dd2eec11a345ee6b6b3b4cbf8c8da41e9d11b9e938f97a0e0c98e2231dd14e63d4e7b84144fb6baf6bda1fd3c591885ba48992d181e68c3958a0d66943a9ad9852586edb0afb6bcf68fae3a45e3a45739807ea5f0272de0ca5b39faea91db71db3fc8a59e76e7265adf530942307f382164b35989c53bb2fcae45ad9c78d1dfc9899fb2ca4826bf02a1f8e0b5f715c5cae427b298981cb03a399ca889e0b40094133dbe6587afdae9970c05a0fd61386712f7669fc90dddb2d6ed1f29bf51a6b9e6f158c7af04b28a0223880246c36a43bf23091f37813cfc13f35abf11d1123b543229e0192b71802e511d182db1500cc6137c12a7c9ae1d0bab35046ee82ac9d31f8fb23e203004870a3092679155360f3385cad38ea81006314b9335edd0bdba045071a3309f84db4a702a669f4c2590588658556ae4bcbe0de3c7d2d1ac8e9fb1fa3614ad62a13ad774c1a189b910f58d80654c597f8aa3f208aa685a677f6a6fc1ce2ee6e94332a8350840ae54f86f85045780081eb5b68e3268dcc7b5c51f4142c40be1a601d7a72611d1f632d88aacea2459008fc6bbeb3502a5afda8481846d6904092900a845e6831f8ebed0dd31dc67d9918555627652e8d45c524eccee30203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140a4823a660a4920a33ea935bc557ea254dbd12ee300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201003e9048aa6e621525667b0cd58c8b899dd7ed4e07ef9cd0145f5e50bd689690a41411aa686d0935394009daf4092c34a57b598449299774c8071e476df2ce1c5026e39e3d40533ff77f967610c546a5d0204b50f4353b18f4556a411b4706683cbb090862d95f5542aaac5385ac95563656abe4058cc5a8da1fa369bd530fc4ffdccae37ef24c888647461af300f58091a2dc4342949b20f0d1cdb2eb2c53c253784a4f0494419a8f2732c1e54919bff1f2c28ba80a393128b47d62362c4dec1f33b67e776d7e50f09f0ed7118fcf18c5e327fe26ef059dcfcf37c5d07bda3bb016840c3a93d6be17db0f3e0e197809c7a90272224bf73776ba75c485035a63d5b17505c2b9bd94ad8c1599a7937df6c5f3aa74cf0485949800f4e2f9ca2465bfe062afc8c5fab2c99e5648da79fd967615bea38e56c4b334fcbe47f4c1b4a8fcd5308868eecbaec963c476beac3818e15e5ccfae3a2251ebd18bb3f32b33075487fab4b2137bba530462019df1c04feee13ad48b2010fa0257e6efc10bb790469c19298cdc6fa04a696994b72465a0ffac3fce01fb212efd68f89bf2a5cf31385c15aae69700c1df5aa5a739aae9847f3c51a83ad9945b8cbf4f0871e5dba85cd4d2a6fe00a3c616c70fe880ce1c2864741908d342e3ce005d7fb1dc13b0e105cbd120aa86749e39e791fdff5bd6f7ada62f030b6de35754eb7653188d1198ba	astrozabal.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\022D0582FA88CE140C0679DE7F1410E945D7A56D\Blob = 5c00000001000000040000000010000004000000010000001000000065479b5886dd2cf0fca2841f1e96c491030000000100000014000000022d0582fa88ce140c0679de7f1410e945d7a56d1d00000001000000100000007fd52fb9e073588a3e1099811be860a81400000001000000140000000a4823a660a4920a33ea935bc557ea254dbd12ee090000000100000016000000301406082b0601050507030206082b0601050507030153000000010000001f000000301d301b060567810c010130123010060a2b0601040182373c0101030200c0620000000100000020000000d95d0e8eda79525bf9beb11b14d2100d3294985f0c62d9fabd9cd999eccb7b1d0b0000000100000038000000480041005200490043004100200054004c0053002000520053004100200052006f006f0074002000430041002000320030003200310000000f00000001000000200000002f7265a1d1385e1decf7419f774976c48609c250c025d3aa5d73c3f9efc845fe190000000100000010000000c86502c60cbe9a28cd602fdd632da3bd2000000001000000a8050000308205a43082038ca003020102021039ca931cef43f3c68e93c7f46489387e300d06092a864886f70d01010b0500306c310b300906035504061302475231373035060355040a0c2e48656c6c656e69632041636164656d696320616e6420526573656172636820496e737469747574696f6e732043413124302206035504030c1b48415249434120544c532052534120526f6f742043412032303231301e170d3231303231393130353533385a170d3435303231333130353533375a306c310b300906035504061302475231373035060355040a0c2e48656c6c656e69632041636164656d696320616e6420526573656172636820496e737469747574696f6e732043413124302206035504030c1b48415249434120544c532052534120526f6f74204341203230323130820222300d06092a864886f70d01010105000382020f003082020a02820201008bc2e7af659b056796c90d24b9d00e64fccee224182c847f7751cb041136b85eed6971a79ee425099767c147c2cf911636623d3804e15182ffacd2b469dd2eec11a345ee6b6b3b4cbf8c8da41e9d11b9e938f97a0e0c98e2231dd14e63d4e7b84144fb6baf6bda1fd3c591885ba48992d181e68c3958a0d66943a9ad9852586edb0afb6bcf68fae3a45e3a45739807ea5f0272de0ca5b39faea91db71db3fc8a59e76e7265adf530942307f382164b35989c53bb2fcae45ad9c78d1dfc9899fb2ca4826bf02a1f8e0b5f715c5cae427b298981cb03a399ca889e0b40094133dbe6587afdae9970c05a0fd61386712f7669fc90dddb2d6ed1f29bf51a6b9e6f158c7af04b28a0223880246c36a43bf23091f37813cfc13f35abf11d1123b543229e0192b71802e511d182db1500cc6137c12a7c9ae1d0bab35046ee82ac9d31f8fb23e203004870a3092679155360f3385cad38ea81006314b9335edd0bdba045071a3309f84db4a702a669f4c2590588658556ae4bcbe0de3c7d2d1ac8e9fb1fa3614ad62a13ad774c1a189b910f58d80654c597f8aa3f208aa685a677f6a6fc1ce2ee6e94332a8350840ae54f86f85045780081eb5b68e3268dcc7b5c51f4142c40be1a601d7a72611d1f632d88aacea2459008fc6bbeb3502a5afda8481846d6904092900a845e6831f8ebed0dd31dc67d9918555627652e8d45c524eccee30203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140a4823a660a4920a33ea935bc557ea254dbd12ee300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201003e9048aa6e621525667b0cd58c8b899dd7ed4e07ef9cd0145f5e50bd689690a41411aa686d0935394009daf4092c34a57b598449299774c8071e476df2ce1c5026e39e3d40533ff77f967610c546a5d0204b50f4353b18f4556a411b4706683cbb090862d95f5542aaac5385ac95563656abe4058cc5a8da1fa369bd530fc4ffdccae37ef24c888647461af300f58091a2dc4342949b20f0d1cdb2eb2c53c253784a4f0494419a8f2732c1e54919bff1f2c28ba80a393128b47d62362c4dec1f33b67e776d7e50f09f0ed7118fcf18c5e327fe26ef059dcfcf37c5d07bda3bb016840c3a93d6be17db0f3e0e197809c7a90272224bf73776ba75c485035a63d5b17505c2b9bd94ad8c1599a7937df6c5f3aa74cf0485949800f4e2f9ca2465bfe062afc8c5fab2c99e5648da79fd967615bea38e56c4b334fcbe47f4c1b4a8fcd5308868eecbaec963c476beac3818e15e5ccfae3a2251ebd18bb3f32b33075487fab4b2137bba530462019df1c04feee13ad48b2010fa0257e6efc10bb790469c19298cdc6fa04a696994b72465a0ffac3fce01fb212efd68f89bf2a5cf31385c15aae69700c1df5aa5a739aae9847f3c51a83ad9945b8cbf4f0871e5dba85cd4d2a6fe00a3c616c70fe880ce1c2864741908d342e3ce005d7fb1dc13b0e105cbd120aa86749e39e791fdff5bd6f7ada62f030b6de35754eb7653188d1198ba	astrozabal.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280\Blob = 0300000001000000140000009e99a48a9960b14926bb7f3b02e22da2b0ab72801400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183040000000100000010000000c6150925cfea5941ddc7ff2a0a5066920f00000001000000200000008408d5e5010ab8da67eb33a7d79ace944dd0ac103ae6ead3ff30dec571066b0319000000010000001000000014d4b19434670e6dc091d154abb20edc5c000000010000000400000000080000180000000100000010000000fd960962ac6938e0d4b0769aa1a64e26200000000100000079040000308204753082035da003020102020900a70e4a4c3482b77f300d06092a864886f70d01010b05003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3039303930323030303030305a170d3334303632383137333931365a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a381f03081ed300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183301f0603551d23041830168014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7304f06082b0601050507010104433041301c06082b060105050730018610687474703a2f2f6f2e7373322e75732f302106082b060105050730028615687474703a2f2f782e7373322e75732f782e63657230260603551d1f041f301d301ba019a0178615687474703a2f2f732e7373322e75732f722e63726c30110603551d20040a300830060604551d2000300d06092a864886f70d01010b05000382010100231de38a57ca7de917794cf11e55fdcc536e3e470fdfc655f2b20436ed801f53c45d34286bbec755fc67eacb3f7f90b233cd1b58108202f8f82ff51360d405cef18108c1dda775974f18b96ddef7939108ba7e402cedc1eabb769e3306771d0d087f53dd1b64ab8227f169d54d5eaef4a1c375a758442df23c7098acba69b695777f0f315e2cfca0873a4769f0795ff41454a4955e1178126027ce9fc277ff2353775dbaffea59e7dbcfaf9296ef249a35107a9c91c60e7d99f63f19dff57254e115a907597b83bf522e468cb20064761c48d3d879e86e56ccae2c0390d7193899e4ca09195bff0796b0a87f3449df56a9f7b05fed33ed8c47b730035df4038c	astrozabal.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb6587f0000000100000016000000301406082b0601050507030306082b06010505070304140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d777e00000001000000080000000080826f22e7dc01030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	astrozabal.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 5c000000010000000400000000080000190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a7e00000001000000080000000080826f22e7dc011d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e77f0000000100000016000000301406082b0601050507030306082b060105050703046200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e650040000000100000010000000324a4bbbc863699bbe749ac6dd1d46242000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	astrozabal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	astrozabal.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
8	ASTROZABAL_1.0.0_x64-setup.exe
8	ASTROZABAL_1.0.0_x64-setup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3200	msedgewebview2.exe
1212	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeImpersonatePrivilege	8	ASTROZABAL_1.0.0_x64-setup.exe
Token: SeImpersonatePrivilege	8	ASTROZABAL_1.0.0_x64-setup.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3028	astrozabal.exe
2872	astrozabal.exe
2872	astrozabal.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 3200	3028	astrozabal.exe	106
PID 3200 wrote to memory of 2104	3200	msedgewebview2.exe	107
PID 3200 wrote to memory of 4360	3200	msedgewebview2.exe	109
PID 3200 wrote to memory of 4360	3200	msedgewebview2.exe	109
PID 3200 wrote to memory of 4360	3200	msedgewebview2.exe	109
PID 3200 wrote to memory of 4212	3200	msedgewebview2.exe	110
PID 3200 wrote to memory of 4464	3200	msedgewebview2.exe	111
PID 3200 wrote to memory of 4464	3200	msedgewebview2.exe	111
PID 3200 wrote to memory of 4696	3200	msedgewebview2.exe	112
PID 3200 wrote to memory of 4696	3200	msedgewebview2.exe	112
PID 3200 wrote to memory of 4696	3200	msedgewebview2.exe	112
PID 2872 wrote to memory of 1212	2872	astrozabal.exe	118
PID 1212 wrote to memory of 2072	1212	msedgewebview2.exe	119
PID 1212 wrote to memory of 1848	1212	msedgewebview2.exe	120
PID 1212 wrote to memory of 1848	1212	msedgewebview2.exe	120
PID 1212 wrote to memory of 1848	1212	msedgewebview2.exe	120
PID 1212 wrote to memory of 3216	1212	msedgewebview2.exe	121
PID 1212 wrote to memory of 972	1212	msedgewebview2.exe	122
PID 1212 wrote to memory of 972	1212	msedgewebview2.exe	122
PID 1212 wrote to memory of 2684	1212	msedgewebview2.exe	123
PID 1212 wrote to memory of 2684	1212	msedgewebview2.exe	123
PID 1212 wrote to memory of 2684	1212	msedgewebview2.exe	123

C:\Users\Admin\AppData\Local\Temp\ASTROZABAL_1.0.0_x64-setup.exe
"C:\Users\Admin\AppData\Local\Temp\ASTROZABAL_1.0.0_x64-setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:8
- C:\Users\Admin\AppData\Local\ASTROZABAL\astrozabal.exe
  "C:\Users\Admin\AppData\Local\ASTROZABAL\astrozabal.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies trusted root certificate store through registry
  - Modifies system certificate store
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=astrozabal.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=3028.4756.15396348122080641142
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:3200
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffa25cfb078,0x7ffa25cfb084,0x7ffa25cfb090
      4⤵
      PID:2104
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView" --webview-exe-name=astrozabal.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1684,i,945662750017528331,930465236337472665,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1704 /prefetch:2
      4⤵
      PID:4360
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView" --webview-exe-name=astrozabal.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1372,i,945662750017528331,930465236337472665,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:3
      4⤵
      PID:4212
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView" --webview-exe-name=astrozabal.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2364,i,945662750017528331,930465236337472665,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:8
      4⤵
      PID:4464
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView" --webview-exe-name=astrozabal.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3596,i,945662750017528331,930465236337472665,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:4696

C:\Users\Admin\AppData\Local\ASTROZABAL\astrozabal.exe
"C:\Users\Admin\AppData\Local\ASTROZABAL\astrozabal.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=astrozabal.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=2872.4584.11262254662685875390
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x17c,0x180,0x184,0x158,0x18c,0x7ffa25cfb078,0x7ffa25cfb084,0x7ffa25cfb090
    3⤵
    PID:2072
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView" --webview-exe-name=astrozabal.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1776,i,17578847103057435591,1927116278663610086,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1772 /prefetch:2
    3⤵
    PID:1848
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView" --webview-exe-name=astrozabal.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2060,i,17578847103057435591,1927116278663610086,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:3
    3⤵
    PID:3216
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView" --webview-exe-name=astrozabal.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2384,i,17578847103057435591,1927116278663610086,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:8
    3⤵
    PID:972
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView" --webview-exe-name=astrozabal.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3508,i,17578847103057435591,1927116278663610086,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:2684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

astrozabal.exe

Path C:\Users\Admin\AppData\Local\ASTROZABAL\astrozabal.exe
Size 31.8MB
SHA256 76660f8b1b6ef2651f1110e17e046b2911622938c8415399aea16591a0eb837b
MD5 bc1fef2212c033f9b1ec284c343c6e20
SHA1 a624ebd89c74e9741b6094a7153d8e7fabc2ee1e
SHA512 e56cb99f56cd7e4966ce19fd31704b2bc30c41886d8c2d24d2bc9db8e97a67f0d131a700ecfb27fb221c96519720275c67e1828f5da87bc425e105e6a63fa243
SSDEEP 786432:OSHzCXCbSVKA6HkPipUqwh3ME6DXlpM95MQlTBN8+:OkzCXCbSVKA6HkapUP8E6DX3z
TLSH
T16177BE217A5A996CD05BC47483478A624A7030DB0B39B9FF449896383F7EBF46F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nse2894.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nse2894.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nse2894.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nse2894.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20dc261d-7b3e-491c-8a42-f0c23f9f9047.tmp

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\20dc261d-7b3e-491c-8a42-f0c23f9f9047.tmp
Size 2KB
SHA256 d1d3cc4a1b0ae287eaee0f626640d4ee058b71f5b86a3a691f26af2e66c9602c
MD5 59c0f3a69465e184264a94112e691cbc
SHA1 46b0cf7ac80ea156e9419a4cde88cf1b1128dd83
SHA512 5f93b7348628dfb47537128cc87c57c97dd0d85d664bfbe0c32fdeeec4b925ab8ad573c4a3c671688502887150358dcf49ed5f71b132801b09d4a744294bae2d
TLSH
T1A851C733F448AA3789D25A44B90A3F22DE7851628A622FB095EC0B1C03DF6DD2316C37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 13c6deb18a2995c88b3d39b44b41fe2fcafac03caa2d65cd8d08922c901ffd10
MD5 0482a328242f27174fd8c5ab1dda5b94
SHA1 22cdb1b9326e0a2f25934f788d7c61a2c1c8dfa6
SHA512 fef2a0bc98820772803aaddd195cb255288ee6ec7ecacb9f237886d3a166ae2b34de0150ce362518f7db3321be444bedd396d4d5362e33d43f11ed2919533fb8
TLSH
T1CDD0122372010534C0203837182275090581C54F400BC000D829CA2D1B040901943445
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 de388993b297c608fa8725eb858ca54307d4f616238c8c86700656fb38474d32
MD5 6c8d8a418bc5d5e77598e9a6d7996a6d
SHA1 95fa81b798e7e2d2f0f7247a0882806a9002a891
SHA512 035041d9d8a38ee9a4f1b5997e4504e2e29fbd09923d019462771bc20a904411b5bec7f51c631cdcb0e7f667a691f58d7d8d54d4970b7fcda188ecb6c0be1fcd
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8bdd26242c9ce2397b88d4275279818bb4e593bd4f34daba4c0b2fe2773752a8
MD5 fdb31f2d629484778762994d3a28ba03
SHA1 aece9f1588e56912ff818073bb4d5b14b5478322
SHA512 7a3b7398c96b49a1ed8e1a1fc1616bb120015c9902aa3544b0eb0e6ceccad79cd3abeb4c5331501b6abb0d2fd249670e3a4d0e08cd39be7c38e40349e27b5ee9
TLSH
T127D02B7332150931C324753B8891F5485141C51F000BC0009E36FE2C0B400E10CC2845
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f1eb867c5c44356b533dbdfad8ec770debced91593d2a2e679ebe636a444d242
MD5 9fce73b2e02c16c386cede56cec6c51c
SHA1 9c88967840bc18f7a26c06a9a7fe43c8a1af7750
SHA512 0daad328ba7fc1f186625e60323687e3e416e1b43b8b37b6974f32e03fc7c6bf2814a6df01c47e1163e6b755afd309fbf21bcf2af591153463a6d92823c5b2af
TLSH
T16AD02B7332150531C324763A8850F5485241C41F010BC1009E36EE3C0F410E10CC2845
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 13a62a29923fb5fb7d6a57464fb5c14b65e3059cbb16f61bccd3d376a97a0003
MD5 3345a9e3cf41e84597c584d4d70ce62c
SHA1 cc9691a1ce153b8f21377c3988813a944c39836d
SHA512 32d980148d32e40922c0408c5fa566a282d50d2ca65c7b6db937693f04a846d983fb49b47a3e290d0c1fa92efbeb742558894a3afe23d934a742d95d0420ebb3
SSDEEP 24:d52dMS4rkCG+abZ/dRxadqOWv4tx1YdBzUu:SdMb9aV/7xacacU
TLSH
T19013683F90C2BE28DAC4203D12AF2B79273440C9D430B48752FB743655E4F80199D578
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 17ba53066c3636c5853ef6989ec68cf43f706d78b2ae750c1ba2b4214a57ad4e
MD5 e051f5477ee21f9b4256842d8b143a46
SHA1 4e6f2e3b30a5e7713712b09524e02ea48cc1b9ae
SHA512 f10ac54a695fc3c3aa50900f21764d889853cdeec00b3336a47a2c68452f337bc7b822e91e67cdaaa3bd1005c400c58293f15cd4dedb69ebc83067a49206124a
SSDEEP 48:+WV+SGXPqqHrBWHvQA73l2uYHXBnIW426Bu2hY2kop3cDAom1lKB:1V+SGXPvWPPwuYHXBnK3qzyYB
TLSH
T1B84409EF5B02E514EBA48AF17ADD6DBD832F00D565F9A901EE908C925CD278D327434C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 e74b4eee4508f3d78aea7fad91bef0b9dafe3974e0e977f8984a824ea7844260
MD5 61201efc148b8e75ffcc7d234f585696
SHA1 24082940d7e9f03e35a795d6e94d44e2fcb5d26f
SHA512 69d8a2ef6bcd55f44d4d725d4ae1fe88bd168336c24fcba78b14918ccb4ff65e4818612df5d6f8742e338e1481b8d24fd3f47dac869babdd8f976d50b5db5bce
SSDEEP 384:Bjcn6+F4FOlnkNITOP+F7BPY1/ztkKXwTOP+FBUPl5Ketocn6+FbqeA:htW4FOlnkNITYW7pY7k9TYWDe+tWm
TLSH
T13E254BD72B785A91D7E6EA30AAC1CC792DF862869AD5E0833901C1BF10C3BC75B51B1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 f29328eddf4615ee786a5790cc681e4047667a50cbdbefd0c0e8141e42a93930
MD5 0625ce460902124a91376a3c36cb8619
SHA1 382e71368cf7a5a621ac321c8b3a1ce82c2bc754
SHA512 943e6fa3d5fa12e42e266639797cbf03c89ee9fdaf1c6d6b800d9a09a39afa73da930e98b8ed19dbae231012af7ce7a97819d0f4cf6359e8fee2060254ad64c4
SSDEEP 1536:zuUusu5u0pS++WuThMhwfkKfz3fzuA+FfJ2ffzIfz1fz9fzrFnWgvbVD+z6fzEft:zuUusu5uOFthwzIfJpn5TVDPOu3RB
TLSH
T1F416AF9B6F306DC3DFC2CD3CA8CC6D876EF5A2D495DE0482E113822D29187D56B5A12E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Cache\Cache_Data\f_000001
Size 68KB
SHA256 aa0276b301586a32a470ac62193ba34ba560ffe6b10a05cc6163668917832751
MD5 b2fc15f89dd699fc340dd42a8e78a7f7
SHA1 98544926f315ddd2688150b81ada535d6967c42c
SHA512 d95989617df2c2ba4f1e4db4b1f95e9ec3a14cdc678eeb92ee264d67513283c59dd89bb99206a2adf0e0fdb87d72833618794b26e2cacac784b84956f6883c0b
SSDEEP 1536:E2XPQ4h6BiUZ1iX62FF1Y7suxC28O0Yh9RDSfu4SftO:Eeh6T1iq2FE7xZQ4RufuJftO
TLSH
T1E363022653B29EF7D1F109C65C33F7B81C00EB464E26DEB3110246348A19E6E77AE4E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Cache\Cache_Data\f_000002
Size 41KB
SHA256 7c5745f95d7d243885405250eb8edcf3d5cd5b9d1b4f0529b31687905cd3422c
MD5 3f7e376c9391910d65d9d3665f257e45
SHA1 e8822ec95ba05333b7c189dcb5c2598bf2aa426e
SHA512 02b89c9bbbbd198d0349cb3c89918d573853aa9488605dd49f07472243f98b9394d1845699d7d41a13dc3d1d683a35362a9177daf5dcf69a80a88fc505cd9548
SSDEEP 768:JAjq9wLs/AjwPElIX+yobcxWJPcBHRt/NVtfiQEF3g2S:2jawvcaJZb4LNffhEFK
TLSH
T1F813F1637D1CE9C1BEBB369D2B03A027C195833FA06252693442E102BED597DF33596D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Cache\Cache_Data\f_000003
Size 44KB
SHA256 177761d74f13d4960938a05eedde3b69a981fce99ffedda119061be0e813404a
MD5 b0687224f2ccff7f9b15b70a943395db
SHA1 db3b9f882b731819f1669b36ffc045288adc75dc
SHA512 b48d987f14f51d7bcd0ef20cf57138733f662d2b19f7eb2eaf8f8458ed02667c109670777d421a76ddd6bccae21cbca22f22be4265d96e67ec8f0afd80e4a332
SSDEEP 768:HkzZvr/njusLmShxIS5dzs/EPCQS+7ZIID2SBdl584o9L4HWCgd0tXLBTmi2o8sR:EpnSsYS5dzsd+7Zv2NLEWFdOLhqod
TLSH
T17B2302C57D42BCC829DDECC6393913874678B5107256E5880EA3801EEB50BB9AE7DECC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Cache\Cache_Data\f_000004
Size 105KB
SHA256 662e5fbfe0f1a6afd33f19ab281ea03cede3847cd962f6a48059d2d4ef32d505
MD5 853ecae999e8edbd76d2f7315911c6f4
SHA1 05e22625eb2ddd34d5d375dc1a635de058598523
SHA512 ed36bd1fcdb098d30338841f74e495f32f5b5dcef6654326e8e3cfa68bad0780a800b5b5bccdd4277b50d964a67f8c07cf7a026098658e481159e35a81e0be0b
SSDEEP 3072:0Zilm7NUEsP2TlGdf9kgwyfLhl7plCJXFvecVX6u:G0mwP2TCf9syf/yL2cR6u
TLSH
T18FB3128F040F012A8E6189DA17A167DDE71B4CE58A02BE693C39B641DC6F5D487A3B72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Cache\Cache_Data\f_000005
Size 22KB
SHA256 df99366338d0c7fc2c0870f746185eedab0dafbca66d90baae30af00ce11dd5d
MD5 ac8bd5d8417b943bce1e640b789014a3
SHA1 cfa739318e87b0584da32a3a300497eed43bbd8d
SHA512 68acabfe5e92a85318d19fa322417758feedec012b16623d7dff467243f0b2cdaf05f90125f063036eaee176a4996cd805fa464130925a8272369d5eb61a8c8e
SSDEEP 384:WEwPHNTPgviF3zm5VT6WleDQ/KQtvZ9IwIGnkE7Ir+FwoUdCdqcbioj:kSi1q50wKsQwIQ7IrAaJc2A
TLSH
T162A2CF275110F790A59CC9B055FD9CDA7218CF1FAC7F82E4D00D8CF4D4799624EA2E6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Cache\Cache_Data\f_000006
Size 27KB
SHA256 d939050dc22fc1d0d1e7cde51828697a3d65911c30a82cb1c49041d3c581e195
MD5 545b82eec5ca1714f368382efd44dfd8
SHA1 5d3d26f78bf9b2ecd33d03750e90d5d34478f74f
SHA512 1dc64157a6534bb0517fb0879b1a50471fa3e752a6fd203ab3ebc7a1d4e8cb96448bcc24af8458656dcdb3c7adc739212e8f2e3bb04f5ed62514eef2026eec54
SSDEEP 384:kCDtH0xcVKtY/h3e5pbjCn6z3xz8Jcs++bSHhyB5RS/0kwN0SSbZso6Esgdn3mRp:xtVVHABjC6zl8/DShSrW0kwiSrIC2e
TLSH
T19BC2E170649725512A3BBEDDEB73F7E891E4A6F3C982138E17A5343BE09205D2E0C984
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Cache\Cache_Data\f_000007
Size 17KB
SHA256 4b8f2655ca109db115ad506cde27a6fe694ca56a2581470d8a8dda226d693684
MD5 cd76646d81a244b2d84874c317ee289d
SHA1 8f887f13a3497cfcc6e2140ddb149cbff936495c
SHA512 45b2208ef1e086748d3a2f81f7857694625262a98b6f4b92815a250bb8c6f6c63061d87f6e719bd1167609720fd48398f974902f2433c58b369a3f7de9c25733
SSDEEP 384:URl9ZGQIXG7GC8VG0MRlVDbBCfKrflb1BDL:URBmXGC60MRlVDNC0x1d
TLSH
T17C72D084FB112C2F25386C35D8ADEC5EEB001386251386F64B5BDDA889D3A7E4E23078
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Cache\Cache_Data\f_000008
Size 24KB
SHA256 193a9484f1940f9407e0a573b9fb497750ff642052bfd112c8f1ced10594fe41
MD5 9f7cb523c0e7f0cba86f1d9c9e7c1f9d
SHA1 ec4e977e4ab7be5e64df8b66687b90bce3270a04
SHA512 11b260f33c03a9c0011548520c6a3fd53ccf6b6b72140e51d953f4800d92155e482d469ff1df28196d66e1aa4bb6e332176a66d77e4d03b4bdbc70a9756d2126
SSDEEP 384:npoa+CX6Ubpz9WU87/rW61ijqWnPOHV0SXooym5NvPguy+4oBR3LqmmjBln2pli:q6bOnW6lePOqY/ymzFr9TGmwmli
TLSH
T188B2E0FA1699ECC5FB92A824B081F1695F32D85F66033337B257DDAC20949438CE45BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Cache\Cache_Data\f_000009
Size 30KB
SHA256 6213b3452cff0840a86e43fe23e0b5725bc173ef7824fb62f41f7d1cde4526af
MD5 4aa5ed573667c0174f786ffbf9eb1564
SHA1 64b9c389bcf8d3c261ed9690efb8cf87857596d2
SHA512 2d2b9edc7905f0ad8d8d1a79b5a093693ceaff283bd26a9c22f953410c2038ed6e1b57c3bbe8394752a6c0bf1168fe88a710ca3094f961eff74106c4035af5a6
SSDEEP 384:vtixWI0mHVFZ2AKMOn7XcV7fton1zdCKGvWF44fKw6XSz425z2Wt0fta6YmtwXuB:vI3r+5XcVzqnt4KGv94BU0vC9FfjO38
TLSH
T107D2E1B3E06EDB13DA61193221D76318B14B2407DD0BE0C315AE6FBA11029EADDFDA45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Cache\Cache_Data\f_00000a
Size 17KB
SHA256 0198be8e1768d0fc3f800af6528297ebd70bfcc4ca9adfceaa797f944a8a7184
MD5 357d0a03379b4a327f9bd70dc487ed60
SHA1 f458c069729d03446ffd4ea7a5289e96a1603270
SHA512 c97cc72843eec31a85cf2442c517eaf98567a19c3804a8e6f62cf94be810a2501d08b95d0be93423e985777612c4e7a9c3aa2636288633f8ba587f7cd483ec07
SSDEEP 384:MDvf7nxqXKkPH3z7pCSF2R0Oij2MYjjvXiLWo8msNHs7:MDvf7nIz7kSY0OE2BviLuNHm
TLSH
T12282C1E7B2728F6309B221171302ABAAD32C95D1F542E70D73474D741864AD72BA39F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Cache\Cache_Data\f_00000b
Size 24KB
SHA256 eaf512f389c460c3fb947c015056b09ce3f3384565faf67d4f9b369dbf592665
MD5 71013615ff76fdeab64203c8be8bcd70
SHA1 cafe7fae4a2ddc61e80b1ea32a2a258dc27b624b
SHA512 c5f7071fcdc14689e98ee8a462353ed92ef30ecaccee61af2f32d34386a6aaa7f437c21bdd1c57120f2ff608f453f8d59031e2fffc8e833bfecd63f875177dae
SSDEEP 768:Pns128qlz53KgTFDiYetLwVP6uAbRxpKF:QqrTFOYetLwVPTAbxm
TLSH
T190B2E008568495AB6FFDFFDADA8440398D0301D5916406DB0FE3DE12C86FE4E72906BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Cache\Cache_Data\f_00000c
Size 29KB
SHA256 502e0a9d58c2796eee7e989c1ed6e20d51e0327807b9f39d73ba74d6aee2964c
MD5 7653dcdf733771447d41f9d05526abd1
SHA1 8eeba59ab2612f05adeb7976d84ce3226413ed21
SHA512 24c9f47270ec690250389177b8842d709fd286fb3e323bfcd597b98dea5c79f576f55a9ae6ba04b530ee4b380014fdeadbac10c20ce1c0bfbbf068cd1b04cae8
SSDEEP 768:7jn8sh/PgFpJ1vcD8XJnPGiqo/EqpZl/PgAQFV3G:n8f//vSiKqpbQAiVW
TLSH
T1DBD2E1B8FF8F01015A9B26F7CD6D09A9FDDDD03424780F432DE95A4BA1EA1984959F0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Cache\Cache_Data\f_00000d
Size 17KB
SHA256 a944b0875703f7a0af0337c51c8332277aa6dec5ee4f17ba3b59a6cbe475ac27
MD5 eb35c542e7c806e77d6f23a56af03b51
SHA1 9778e93b7b09b6036429861d5e16ece2f19a087b
SHA512 f35d62417ecbb0df8ba810603813dcd172657b1ceeb9e0ed1b2cf51961d3b7043dd192bf8dd652bbe3facddb48719297c2e3dcef9b584ac9a61516d9da705387
SSDEEP 384:ZQvegQLd+kbnPxbKrYYNFckr4AUveDNjwY:ifQ5+kbnPuYYDckkAUveBl
TLSH
T15082DFD5689FF5C89D3336D4ABCBB02FCE5C49814E7D771662881F316A66A180032EF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Cache\Cache_Data\f_00000e
Size 21KB
SHA256 8c499414ed7c2856eadcd8340229f58e818d37d34a5093c024d3daf9774cfa46
MD5 00b0311daacc949b59bd2d8e8d2dd5f6
SHA1 bef52f5969464c7fdd2b9df5e5ff25aad748961d
SHA512 1e3ba7f85c6eb3e25751408c818ed53064163b1a8c603c86d7b1aa3d02c2ede5eff471457ca719ce0db90ef84f9708a1c2b9aeb5b5578fd472bf43d201610cfd
SSDEEP 384:s493blPujUjQkH7oBhZcTBgTVPNiaztEeCYZ+1kUZkJLCKLPGJ16u06b8QmncR9N:/3BGjUhH7oBhZGgTLltSpkJLC6q1B06n
TLSH
T119A2E15EE771F385C841D2FBC138AF0F8FA4A4551A48AFF1A747B60AD2928B64781C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Cache\Cache_Data\f_00000f
Size 21KB
SHA256 53e9a17989c5e1f366fc5ec907d8b39e09346c362b3fb6e4ef3a586098f536c0
MD5 ca6ef2814a25bc1d71421ba30726c722
SHA1 e1273a14fb2a65d63640344817a0c02ac2ef19a1
SHA512 c4fcdce0cce9407b3bbc2bc7dcba71b1413b56b323cf59995889550c0cfc00c7f4c26213c32d9e5ca9faac5258bb35e4b1ca2dba8d31a99d0b80b6d90a08d356
SSDEEP 384:MQP5v//iA7vQVrdWfafqOVPZteQfQsD5340D39yR38M5aIzAibekFEkhCs:M453/iA7CMfbuZnQsl/D39yR3ZNsibeY
TLSH
T188A2E1C7CF5481BD702C7417A9E41C2DFB695620601B2EEBAC06DE919F3C66B8C62B35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 d3470923e213a794ff004f1e36792c188bf39ba40a68ecfa3068bb1ecd1af436
MD5 d401a454cfbf42b598fe48ee50318356
SHA1 a97c4994cc8c9e3277defa7fe8be2b37299e1512
SHA512 48047a54451e7fc506c2b19a804187c1864a6c0e47269e03e6c99b113b860a406029149410659bd4e81e1fc376c836a28c25c59875a099c479c64f059d46034d
SSDEEP 3:LsalNllkll/lbTSKN4JlJ/llqlvt/vtNNl/lylXlS/l5lDlMNl/lpNtl0lQlrl/y:Lsu3lEtn5DlvlXMJN5izNgNIuNG5Z
TLSH
T188448C8FA2809F2AC5C0203DC08703301324C008DA1A93035B89443420C43040E6D251
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 408B
SHA256 efd54c1f927a373bba130f4dad3dd46d98712282e6edacd039c677278b0375bc
MD5 a49305fff8acff1c832bcea5d574662f
SHA1 27669cbe4359c4ba971215a11dc0e115b3e73038
SHA512 b33fc10f4d24c7720a1308bad10bdbc33b9e34fc32c09f41b68d8fca46060f153957daea884dedec010d4e3141eb8338b7a3ae8502f5c8c45f734b43f8be3d09
TLSH
T113E08C134044F817CB0A0731E9C29597213F87E156778E057A6CCFFA58B13636700419
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 5addf8e7dd5ac7eafc30b9d470a72171bdd11153b58f66e4df4968e465c4403f
MD5 928bbe020a78e61278792d55998ac8c2
SHA1 1366bdc509741c4006919a8751984116e1fa72ad
SHA512 2744199e7185d7122472435c24569c3f70c9d4ef5b2326d464f12d5fd74a15bca50ebabc2310725f760f9d98e8ec43ea3dfcd93e6eeca850fd578fded2b0e63a
TLSH
T1EAD022238409BC23C706153825C2CB17B13C01A115BB4E42A91E0FF46CC2384189002C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599dfb.TMP

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe599dfb.TMP
Size 48B
SHA256 06c6654cd61dffedb41d6da0e7142259182dcdf2d5ab4c578ba12e320c868176
MD5 08fbb64ea420503aff0cca696ef9d223
SHA1 86dd0711e75b39541fedf701598061e1afcdfae9
SHA512 89c1290e64bf8a7d322e592f4cf065d2ed17ea3d6041c3678415f6ab2b86a09338d83fe7a94523c72da6401f33beadc6240bfd3f3d83c99869e2f155fb128003
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\History
Size 184KB
SHA256 9355580a6284a17aa47b235e680a1e2b01e2b74134d956fadece5cc34439d596
MD5 f0770da660039f223fe01813450764ac
SHA1 30bb00a623db46e11484af964e253df81ceda204
SHA512 3c26148733680a4b788cec15ea0619927f1a69621e03eaf4f0415bf7abbca0e883bfad8619fbdabb03af1c5cd1845f986cd320c762799e7fa7a1ea28f0ca245c
SSDEEP 96:HBaX2gejzH+bF+UIYysX0fxQp97FEHt/DfLjLqL/YibgI4VgNr2jWRk/E0kV:HBXPH+bF+UI3iWGVFWN3qL/6VgZQW3/V
TLSH
T17B04FD5E5F243212CDBD513A68E745B3587DF03F8B2366C66C6204B1CEE2656B02C5BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2d7845d3-f3f1-454e-83bf-9d191a61089b.tmp

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Network\2d7845d3-f3f1-454e-83bf-9d191a61089b.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

516b7538-e8b1-4258-9d07-c9d31fb3f99c.tmp

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Network\516b7538-e8b1-4258-9d07-c9d31fb3f99c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 756dea63470228f9fb46c64c6bed5dc4d5ea3a3f17c4bf91ab2999dee8dbf44a
MD5 e9666a975fa87aab5cffb8803dc5d1d3
SHA1 6b37bf9e2b589d855a871531aa48144fc70e2639
SHA512 b7d224e6aaddd83aaad5392cb39a37ff22037ad4c816c8c1dac98f9aa5b289e6e77042e389af06847287143d6fb692048cb603887cc462a15d3973f970e25e02
TLSH
T1CA51ADA1C2D4C73D89512AE42B347957C92D051E91243E278EDBEBEE6BD2071E22154B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59db14.TMP

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Network\Network Persistent State~RFe59db14.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 d8d83cf8b0de3bc55193bf1b9b1cc0dc3e7e40d8adb6dcc9ed9e9b3d7562b50f
MD5 33c514041bc4d1ef4a96b77f3f939b5c
SHA1 e889dbe9c8021b99626d0d4fd790d9fa3769f4bc
SHA512 19195dd6d40d827c98cf596ba7311c210fd14805bec47ea642ae3ea10cdf38f3ab8f5e9c81c496cbcd30ce56e56320107ddc339760753291c5cc2cc3a6901050
TLSH
T19A21076350BEA47BA1681D670D44F88DA97FA831914294F9DBA6826CB0D48F36646037
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Network\TransportSecurity
Size 1KB
SHA256 82489ebb4237f07478502db83c625c34241e65536764356eaffe061b4105b745
MD5 b352f7193f073f12fbd6094de3fdb98a
SHA1 4d56217ee32be3e3e3b7c816530c26fb271a9efa
SHA512 3e47ad503750f5496f05ebd4108c3f3681af6dcf4217eea941c36a8727fa1e5edef2422ea9dab2fe0cef8e5c4a5c35714297475ab536fa4a15fab9743b472eb2
TLSH
T190216E6785BEF47B606C0D670D14FC4D6E7BE8719142D4F9DBAA426DB0D48F36A02027
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe598b00.TMP

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Network\TransportSecurity~RFe598b00.TMP
Size 857B
SHA256 2d6b7ef852db3a4b2d63566d1793596af270a80f547226dc2d67ff45194f4cca
MD5 283274e5bb0a1e9359256b2bbe351b77
SHA1 968c5da498c5cbeca7c17f48508b8ed7d65cd1c6
SHA512 fa5554b6f7b3abda920486562ae9893dfd0e1865ef40c1e46004cf89c6ba8091148556b589f19bb9cfedbc5d3a6e7ea71406ca10eb6c93186949b989918cfe2e
TLSH
T17411086380BEE477A0684DA70D44BC4A7A7BA930558294E4DBA9836DF0D08A36602027
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Preferences
Size 7KB
SHA256 dd017984549e3ea622e319bbd49ff8c1b2aaebeaa80d132ed15bbafb8e0d6ad2
MD5 233b74c722666514e7a455ce1838cb93
SHA1 11ebe96c108d8fe8e81232ec949ac0f63d03d992
SHA512 e7c1e920bfadd1c405b9b440e2533064487a8128fdb6b08b74d47d661d57b40ff2f7d6fde893bca17059177c8403a10094dc533242b25edc01009fdd1d2982c0
SSDEEP 192:st30TfPfPZ8pa3u/S+WiTly/ixgE1VqIMC:stkTX2T/VQqxGRC
TLSH
T126E1A9029E28697B9CCBF61D7A35BB52E2FA202261D50E54EBFCC61C05DA6CD5307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Preferences
Size 7KB
SHA256 c5be77d47ea45e071a2b5c4e4987bd9ab42507b528426618307351c5c13d6511
MD5 f5e41d403e85886b01fda3e118821489
SHA1 ed2344fcb83a86df661b1a9c858cf0327d46f655
SHA512 0ef0f545d75812f0f379ae79ff4178b82758d47be618b2afd4c21855aba8bff1121f5319ab86e47877dc77525d7f0203fdef72f4ff2e40d09ebd4d3f2023ffe7
SSDEEP 192:st30NfPfPZ8pa3u/S+WiTly/ixgE1VqIMC:stkNX2T/VQqxGRC
TLSH
T1B0E1A9029E28697B9CCBF61D7935BB52E2FA202261D50E54EBFC861C05DA6CD5307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Preferences
Size 6KB
SHA256 ac446760c73337ed0dc8ef7803dba2e2e7be99d028861f74686918420aaa5e87
MD5 f1090726670148609fc009a4c1de0c70
SHA1 8df61a9e905b544ce60dd61ad7ccf479b59adf88
SHA512 3336e7b2af76206ae9712c91be54fd2e6b4005a3080ab1372a7289938c6ba26329c47d8330ed65bbed34c032441a39094bad8a6f78b154af859b177c4a706aa7
SSDEEP 192:st30TRPf+Z8pai7/S+WiTKom0oxgE1MarMC:stkTJhV/Veb0oxOJC
TLSH
T1C2E1CB029E6C79778CCBF6197A35BB16E6F9202261D50E54EBFCC61C05E66CD2207D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Preferences
Size 7KB
SHA256 2a0a4cf50ee6a2ef62474c469583598f340caffb4f148e8c3203b68c82393b66
MD5 0b882dc104cc3c0cdd76bdd00388ae8f
SHA1 171f08898797ca63c7f6f1486fd23f33253bc0c4
SHA512 1317db430e2abbca898b98fd47d10d00b8481e6a9389ba89c0254d8946058780d4cefe019c56f92af056e6a6723b3c14af395d7ddada6f95b79b7daa7a77facd
SSDEEP 192:st30TRPfUZ8pai7/S+WiTQgqxgE1MqWKC:stkTJzV/VrqxhdC
TLSH
T133E1DA029E2C697B9CCBF21D7A35BB12E2FA202261D50E94EBFCC51C05D66CD2207D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Preferences
Size 6KB
SHA256 204ca83261a82f5bde7adb2fd64f71905822ef2b5d5e6ab09457936708dfac20
MD5 c5b0cd88620ab8d69d7a811f04913a28
SHA1 9543f5b04a9320b6234d2f8aa4a772bdcc70607c
SHA512 1dd40cdc89c3dc25c621f69217fdeddea5aa4f61f383ea4006fe335cd6213cbc47148c005b02069f835729c668d50eb26eb2fd717b83473b4542c22df59a8f9e
SSDEEP 96:stf/05N0VvdGb9tFffR0Z8i0vhE8sktum/7qx+WVHMSm+uecJnD1ixgEQjeg++gc:st30Tlf+Z8pai7/S+WiTnDwxgE1WrM8
TLSH
T128D1C8029E2C79BB8CCBE2197E35BB12D2FA202261D51E94EBFCC51C05D66CC2207D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5960b4.TMP

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Preferences~RFe5960b4.TMP
Size 6KB
SHA256 cef54338456386117fca428eb3bd12b3dc3fde400b3d7cccbb748561b357d818
MD5 7fb21b342cae8e45312d08f47207f9ad
SHA1 07ea17c6af8b31633d47730373a37cbbd1311b0f
SHA512 1fb7ec9dfa7044b5471e9583a83faa2a080f21d839eab78e14672b4b1659e810654d16e4d43185c2f26d74bd377832cf144c7e34e77f823085978de5dfb35ac1
SSDEEP 96:stf/05N0VvdGb9tFffRWdZ8i0oE8sktum/7qx+WVHMSm+uecJnD1ixgEQjeg++gc:st30TlfGZ8pFi7/S+WiTnDwxgE1WrM8
TLSH
T103D1C8029F2C69BB4CCBE21D7935BB16D6FA202161D51E54EBFDC52C09D66CC2207D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 936f5cc9a16898fc133183459ec297ab13ff438d558cf6c6b3bb67fd4981e31e
MD5 af0bf0285b9d9784b226c1c4342f47b9
SHA1 f57701228dafa6dd9ecbb097a3033911e3354d93
SHA512 0ce9948a0c5fc27210d053682ff40e3f130e658e40b8a81e3a0b4997e74952305d205a75a2abdd53ac701f4b88d561e56df6cd968aa42e36a792cb61b1762355
SSDEEP 96:HlZJi0CPlf/ROoKOpkF5d1ZJi0X7sMaTEv9V5h5pg5+eeAVyCXtDfgVi4y:HQFWGHM9luyWtDsi4y
TLSH
T1B4D1B6A3455DC535AF499BEAE82D3ACBDDBA408F98D5481697E1C44C07C2EFC20DA8D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Service Worker\CacheStorage\7c0a3bc891327ef5159cf5d251c4e0d2ec0f4c59\a366a9f1-52ed-4585-a70d-4751cdf6a9e0\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Service Worker\CacheStorage\7c0a3bc891327ef5159cf5d251c4e0d2ec0f4c59\a366a9f1-52ed-4585-a70d-4751cdf6a9e0\index-dir\the-real-index
Size 336B
SHA256 7d805946014431e15866f2e23fd259b83386940605943e9929bcf8cdfff5d02f
MD5 8dec0661bd85c65ccc694600296b5888
SHA1 2cb22daf0b6af34506b75e65b66a4a7a99157643
SHA512 4d7529571484f2bef7cfa795783ab766c87d2a6a4452cade57b656734990c45089e77254d80fb58a51e1dfaf26c0a5f6de57d0b52060696f287e4c274f398305
TLSH
T1F2E0951DDC422595D9100D3C05C60D531323AD200F371557D5D24577F9F5190C813181
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Service Worker\CacheStorage\7c0a3bc891327ef5159cf5d251c4e0d2ec0f4c59\a366a9f1-52ed-4585-a70d-4751cdf6a9e0\index-dir\the-real-index
Size 264B
SHA256 902c226bb0064f738f362c9351f2eed7861b474b4bbd3ebee182b90a4fdd55d6
MD5 afa11faa6f041c72f098c6b77df4f051
SHA1 a77f3b2cfd14a4b0191a71462452227946008206
SHA512 b26a2cf43992f225d1b131287159cad9aa9d9737d19205c021b72e3a1c6d7d90c56205ddcf51a55a00a7dcbb0f200ddff5f2bd1c04ef3dad6f7e67fea096d5b2
TLSH
T188D0229EA8C22136D8110D3C0AD208520202AC601E220AA7C291A8ABEAE86C4DC01242
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597342.TMP

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Service Worker\CacheStorage\7c0a3bc891327ef5159cf5d251c4e0d2ec0f4c59\a366a9f1-52ed-4585-a70d-4751cdf6a9e0\index-dir\the-real-index~RFe597342.TMP
Size 48B
SHA256 468952f97139549d1e9d2850186e1039fa84dd3852697318fdbfe6c816e70560
MD5 58ac9fb261a6146e665cff685365c5ec
SHA1 d87ca1c66b21b346034dfabf7fd78e882de7c72a
SHA512 4aacd73329fc97ac56e65e25b1bbd377183e7d0e2327e4f1cff3bd79fcd0b13bf9e25ca755d329b7fd01504d4a1508aeaa142ab445e6aa13833c0f4c55908906
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Service Worker\CacheStorage\7c0a3bc891327ef5159cf5d251c4e0d2ec0f4c59\c2f41063-c2fd-4326-9831-49d33967581a\index-dir\the-real-index
Size 624B
SHA256 8ffd0a58b55c2512679f5c7c154e4d6e3019d7274cab95916499b7a39ed33df7
MD5 ea2217920afda99ff5e7290ac32821dd
SHA1 d9882b4d72378648acf34788e3c1c16d4f8cfc1a
SHA512 f6ae0e2add35b0c1d29f95e9b6e33462bfc5b551c048a0f607fe74393f13599c899f5842e8450c602c4bd45e8796afb4a4d0f6aaddcf08750946524a8f011f81
TLSH
T1C4F0DC8B6E051548E7890C3AE0B3326380038DDE024287A86AEDC88FFBA49445181055
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Service Worker\CacheStorage\7c0a3bc891327ef5159cf5d251c4e0d2ec0f4c59\c2f41063-c2fd-4326-9831-49d33967581a\index-dir\the-real-index
Size 408B
SHA256 71df0dc421e921ace974e2ec0860ca1de5721a8558839ab10fd4dc3a29d18a36
MD5 4e2cf2e7a79fbdc25c4d43f4303aa560
SHA1 389ca133ec915a73f576ae2b06f18ca6885cf67a
SHA512 005573744c2761406da1dffa9acfdf8ef4c985256611ed4a5855d3dd4c68c7519f080e45ac7ba246086e269f3ee1830ba040b244daca70db984f3cea2e9d0cce
TLSH
T199E0E7433D41150CF5040F7BD4B3236781034DEE0140CF5CF9ED8557F871C805181051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Service Worker\CacheStorage\7c0a3bc891327ef5159cf5d251c4e0d2ec0f4c59\c2f41063-c2fd-4326-9831-49d33967581a\index-dir\the-real-index
Size 216B
SHA256 55662fbf4c2a83e696fb85fb11663799f1a6eba7fce0e7be1d680989a778ba3f
MD5 2f7788161c4e3cf30c506f23197f3ec2
SHA1 7df67edac42a8e1d4fa91e8f01af4914c58c7de2
SHA512 32ac2d839da9930bad796831f950b744142ae7f2731ddc03f4e6d1aca3ee1e6b78d77a9da963695295816207882d39be15b00610878f12fd6f17b048874c5b2a
TLSH
T1B2D08CE17C020E66D10807BB74B3A66190194AFF121187A860FD2AAFE868E901383024
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b2db.TMP

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Service Worker\CacheStorage\7c0a3bc891327ef5159cf5d251c4e0d2ec0f4c59\c2f41063-c2fd-4326-9831-49d33967581a\index-dir\the-real-index~RFe59b2db.TMP
Size 48B
SHA256 37810328578ffec3a6734010b1ca47e9409ad9cdfa5274356322f189eae99371
MD5 cea979be04f4eac8cd5bea859ea01e63
SHA1 dee89c7eadac7e77fcc0effdbe81ab6cf9812248
SHA512 5f4b1faf08e19169924cf032735d26cad20cae9af670de268ca63212a5f525360e5c2da599f125563937c1449892e23f6b928ba6bebb5278c60b70bf1841efa9
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Service Worker\CacheStorage\7c0a3bc891327ef5159cf5d251c4e0d2ec0f4c59\index.txt
Size 205B
SHA256 eb909dcdd4761c9b883ac3c9fff878ac08121a1c518915d4fefe0cf8d40dc8dd
MD5 c43792c9f8dda52f6283c3fc51c998b3
SHA1 4833cb98e27993e7217d76c73770326c08cb2405
SHA512 40fb4e2f673150d09ed4b02fb2bea51b2e2c80dd727822ecaf302cd605ff36d813413ef7ae88a1cecac02d7f9c8e7ed0008bf4fa369beaece38e264f299261fe
TLSH
T1D2D0231EC521E80447B516B737E4DC2BC00D009055742484B701DDDE52C430D7B70719
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Service Worker\CacheStorage\7c0a3bc891327ef5159cf5d251c4e0d2ec0f4c59\index.txt
Size 205B
SHA256 164980121e766dec7320e3d889dfe26743c863d5371bcca2cb19119e9c9a0f44
MD5 d9a91f58fc69d7df2aff82c2774b0cff
SHA1 c79ed6e57dc38c96647f4ae47ac481340da0d283
SHA512 d651092bf8d7ce6cf5c5498b48ae33e06847f2294bad8075f56011f25f28cd5a6841eb4bc1de6eceb60dde3ac944949f63c8868880e5b6aad8a49c6fd9c5e949
TLSH
T1D1D0A92EC521E8088BAA16FB3AE4EC2A840904A059B42488EA01CCAE43C420C6B7071A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Service Worker\CacheStorage\7c0a3bc891327ef5159cf5d251c4e0d2ec0f4c59\index.txt
Size 205B
SHA256 c0ddac9e310b858e2f8e4c1b8acc2aa3271b482328102345f0cf2301526f57f9
MD5 11edc6eb56f7f71d3f944b812127bd93
SHA1 662b81952b4175ca2072685fa85dcdcfc06415de
SHA512 9b1b81738a23a43a57c60ab7a6e06df0c6bb6731e6f3e1c3809ae61f88c92b53158bdf6f5bc50bd9ca24a493d9711cac10fc1340544ea912f13d50ae8210e97f
TLSH
T1D7D0A96EC621A8088BB916BB77E4EC2A840900A059B02888AA018D9E42C430C2AB031A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Service Worker\CacheStorage\7c0a3bc891327ef5159cf5d251c4e0d2ec0f4c59\index.txt
Size 207B
SHA256 a8f32ce94a0946c9ce171a6c1d415b41f9e4920fa162657a9b7f65ba00f8c35e
MD5 0a8a31f93618fd66be6a651dcafa4ab3
SHA1 3b9ca0721ebcc8b4f5543c5e755ca9e3ce20c5b3
SHA512 5336ac5c900083c5bb2b8e94d434b6b496a8c16796269ff2baa211a7380e299ebab6bf80059eb007e16dafe923dac03c813762674304daad00f4e5952d0c6229
TLSH
T14AD0A92EC02188489BA916BB76E4EC1BC84A4CA45AB02488AA01ACCA52E420D6B7031A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5963b2.TMP

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Service Worker\CacheStorage\7c0a3bc891327ef5159cf5d251c4e0d2ec0f4c59\index.txt~RFe5963b2.TMP
Size 131B
SHA256 183f4a52d08512ef3af5df53994e2a7fdb29a46c43258ef363692ff35f29bb11
MD5 87598bec68bdb702cc3dfe926380bce0
SHA1 f0bccfee5d8f7acf01d9f6b9d5301a7e5c57e2b2
SHA512 7b22d40ba6b5d1778e4cc9e47fb9806e22c0a798c7b9b244babf6b65027f3b9abf46c9cad39898d6e5df711ab7de00519dcdf32f782aba9308712df3c50a9be5
TLSH
T117C02B1EC0028C04472455B3B6F4AC2FC04D0CA00D712804A401BCC412F020C727070A
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Service Worker\Database\000003.log
Size 768B
SHA256 1d38e0ea0a99d3dfce286a573da650d4c896d594cb30df935e5e3e5ace7b55b0
MD5 662272b8c7a6f71a1a52483ec5f7b492
SHA1 0f276f0e109e517927594925ba0100bb23d4cce0
SHA512 fa2d7c4faff6ce2653e7fc1f058e048416d3b21943c974f8bbc9757ddfea0b3a55643eae795fc6cc428fabc203759f2f87d3dafb80a3dbba6933a1f97b8da712
TLSH
T1F401D6CF1F11805ADAE19DF26AF95D2E9BD6C4EC87FC1A03E11A5C4406E814D3235BD4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Service Worker\Database\LOG
Size 305B
SHA256 194275472d7ce1a3edda4334e0a30213683ae677dd8e760dfdc75d778842a24b
MD5 496f918ce74a3aff50e924f94edaad79
SHA1 358a1d0e1dddffd6d7e0d6e31beed753284ff1ac
SHA512 fc6eb04951eef8c63f9ee3da73b3316ace16688aa2b275d3204c58f7bc6a41bedc56f55df4d54f62475a9d45bc2f4154190b06f8ea367590b038e67b7fccef9d
TLSH
T15BE0865065CC857A588585AF0B76530DD768B05EE5C83A950FA0EE5C2C87988B462501
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 d90dee56c02c317f64daeed3cd6a4ad8a5931e80d5eac475e106b675af0aecf0
MD5 d95c40883997e7b82dee45efb2f453f2
SHA1 a062aa84d8eef341fbca34d92b501bf9fe123059
SHA512 8c93ba7f489579cf50e91056cd7354b78438058e2bab86afcf1615cb0475b4ec397c4005d704732d590b98b9a6f638c67e5b0786789a567216210cb9cb27df5e
TLSH
T15DA0025211432956F26152B0219642C43654DE756259221547D216999D941F1411A450
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597277.TMP

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe597277.TMP
Size 72B
SHA256 b93586453f9459b774fb726db559bc222afbd459a250a182e2311794591f652e
MD5 99c9d3d42dbadb21c0795a4215eb9e65
SHA1 ae85659154a14b6feace5a1881c0017d3c7ae0d1
SHA512 e1c2ab59ca6e0f3435bc243fbd10cd7ac5541b91dddef3c8c1341baaf6fc196ce4ce0c740a5918598e5aeef366d7bf70ba872a0299b5f5bba62b2294a8ed94e7
TLSH
T18FA0021243441114C04E12B0201D42D852019E2D8054060282E00656EDF00B19515040
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 d3ab6e9693938566034f01bf7a7193ab986ebabfc7d8a3edb319afdca31c82ef
MD5 0b5c12e5cf4a8014811425f5ca2d8823
SHA1 0a7a3d094287c0a8e517efd4d992f021df7ee811
SHA512 f2229d99d2832af4328eaddff710c3f72b57855f23f26bff614d497a613a4bf4f72478eab4c6c198ec82535e36a63db58b9ed93dedffd58a02f706e87bbe10c4
TLSH
T13FB09280AB01922BC1980E3902C88BE06720E3027A04140348489F218EAA2A82E10898
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Site Characteristics Database\LOG
Size 315B
SHA256 ee60f63289e5617b9273a372baef265929ee9627ff82c30c696c4eadf204be9e
MD5 e98d7d3ec73a8e37856bc77f7b4def46
SHA1 695bc3c705e6ae16d68381321e704bd26f10272d
SHA512 d5935ae4df1190c7c8894e941072b0ca438b1533672f3825ef4ac817adb6b71e5bcfd88593b3cd15a37360d5094d4cf0a673686661a574b5e1392bc983595f5f
TLSH
T162E02620B6CD8A3F498545BF527AA30CC631B008EACA6A251F68EAAC29471C4B422600
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Sync Data\LevelDB\000003.log
Size 46B
SHA256 a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a
MD5 90881c9c26f29fca29815a08ba858544
SHA1 06fee974987b91d82c2839a4bb12991fa99e1bdd
SHA512 15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Sync Data\LevelDB\LOG
Size 293B
SHA256 f186fc1c8b572f18f0561ea68d5f3270443625ddc8145aadfcbcd0ea3bb4978b
MD5 8f73f1ffa8d92d5fbd23e73d62fee33a
SHA1 3f3d6578658ed79181224a25301c8ea8a0bfec88
SHA512 b0188d252848a2ea3c30715ee433fe26758fcc1bff5ba71efebc06dddfd6be8eb686021fd514450a573b1b8645e05f165a0c81fb394b66abb9e9dbd615853a8d
TLSH
T177E0CD70E5DD85774C8485FF42B9530FC670A4445BC976494B68D57C6C42184F931141
MD5 SHA1 SHA512 TLSH

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Visited Links
Size 128KB
SHA256 f8379ee79bd2505f25e47391563dff8350202df8a6185c51c12718a516d4b8cc
MD5 2702a461e3d77316bca4e24770176d0b
SHA1 7cb52f7c5c0b7af397dab8befd4a04151c61627f
SHA512 09095e0f41a77ebeeaaef2a153389ec1cc436f66d209de307181e45e054ea7c7ee247148f332da60c3dcd8aa36e31c4c99c01cc3b60289b0c70c113c21674c28
SSDEEP 3:ImtVuF+uCjSuDBt:IiVuuf
TLSH
T18FD3045C13574540D5340FF4C5001517043CC00144D1141303344501CC554134333411
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Web Data
Size 216KB
SHA256 2a7b3bb5ac287c4d5fd81c76626b1e8e15f32f34d2b37738fdc98fa6ad43baaf
MD5 4ebc7325aec489f53e4635ea414d14a5
SHA1 c85641375cd9bd4a26922883598a02e8861a6bec
SHA512 a2ad8a907e9d3405fefc533ef4ae65fcb32615914163af646c6af02a412df1d3a2250d0ec8e04ab5d04b6d8453122d43d97aa3340358fe5e7c748e9e2117fb74
SSDEEP 192:njQLsS6Xuv9PhDnLUMjA03VpQYouZtuQKIqJZWTVTdhsrV0dwe:nEL3CuvrDnwMjA0FpQY5Z0QKIqJE6K
TLSH
T14924440A7B746001EDA6E9721CB080771D3C61AD8F22E6826DB254694DF6853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Last Version
Size 14B
SHA256 06205ebe5acf3073d12a4ac419377a3449e6d6b5fa7fa2b1c4201f007c4ddd91
MD5 96fb5f155aee0f8cd88274656c58ca83
SHA1 1fe86d9df188b0f86ae2d8da8f7c1ef663258baf
SHA512 fee0061ef23ef3fc35d050501b47db921f490c2aec2a016304c9f27228d3ecf7df9641fd681d9babd275ffd3dbd20e33e38fa5bf583c2852ffcd4b04bedf015c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Local State
Size 16KB
SHA256 265953fc1e202559c217e37be02d12b6494310b3c61d13788783504354a4102c
MD5 21d384174273e1e921d0126ab2e743a9
SHA1 0cdc21412687f4f36b8f3883309073e1a5c62dc2
SHA512 6d93194792acf79fa4742f8fd7f6a28a07e888835843a30e2f6cbfdf22e135226ecee07545ee2558f3e1eb94bfb78fe49de18d447c6726830479414bac8db058
SSDEEP 384:z1+aQikB+z/xvxjg/qhEx3NbHiiNeWcyq9zc:0/UxvxjgC+xxC5yqFc
TLSH
T1BB728E3794687E3698F6E90479191B5BDFB994B280C12EB88AED5F0D07CB3D81302D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Local State
Size 1KB
SHA256 9bd64d31800c96b70a830b2eb841f3004967dd844188f19075206f51ce902165
MD5 fb81c8f6841cb2af5b967318b2720991
SHA1 29f7c2ebe4248adf1c84d2f44c7d2324c73bb70a
SHA512 4273aebd81db15f84c54b93356c585ddb5c3c1d7a6510be9a7718f4e5e41c1d5db453f84079b108cf45f18d016ca5e36685b14b9ea2ea0bf4db433548ad54c64
TLSH
T15A31A472E0C46B32AC826A49B2067B676F701167C2214F6491ED472C03EF6CCA63AD33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Local State
Size 4KB
SHA256 f074002ef3050e188f22651f0c5005d4d91b9ba5b56934a2b05ebf383df3666f
MD5 5e5dcc8e9635da8dbf629a3a98248ae3
SHA1 8ac3cccabad63aa4f1dad2fd7cb7417aba6608fe
SHA512 503033cf9a2958f6ee1aab9760e7675da01cb689e6f2c26baf9fe382c2bdb8d10b2636e9ae250a0429b9829dd9ad3113cd287c5953a5a92af7f975d38a291065
SSDEEP 96:zuVXbNkCufgrOjsY8Frh/cInURoDoto+5f9zA4Df95BtKXnx6ixZZZhTI6Ga:z4bNbrrJooDUhlzBlfQXH9d
TLSH
T1F481B632E4A4A9378DE2D945B9463B17BAB45163D5A53FA5CAEC0F0C02DF3C92352C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Local State
Size 3KB
SHA256 88fe4dec0f86d906195c245e71422fb157bf4f6ca0f0b26560f13fefa3e7c56e
MD5 8fd5e4943329faedd25addbf56787bb0
SHA1 401f85824f1684d019489de4ad8bad747636e174
SHA512 74bd2660fccd37b55adb27367fa8ddfd22d893b603a3e8b0b73b82a08ee790bf1535cabed38d0b0fe9bc0ed1f2bf2532f1d0cfe8a1273dbabbd048130891d282
TLSH
T171719636E4A8E9378DE29D04B9863B16BBB55123D5A53FA5C5EC0F1C02DB3D82312C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Local State
Size 14KB
SHA256 591843b6f8dd2d0c7d247261fc7a8c8c5a2e7be13ff386e113e23a228b8eb155
MD5 e4ca559d1f83e59d376614e307dd4853
SHA1 3e56bc9076c081e6ab8534a9439d47d1c9d79986
SHA512 8cbadeabccd872c68c0c3292b5a4b4aff98260e2f2f8974749df4fa1f648f40eb140ca2b6aca7734c7c1e2d74cbc0156a14784159a5279d2f7aa00e0593b88b1
SSDEEP 384:zg+aQikB+z/xvxjg/qhEwNby3i3fWd09zm:r/UxvxjgC+7eI0Fm
TLSH
T1A1629E2AA4687D3799F3FA0479491B5BDBB8847290826EB84AFD1F0D07CB3D81302D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Local State
Size 15KB
SHA256 0074ba1bcdd047ff312f9b64c82da3241a505be8b625efcb0a566e0eaeacdb8f
MD5 23cf9364e8ca61be82fa23f35431e054
SHA1 23f499c23192ffcf76f7e2f5bd449552f806aff7
SHA512 8e57f03be96e99f7d32623408e8acfab484661f621c8c7af227de10e7b9c631e97578cddaf7e94a36d8e1966e461250673b277ff41b1f50ca2fb55970330b847
SSDEEP 384:zj+aQikB+z/xvxjg/qhEx3Nby3134WdD9zm:+/UxvxjgC+xgaIDFm
TLSH
T170629D26A4687D3699F3FA0479591B5BDBB8447290C66EB84AFD0F0D07CB3D81302D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59114c.TMP

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Local State~RFe59114c.TMP
Size 1KB
SHA256 ded92b97f1e4e11aaec7db6bec636d9b786d1367c34e0c2e8d03d50e27240f6f
MD5 3ef53e41244e696260227beeb1e09313
SHA1 e5a68af65cedaade3b510171a57fefb1d151be8c
SHA512 fec0d0cfb155783de2f0a3691e8441cf7b6dc95164e16824de6c4a17688d9d66c9275d75697215106de3b874a6c413e3495a3c78aa391cf11de304f625ea7d79
TLSH
T147216273D0C4AA76AC851948B2127B5A2F70016782244F29D0ED432C03EF6DC863AC33
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\ShaderCache\data_1
Size 264KB
SHA256 4b63e38056ed9b9800e6ad1c26240c85a7ef34f642065b56122a372f54acdf60
MD5 ba4f80bc724d100b23bcf266fb0f9be9
SHA1 497921ed83de97ae0d12ec661d010b96e325d0a5
SHA512 0811b69b1faf614de2a0f80f16d9d87f65cc269114ea4d4ed8859763ab640cbef3264b9ce7f1ca1ea71eeae6ed1d36211dd2f2f2feeeea53260672cde5371b12
SSDEEP 3:MsEllllkEthXllkl2zEklsE1:/M/xT02znsE1
TLSH
T1DB4404047FC00405C51010304017C3F003F4DCD00515774334530D17DDCD5C10C00400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\ShaderCache\index
Size 256KB
SHA256 cbdb4d08a6edaf2dd5e14b9d55be2b13293674c4e25796a3928c479585e1f29f
MD5 d17da69253bcd32da9c0876efbdadd2b
SHA1 4f063d6025d8607e5b6c13d44d8779297fb6db66
SHA512 048856daf3d7e444a2313813d080bb88d2f46a055cdd702f78910e2533558191c142e6ef339ac769a4dd0e9ebebf74296d902929a10cfc2c09419572263103ae
SSDEEP 3:LsOllllklkXlcLat:LsUlPH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

memory/972-802-0x0000024882D30000-0x0000024882D60000-memory.dmp

Download

memory/4360-76-0x00007FFA43360000-0x00007FFA43361000-memory.dmp

Download

memory/4464-118-0x00007FFA43140000-0x00007FFA43141000-memory.dmp

Download

memory/4464-352-0x000001AE02D30000-0x000001AE02D60000-memory.dmp

Download

memory/4464-127-0x00007FFA42060000-0x00007FFA42061000-memory.dmp

Download

memory/4696-190-0x00007FFA43360000-0x00007FFA43361000-memory.dmp

Download