76660f8b1b6ef2651f1110e17e046b2911622938c8415399aea16591a0eb837b

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 07:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
astrozabal.exe
Size 31.8MB
Sample260810-h4m28stdkg
SHA256 76660f8b1b6ef2651f1110e17e046b2911622938c8415399aea16591a0eb837b
MD5 bc1fef2212c033f9b1ec284c343c6e20
SHA1 a624ebd89c74e9741b6094a7153d8e7fabc2ee1e
SHA512 e56cb99f56cd7e4966ce19fd31704b2bc30c41886d8c2d24d2bc9db8e97a67f0d131a700ecfb27fb221c96519720275c67e1828f5da87bc425e105e6a63fa243
SSDEEP 786432:OSHzCXCbSVKA6HkPipUqwh3ME6DXlpM95MQlTBN8+:OkzCXCbSVKA6HkapUP8E6DX3z
TLSH
T16177BE217A5A996CD05BC47483478A624A7030DB0B39B9FF449896383F7EBF46F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	astrozabal.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	astrozabal.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	astrozabal.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308199569006379"	msedgewebview2.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280\Blob = 0300000001000000140000009e99a48a9960b14926bb7f3b02e22da2b0ab72801400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183040000000100000010000000c6150925cfea5941ddc7ff2a0a5066920f00000001000000200000008408d5e5010ab8da67eb33a7d79ace944dd0ac103ae6ead3ff30dec571066b0319000000010000001000000014d4b19434670e6dc091d154abb20edc5c000000010000000400000000080000180000000100000010000000fd960962ac6938e0d4b0769aa1a64e26200000000100000079040000308204753082035da003020102020900a70e4a4c3482b77f300d06092a864886f70d01010b05003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3039303930323030303030305a170d3334303632383137333931365a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a381f03081ed300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183301f0603551d23041830168014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7304f06082b0601050507010104433041301c06082b060105050730018610687474703a2f2f6f2e7373322e75732f302106082b060105050730028615687474703a2f2f782e7373322e75732f782e63657230260603551d1f041f301d301ba019a0178615687474703a2f2f732e7373322e75732f722e63726c30110603551d20040a300830060604551d2000300d06092a864886f70d01010b05000382010100231de38a57ca7de917794cf11e55fdcc536e3e470fdfc655f2b20436ed801f53c45d34286bbec755fc67eacb3f7f90b233cd1b58108202f8f82ff51360d405cef18108c1dda775974f18b96ddef7939108ba7e402cedc1eabb769e3306771d0d087f53dd1b64ab8227f169d54d5eaef4a1c375a758442df23c7098acba69b695777f0f315e2cfca0873a4769f0795ff41454a4955e1178126027ce9fc277ff2353775dbaffea59e7dbcfaf9296ef249a35107a9c91c60e7d99f63f19dff57254e115a907597b83bf522e468cb20064761c48d3d879e86e56ccae2c0390d7193899e4ca09195bff0796b0a87f3449df56a9f7b05fed33ed8c47b730035df4038c	astrozabal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	astrozabal.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb6587f0000000100000016000000301406082b0601050507030306082b06010505070304140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d777e00000001000000080000000080826f22e7dc01030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	astrozabal.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 5c000000010000000400000000080000190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a7e00000001000000080000000080826f22e7dc011d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e77f0000000100000016000000301406082b0601050507030306082b060105050703046200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e650040000000100000010000000324a4bbbc863699bbe749ac6dd1d46242000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	astrozabal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	astrozabal.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280	astrozabal.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2884	msedgewebview2.exe
2884	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
900	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3040	astrozabal.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 900	3040	astrozabal.exe	86
PID 900 wrote to memory of 1488	900	msedgewebview2.exe	87
PID 900 wrote to memory of 1324	900	msedgewebview2.exe	88
PID 900 wrote to memory of 1324	900	msedgewebview2.exe	88
PID 900 wrote to memory of 1324	900	msedgewebview2.exe	88
PID 900 wrote to memory of 2768	900	msedgewebview2.exe	89
PID 900 wrote to memory of 2148	900	msedgewebview2.exe	90
PID 900 wrote to memory of 2148	900	msedgewebview2.exe	90
PID 900 wrote to memory of 1920	900	msedgewebview2.exe	91
PID 900 wrote to memory of 1920	900	msedgewebview2.exe	91
PID 900 wrote to memory of 1920	900	msedgewebview2.exe	91
PID 900 wrote to memory of 2884	900	msedgewebview2.exe	106

C:\Users\Admin\AppData\Local\Temp\astrozabal.exe
"C:\Users\Admin\AppData\Local\Temp\astrozabal.exe"
1⤵
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=astrozabal.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=3040.2996.12196079706535182468
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:900
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffb209ab078,0x7ffb209ab084,0x7ffb209ab090
    3⤵
    PID:1488
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView" --webview-exe-name=astrozabal.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1720,i,4636706249149760069,8616134465056806359,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:2
    3⤵
    PID:1324
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView" --webview-exe-name=astrozabal.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2052,i,4636706249149760069,8616134465056806359,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:3
    3⤵
    PID:2768
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView" --webview-exe-name=astrozabal.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2400,i,4636706249149760069,8616134465056806359,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:8
    3⤵
    PID:2148
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView" --webview-exe-name=astrozabal.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3624,i,4636706249149760069,8616134465056806359,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
    3⤵
    PID:1920
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView" --webview-exe-name=astrozabal.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2216,i,4636706249149760069,8616134465056806359,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7b8cb2ed424204388ff60309ab47abb8ee91c129ba291dfd92bc9bd5a3625d6e
MD5 74c6743d15394c98008b1df0bf08be45
SHA1 daf3f3bcab9f1e414553ca7433e91df85bd92ac1
SHA512 a5acbb716f5859f661745d5635963b6d45446962a9da441428ee6ed72fb25858bffa57442f27877aaef5bf3493ce94c0000025af99550f741ea26163c171021e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 059b8300e29deeef72e2e43bf81e0362043f2a240df9f1faf462f4b4b41df178
MD5 1902f5aa0b9688183845064c3ac04e5d
SHA1 9ddd851584096bbe81fe5053f21993279d05b66b
SHA512 3aefb63cab861bdddcd9806d70a9324a4dedd7c429e1b4b71ea5cdd93c51f04913273c58357a34d2ec193cecec06cfc98611ca3e073369d6de9c8ebabcec46fe
TLSH
T1FFD02413335D0174C01030731003730D0501C11F4015C005DF3CD71D1F540500D07C41
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 5ada8c1eb38ce08e9d4b2ab2ae93b33172e4f6eb7220866d51fb6e76e3a82a6f
MD5 59b3dbbe7aa5a23d718cd26e7f7d9861
SHA1 deda39314bf4100055a5c6344c5b12de17a28250
SHA512 e4ad25502520b8727d5f7a0ca11cad928568989f99c12a106e0de10377e70d1b7afcf0303d61ba834388abf029e041e8545aa4ed9b0e5f1f88d15162ba6b8fef
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 26d5e345b3333d65a78eaf6a7779c14d9e8f3b9208b9902a6c1fa65b9498732c
MD5 73fcf64fa717c6b7b3991bc6054246b1
SHA1 85ecb5b5b62a8906785a0f048fd7b519d3ae98be
SHA512 9f9bf123415f15eb41eb31ca0d945976ebe6e01b1b9596cbb370073926e66c8bec5a034df0df13f1963bdda97e4d3d2d65c23cce236eadc0f6e830fa2400d01f
TLSH
T1A0D022380408AE8EC3868DF128C2CF91703402A1503F2F06AF810F3CC40074CBA3002C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 2476a7e1beb904525e21e4057eefded3fac7e324903a37b92aaebd50a17d8895
MD5 b699ee612a409f5ae45805516f5d04de
SHA1 fe75f38502d31390fcd0a7d51cf8d000e88cb4e2
SHA512 06ce4b772b3f3cdf39806311cef22051be5351a90bd32051a0184261c925422dd697306a0ab4bef747c8fa8c1f33a833b9315a243de751bc4b2f624cf9617b72
TLSH
T137D0A9388448ED8EC30A89F028C2CF61B03402A1123F2F06AD810F3CD48138CBA3042C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 cab0db1c6feec59e633de9ecb290041d6161f4ad788882ed5c0f0335c012cfce
MD5 a9ac39e0b53e0572b71e4c711e535f74
SHA1 5bb6bfd24876f77b6be55c505d44c78587c16554
SHA512 c96adad6855cf478dd1ffaf7000647bf94894f4326d03506d6d3716464d819fc6463e61a28aa65fd9584b88eeed773c568970c616eab0e6036d6ebc4bba74b6d
TLSH
T16E31F292C2E4C67D894116E437303D67C82D091D92247D27CDDAFFAB67D20B1E12044F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe592fe0.TMP

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Network\Network Persistent State~RFe592fe0.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Preferences
Size 6KB
SHA256 90d3c1a8d8886dbf5d1ddc42814127ed1f5e6643db122530e7cf0f300d5a8bcd
MD5 f2a1862c133142d28d11cc2767b3276d
SHA1 58cb65ac8c0bed8abd486caacf352e9a0f9ff6ac
SHA512 4141565a6f434a27ca0d6eb3adeaec2e1c6ae822da474848b7c3c096667009ecd630e2f4ae249b0a763d2961a6f0536b460b978830fb1bd1941bb94e39281716
SSDEEP 192:stg0TvTfoZ8paUWS/S+WiTG2wxgDzZ7MC:st5TvT/V/V7wxDC
TLSH
T124E1B7129E2869774CCFF6197A35BB12E2F9506261D40E98EBFD961C04E66CC231790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58b63b.TMP

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Preferences~RFe58b63b.TMP
Size 6KB
SHA256 3ab1208c7a1de3b7df229547712f4919b57f0ee60c75e1f8545962c692c0528a
MD5 aabba55a4630607d3924423da2decc14
SHA1 f800f7bf470d96e16ebec2abfb3c0f51ad304dfc
SHA512 700a272422ebe2df0d2de840b400c97576d2932f536cebc142967070987438c997797c9724fb56ce4ba20f60e483beb960ffb936a8aeffb7b10c18958f336b2e
SSDEEP 96:stg05NhQ2b9H2ffAZ8i0vhE1ktWHDm/7qx+WVHMSm+uecJtI21ixgU+Qju+gJ7M8:stg0TUfoZ8paUWS/S+WiTG2wxgDzf7M8
TLSH
T132D1B7029F3879774CCBE61D7A35BB12D2FA506161D40E98EBFD952C08E66DC231790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Service Worker\CacheStorage\7c0a3bc891327ef5159cf5d251c4e0d2ec0f4c59\7372dc8a-d60e-4760-be66-f8e803894e28\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Service Worker\CacheStorage\7c0a3bc891327ef5159cf5d251c4e0d2ec0f4c59\7372dc8a-d60e-4760-be66-f8e803894e28\index-dir\the-real-index
Size 264B
SHA256 9f0d1c489fb5acf85a0c168f292e52a437cb92d4f19a3e67fcfa583ab457f248
MD5 a5a223d32b76d8ac9cafe4ca9a9fbd9a
SHA1 a21c2d10e3c14c77651e603f191db4ace8f6e79f
SHA512 fc63ae841517048b3c28d8413e6b3792ab9e98d44c350ae6f2cfb77fb134117e038373e59038995b72c474850cb186badaf536514dbc134d9c2e7bf981a56d24
TLSH
T1EBD0225AAA811132CA2009380BC21D500203AC611A270AAB82D1889BE6F8290CC0124A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5876f0.TMP

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Service Worker\CacheStorage\7c0a3bc891327ef5159cf5d251c4e0d2ec0f4c59\7372dc8a-d60e-4760-be66-f8e803894e28\index-dir\the-real-index~RFe5876f0.TMP
Size 48B
SHA256 8c0b30420b08c387c951c44fc91cbd525e130cf68a22e2f80b4b36a7cd89bdf8
MD5 b3f35d502f5b5367f4032f5e5c4762f7
SHA1 5dc75d71256c46f332dfdaf3e04c1d5121499196
SHA512 e0ef23ddf213f1a5f4f777d1e92490949d0bc9d973517e1f90c1eaac72fc156b1b2ddb7540a3652bf117340f10184927421f30243faf2063da3ddc6d724c9f61
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Service Worker\CacheStorage\7c0a3bc891327ef5159cf5d251c4e0d2ec0f4c59\index.txt
Size 130B
SHA256 0bd3c9a0e6b6c53ddc23d7d75a734a9b454cd3d5e7fb8b1dbc89c0125524d544
MD5 e77411293df2217ec05b1ec5f9567f5e
SHA1 19207d34fa3f22e4930eb437e8945250619f1ac0
SHA512 d9aa7b3576f1c674611e8eec3f20121dc99901e559371e8e74f686dbe7a710ccc8acfcb98d07a32065bf2770261dee86eb6d0dbbc554de4794d2934829641c68
TLSH
T1CCC09B9D4512C4155BB5DA6775D74C6E811E509005F4A458B1048CA443E134D657670A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58771f.TMP

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Service Worker\CacheStorage\7c0a3bc891327ef5159cf5d251c4e0d2ec0f4c59\index.txt~RFe58771f.TMP
Size 131B
SHA256 181cfbf8a49a9017d42ec9acf10ef285c5aa55dd26dc66a1a721c4505c80b4ec
MD5 ea6f92379d7944f90f369380342e73f2
SHA1 8bf9950255901a71a659417597eec0534ab3b218
SHA512 be52b2c08aed2d7a3f3ff8cac7c1488621639fa3463d329964de096dbd4e190178d1c2f65297384057c6bf2cdf01614a44ab0013a1a8c68c3062b862dbed6652
TLSH
T17FC09B8D5511C51557B1D663B5A64C2D854E5C900DF4E454B104FCD442F130C6671709
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 d13fc8e5651f57e4a259ea8c2b6118a07cddea426885407d0783426940c067f1
MD5 3dc1c3fa126bea9f534d1e651adf5ac0
SHA1 e7cfdff15b9885bc6b39ae01343ff7c67fbc33dc
SHA512 cce63adc19b9cfcb9206b41f87b63fa08718bc19c459727d33b47390bd4e94a558e9cf8d96060dcb7d76e20453f89a9f61faaf5f7ff61f27fe38b9f7c24e4fa8
TLSH
T195A002E589430355F61102B05086129432215E25714E972142EA06D5DC551E04111840
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5875f6.TMP

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5875f6.TMP
Size 48B
SHA256 09f15a502204659c0ce78b643e10f29aaf813e97fc43c9c8ec0517a92c7c3d6c
MD5 eeb6f54601126adac9bb50c595609746
SHA1 ac64388cf846b4ee00c1b0d3baeac921a650da61
SHA512 a5d362f32ee21df4a763bb040239a325e5f4c2c0c63a116377ca9fa5d038962ddb733cebe24d99e583ead0a8b9c25a366d967dba9237df92c952cd51b5c55920
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Local State
Size 1KB
SHA256 1e9105626fbf8859c715bac33cbece104d0f7c7d3c506715b887ae3ca0aa4f39
MD5 cf1c91f14e55f6f35a32445f83cf9405
SHA1 669026f615eb040070e304fe144d067dd0f752f6
SHA512 0b6cc00625f73e0dc4c7f14c43e0d9aeda4b4c2ac27a0e2d266f729039a306d38c33a5a4cbe01be2672d87398762974f613ac0fcb753bd0ca15edd7d922230e2
TLSH
T1DE3187B2E1446F724C9AB547A282BF436E61506A82510F54B2CE572C01D758CA93DC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Local State
Size 2KB
SHA256 ca77af05dfa5eba6b074e944074417c821c4bd91e2a8bbc25a73603e0404e97a
MD5 0bb2aad0f09179f1de896953ca241601
SHA1 78a1288bf22649e02b150879faafadf411957984
SHA512 0ede13c6b7600e8e85f7f77fe12777f5a9c9f267b570aa3ffa18f2b91852a1f292b8e831a1d70179ef2c1b18d055233292fe661e44b240003e266807b08c98ee
TLSH
T1C1510C73B804AB7349EBA905BA867F03EE39905586612F60DADE1B2C00D755C3715C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Local State
Size 3KB
SHA256 462959c24ef4b2ddd56886b4d4f1138743c02b2f85d764364be80b6e8671ae6c
MD5 c513e7e3b894d1fe3dfe009377127f38
SHA1 5c46dc0199f6192c2ed0a8cf704dd05d9a93dfc4
SHA512 df73befcab89cecf2329462b984f9f295da144880d644b4deb279e8aa23c164982f44cc665887b3dbbeffa45806dfaf551f04113ab6bb55c0470c7167c254695
TLSH
T18E71C432A964A9374DEBEA05B9C23F02F6A55127D1913FA4DAED1F1C01D72982312C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Local State
Size 16KB
SHA256 6a7f0c98b18fa745aef3018fdd6bb7ff784f539c3e9130b55d7689e1aa99c305
MD5 9661977eecc6a5dd276d2c22b7c371b0
SHA1 ec676be94c0d6784b40c8e3a8977e84fd12ed185
SHA512 b02501138fac66c03677066c61b371a69ae9aecf06bd4609e321552c5aac7c0760215b45a7c42fec6e9ba70ac474b79977604825693644456c3ca217ed99e587
SSDEEP 384:zF+aQikB+z/xvxjg/qhEwNbLcQ2cdPY6Tw9zT:k/UxvxjgC+2ccnTwFT
TLSH
T18B72AF3755687E3355F7FA447E491B4BDBB984B280C12AB88EEE6F0D06C72A41306D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58176b.TMP

Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Local State~RFe58176b.TMP
Size 1KB
SHA256 b2cb3b44c578c1df58152bbf6b425bf25da9e2365010e9472c5795a0dde10452
MD5 d3a17b3c8c9a128836b89ceb0147baad
SHA1 b93de74b0d9407bb0871cd83b2f27f665ae4d876
SHA512 22618a2d5672f03657afc346ea36c68d6a52efd30819062819339d5b9a1f8c7b492c923ad1d45128efa3d27794a225674f98f09aff72ae6a21fdb40aafeb9fde
TLSH
T1DB2187B2D1846E72599D6956A382BF476E5050AA42600F14F2CE523C01D749CDA3EC73
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1324-25-0x00007FFB3C0E0000-0x00007FFB3C0E1000-memory.dmp

Download

memory/1920-141-0x00007FFB3C0E0000-0x00007FFB3C0E1000-memory.dmp

Download

memory/2148-76-0x00007FFB3BF80000-0x00007FFB3BF81000-memory.dmp

Download

memory/2148-75-0x00007FFB3B700000-0x00007FFB3B701000-memory.dmp

Download

memory/2884-411-0x0000015D025D0000-0x0000015D025D1000-memory.dmp

Download

memory/2884-410-0x0000015D025D0000-0x0000015D025D1000-memory.dmp

Download

memory/2884-409-0x0000015D025D0000-0x0000015D025D1000-memory.dmp

Download

memory/2884-415-0x0000015D025D0000-0x0000015D025D1000-memory.dmp

Download

memory/2884-417-0x0000015D025D0000-0x0000015D025D1000-memory.dmp

Download

memory/2884-421-0x0000015D025D0000-0x0000015D025D1000-memory.dmp

Download

memory/2884-420-0x0000015D025D0000-0x0000015D025D1000-memory.dmp

Download

memory/2884-419-0x0000015D025D0000-0x0000015D025D1000-memory.dmp

Download

memory/2884-418-0x0000015D025D0000-0x0000015D025D1000-memory.dmp

Download

memory/2884-416-0x0000015D025D0000-0x0000015D025D1000-memory.dmp

Download