Overview
overview
7Static
static
3ASTROZABAL...up.exe
windows10-2004-x64
7ASTROZABAL...up.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3astrozabal.exe
windows10-2004-x64
6astrozabal.exe
windows11-ltsc_2024-x64
6Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 07:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ASTROZABAL_1.0.0_x64-setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
ASTROZABAL_1.0.0_x64-setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
astrozabal.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral14
Sample
astrozabal.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target astrozabal.exe
- Size 31.8MB
- Sample260810-h4m28stdkg
- SHA256 76660f8b1b6ef2651f1110e17e046b2911622938c8415399aea16591a0eb837b
- MD5 bc1fef2212c033f9b1ec284c343c6e20
- SHA1 a624ebd89c74e9741b6094a7153d8e7fabc2ee1e
- SHA512 e56cb99f56cd7e4966ce19fd31704b2bc30c41886d8c2d24d2bc9db8e97a67f0d131a700ecfb27fb221c96519720275c67e1828f5da87bc425e105e6a63fa243
- SSDEEP 786432:OSHzCXCbSVKA6HkPipUqwh3ME6DXlpM95MQlTBN8+:OkzCXCbSVKA6HkapUP8E6DX3z
- TLSH T16177BE217A5A996CD05BC47483478A624A7030DB0B39B9FF449896383F7EBF46F38359
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA astrozabal.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-hi.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-hy.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-sk.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-cy.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-pt.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-uk.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-da.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-es.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-et.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-ml.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-mul-ethi.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-sl.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-sv.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_1929465562\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_279614490\Microsoft.CognitiveServices.Speech.core.dll msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-fr.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-kn.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-mr.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-nl.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_1293168959\keys.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_1293168959\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-cs.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-en-us.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-nb.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-nn.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_1293168959\LICENSE msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-as.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-de-1901.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-or.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-pa.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-de-ch-1901.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-ga.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-mn-cyrl.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-ru.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-te.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-gl.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-hu.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\_metadata\verified_contents.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-be.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-cu.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_1293168959\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-la.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-tk.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-bn.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-el.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-ka.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-lt.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-ta.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-und-ethi.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_1929465562\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_279614490\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-it.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_1293168959\_metadata\verified_contents.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_279614490\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-hr.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-lv.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-bg.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-en-gb.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-gu.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-sq.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_1929465562\protocols.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-af.hyb msedgewebview2.exe - Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 astrozabal.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 astrozabal.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe - Modifies system certificate store 2 TTPs 13 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 5c000000010000000400000000080000190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a7e00000001000000080000000080826f22e7dc011d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e77f0000000100000016000000301406082b0601050507030306082b060105050703046200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6506b00000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb6582000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 astrozabal.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\022D0582FA88CE140C0679DE7F1410E945D7A56D\Blob = 6b0000000100000020000000d95d0e8eda79525bf9beb11b14d2100d3294985f0c62d9fabd9cd999eccb7b1d030000000100000014000000022d0582fa88ce140c0679de7f1410e945d7a56d1d00000001000000100000007fd52fb9e073588a3e1099811be860a81400000001000000140000000a4823a660a4920a33ea935bc557ea254dbd12ee090000000100000016000000301406082b0601050507030206082b0601050507030153000000010000001f000000301d301b060567810c010130123010060a2b0601040182373c0101030200c0620000000100000020000000d95d0e8eda79525bf9beb11b14d2100d3294985f0c62d9fabd9cd999eccb7b1d0b0000000100000038000000480041005200490043004100200054004c0053002000520053004100200052006f006f0074002000430041002000320030003200310000000f00000001000000200000002f7265a1d1385e1decf7419f774976c48609c250c025d3aa5d73c3f9efc845fe2000000001000000a8050000308205a43082038ca003020102021039ca931cef43f3c68e93c7f46489387e300d06092a864886f70d01010b0500306c310b300906035504061302475231373035060355040a0c2e48656c6c656e69632041636164656d696320616e6420526573656172636820496e737469747574696f6e732043413124302206035504030c1b48415249434120544c532052534120526f6f742043412032303231301e170d3231303231393130353533385a170d3435303231333130353533375a306c310b300906035504061302475231373035060355040a0c2e48656c6c656e69632041636164656d696320616e6420526573656172636820496e737469747574696f6e732043413124302206035504030c1b48415249434120544c532052534120526f6f74204341203230323130820222300d06092a864886f70d01010105000382020f003082020a02820201008bc2e7af659b056796c90d24b9d00e64fccee224182c847f7751cb041136b85eed6971a79ee425099767c147c2cf911636623d3804e15182ffacd2b469dd2eec11a345ee6b6b3b4cbf8c8da41e9d11b9e938f97a0e0c98e2231dd14e63d4e7b84144fb6baf6bda1fd3c591885ba48992d181e68c3958a0d66943a9ad9852586edb0afb6bcf68fae3a45e3a45739807ea5f0272de0ca5b39faea91db71db3fc8a59e76e7265adf530942307f382164b35989c53bb2fcae45ad9c78d1dfc9899fb2ca4826bf02a1f8e0b5f715c5cae427b298981cb03a399ca889e0b40094133dbe6587afdae9970c05a0fd61386712f7669fc90dddb2d6ed1f29bf51a6b9e6f158c7af04b28a0223880246c36a43bf23091f37813cfc13f35abf11d1123b543229e0192b71802e511d182db1500cc6137c12a7c9ae1d0bab35046ee82ac9d31f8fb23e203004870a3092679155360f3385cad38ea81006314b9335edd0bdba045071a3309f84db4a702a669f4c2590588658556ae4bcbe0de3c7d2d1ac8e9fb1fa3614ad62a13ad774c1a189b910f58d80654c597f8aa3f208aa685a677f6a6fc1ce2ee6e94332a8350840ae54f86f85045780081eb5b68e3268dcc7b5c51f4142c40be1a601d7a72611d1f632d88aacea2459008fc6bbeb3502a5afda8481846d6904092900a845e6831f8ebed0dd31dc67d9918555627652e8d45c524eccee30203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140a4823a660a4920a33ea935bc557ea254dbd12ee300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201003e9048aa6e621525667b0cd58c8b899dd7ed4e07ef9cd0145f5e50bd689690a41411aa686d0935394009daf4092c34a57b598449299774c8071e476df2ce1c5026e39e3d40533ff77f967610c546a5d0204b50f4353b18f4556a411b4706683cbb090862d95f5542aaac5385ac95563656abe4058cc5a8da1fa369bd530fc4ffdccae37ef24c888647461af300f58091a2dc4342949b20f0d1cdb2eb2c53c253784a4f0494419a8f2732c1e54919bff1f2c28ba80a393128b47d62362c4dec1f33b67e776d7e50f09f0ed7118fcf18c5e327fe26ef059dcfcf37c5d07bda3bb016840c3a93d6be17db0f3e0e197809c7a90272224bf73776ba75c485035a63d5b17505c2b9bd94ad8c1599a7937df6c5f3aa74cf0485949800f4e2f9ca2465bfe062afc8c5fab2c99e5648da79fd967615bea38e56c4b334fcbe47f4c1b4a8fcd5308868eecbaec963c476beac3818e15e5ccfae3a2251ebd18bb3f32b33075487fab4b2137bba530462019df1c04feee13ad48b2010fa0257e6efc10bb790469c19298cdc6fa04a696994b72465a0ffac3fce01fb212efd68f89bf2a5cf31385c15aae69700c1df5aa5a739aae9847f3c51a83ad9945b8cbf4f0871e5dba85cd4d2a6fe00a3c616c70fe880ce1c2864741908d342e3ce005d7fb1dc13b0e105cbd120aa86749e39e791fdff5bd6f7ada62f030b6de35754eb7653188d1198ba astrozabal.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\022D0582FA88CE140C0679DE7F1410E945D7A56D\Blob = 190000000100000010000000c86502c60cbe9a28cd602fdd632da3bd0f00000001000000200000002f7265a1d1385e1decf7419f774976c48609c250c025d3aa5d73c3f9efc845fe0b0000000100000038000000480041005200490043004100200054004c0053002000520053004100200052006f006f007400200043004100200032003000320031000000620000000100000020000000d95d0e8eda79525bf9beb11b14d2100d3294985f0c62d9fabd9cd999eccb7b1d53000000010000001f000000301d301b060567810c010130123010060a2b0601040182373c0101030200c0090000000100000016000000301406082b0601050507030206082b060105050703011400000001000000140000000a4823a660a4920a33ea935bc557ea254dbd12ee1d00000001000000100000007fd52fb9e073588a3e1099811be860a8030000000100000014000000022d0582fa88ce140c0679de7f1410e945d7a56d6b0000000100000020000000d95d0e8eda79525bf9beb11b14d2100d3294985f0c62d9fabd9cd999eccb7b1d2000000001000000a8050000308205a43082038ca003020102021039ca931cef43f3c68e93c7f46489387e300d06092a864886f70d01010b0500306c310b300906035504061302475231373035060355040a0c2e48656c6c656e69632041636164656d696320616e6420526573656172636820496e737469747574696f6e732043413124302206035504030c1b48415249434120544c532052534120526f6f742043412032303231301e170d3231303231393130353533385a170d3435303231333130353533375a306c310b300906035504061302475231373035060355040a0c2e48656c6c656e69632041636164656d696320616e6420526573656172636820496e737469747574696f6e732043413124302206035504030c1b48415249434120544c532052534120526f6f74204341203230323130820222300d06092a864886f70d01010105000382020f003082020a02820201008bc2e7af659b056796c90d24b9d00e64fccee224182c847f7751cb041136b85eed6971a79ee425099767c147c2cf911636623d3804e15182ffacd2b469dd2eec11a345ee6b6b3b4cbf8c8da41e9d11b9e938f97a0e0c98e2231dd14e63d4e7b84144fb6baf6bda1fd3c591885ba48992d181e68c3958a0d66943a9ad9852586edb0afb6bcf68fae3a45e3a45739807ea5f0272de0ca5b39faea91db71db3fc8a59e76e7265adf530942307f382164b35989c53bb2fcae45ad9c78d1dfc9899fb2ca4826bf02a1f8e0b5f715c5cae427b298981cb03a399ca889e0b40094133dbe6587afdae9970c05a0fd61386712f7669fc90dddb2d6ed1f29bf51a6b9e6f158c7af04b28a0223880246c36a43bf23091f37813cfc13f35abf11d1123b543229e0192b71802e511d182db1500cc6137c12a7c9ae1d0bab35046ee82ac9d31f8fb23e203004870a3092679155360f3385cad38ea81006314b9335edd0bdba045071a3309f84db4a702a669f4c2590588658556ae4bcbe0de3c7d2d1ac8e9fb1fa3614ad62a13ad774c1a189b910f58d80654c597f8aa3f208aa685a677f6a6fc1ce2ee6e94332a8350840ae54f86f85045780081eb5b68e3268dcc7b5c51f4142c40be1a601d7a72611d1f632d88aacea2459008fc6bbeb3502a5afda8481846d6904092900a845e6831f8ebed0dd31dc67d9918555627652e8d45c524eccee30203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140a4823a660a4920a33ea935bc557ea254dbd12ee300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201003e9048aa6e621525667b0cd58c8b899dd7ed4e07ef9cd0145f5e50bd689690a41411aa686d0935394009daf4092c34a57b598449299774c8071e476df2ce1c5026e39e3d40533ff77f967610c546a5d0204b50f4353b18f4556a411b4706683cbb090862d95f5542aaac5385ac95563656abe4058cc5a8da1fa369bd530fc4ffdccae37ef24c888647461af300f58091a2dc4342949b20f0d1cdb2eb2c53c253784a4f0494419a8f2732c1e54919bff1f2c28ba80a393128b47d62362c4dec1f33b67e776d7e50f09f0ed7118fcf18c5e327fe26ef059dcfcf37c5d07bda3bb016840c3a93d6be17db0f3e0e197809c7a90272224bf73776ba75c485035a63d5b17505c2b9bd94ad8c1599a7937df6c5f3aa74cf0485949800f4e2f9ca2465bfe062afc8c5fab2c99e5648da79fd967615bea38e56c4b334fcbe47f4c1b4a8fcd5308868eecbaec963c476beac3818e15e5ccfae3a2251ebd18bb3f32b33075487fab4b2137bba530462019df1c04feee13ad48b2010fa0257e6efc10bb790469c19298cdc6fa04a696994b72465a0ffac3fce01fb212efd68f89bf2a5cf31385c15aae69700c1df5aa5a739aae9847f3c51a83ad9945b8cbf4f0871e5dba85cd4d2a6fe00a3c616c70fe880ce1c2864741908d342e3ce005d7fb1dc13b0e105cbd120aa86749e39e791fdff5bd6f7ada62f030b6de35754eb7653188d1198ba astrozabal.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\022D0582FA88CE140C0679DE7F1410E945D7A56D\Blob = 5c0000000100000004000000001000006b0000000100000020000000d95d0e8eda79525bf9beb11b14d2100d3294985f0c62d9fabd9cd999eccb7b1d030000000100000014000000022d0582fa88ce140c0679de7f1410e945d7a56d1d00000001000000100000007fd52fb9e073588a3e1099811be860a81400000001000000140000000a4823a660a4920a33ea935bc557ea254dbd12ee090000000100000016000000301406082b0601050507030206082b0601050507030153000000010000001f000000301d301b060567810c010130123010060a2b0601040182373c0101030200c0620000000100000020000000d95d0e8eda79525bf9beb11b14d2100d3294985f0c62d9fabd9cd999eccb7b1d0b0000000100000038000000480041005200490043004100200054004c0053002000520053004100200052006f006f0074002000430041002000320030003200310000000f00000001000000200000002f7265a1d1385e1decf7419f774976c48609c250c025d3aa5d73c3f9efc845fe190000000100000010000000c86502c60cbe9a28cd602fdd632da3bd2000000001000000a8050000308205a43082038ca003020102021039ca931cef43f3c68e93c7f46489387e300d06092a864886f70d01010b0500306c310b300906035504061302475231373035060355040a0c2e48656c6c656e69632041636164656d696320616e6420526573656172636820496e737469747574696f6e732043413124302206035504030c1b48415249434120544c532052534120526f6f742043412032303231301e170d3231303231393130353533385a170d3435303231333130353533375a306c310b300906035504061302475231373035060355040a0c2e48656c6c656e69632041636164656d696320616e6420526573656172636820496e737469747574696f6e732043413124302206035504030c1b48415249434120544c532052534120526f6f74204341203230323130820222300d06092a864886f70d01010105000382020f003082020a02820201008bc2e7af659b056796c90d24b9d00e64fccee224182c847f7751cb041136b85eed6971a79ee425099767c147c2cf911636623d3804e15182ffacd2b469dd2eec11a345ee6b6b3b4cbf8c8da41e9d11b9e938f97a0e0c98e2231dd14e63d4e7b84144fb6baf6bda1fd3c591885ba48992d181e68c3958a0d66943a9ad9852586edb0afb6bcf68fae3a45e3a45739807ea5f0272de0ca5b39faea91db71db3fc8a59e76e7265adf530942307f382164b35989c53bb2fcae45ad9c78d1dfc9899fb2ca4826bf02a1f8e0b5f715c5cae427b298981cb03a399ca889e0b40094133dbe6587afdae9970c05a0fd61386712f7669fc90dddb2d6ed1f29bf51a6b9e6f158c7af04b28a0223880246c36a43bf23091f37813cfc13f35abf11d1123b543229e0192b71802e511d182db1500cc6137c12a7c9ae1d0bab35046ee82ac9d31f8fb23e203004870a3092679155360f3385cad38ea81006314b9335edd0bdba045071a3309f84db4a702a669f4c2590588658556ae4bcbe0de3c7d2d1ac8e9fb1fa3614ad62a13ad774c1a189b910f58d80654c597f8aa3f208aa685a677f6a6fc1ce2ee6e94332a8350840ae54f86f85045780081eb5b68e3268dcc7b5c51f4142c40be1a601d7a72611d1f632d88aacea2459008fc6bbeb3502a5afda8481846d6904092900a845e6831f8ebed0dd31dc67d9918555627652e8d45c524eccee30203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140a4823a660a4920a33ea935bc557ea254dbd12ee300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201003e9048aa6e621525667b0cd58c8b899dd7ed4e07ef9cd0145f5e50bd689690a41411aa686d0935394009daf4092c34a57b598449299774c8071e476df2ce1c5026e39e3d40533ff77f967610c546a5d0204b50f4353b18f4556a411b4706683cbb090862d95f5542aaac5385ac95563656abe4058cc5a8da1fa369bd530fc4ffdccae37ef24c888647461af300f58091a2dc4342949b20f0d1cdb2eb2c53c253784a4f0494419a8f2732c1e54919bff1f2c28ba80a393128b47d62362c4dec1f33b67e776d7e50f09f0ed7118fcf18c5e327fe26ef059dcfcf37c5d07bda3bb016840c3a93d6be17db0f3e0e197809c7a90272224bf73776ba75c485035a63d5b17505c2b9bd94ad8c1599a7937df6c5f3aa74cf0485949800f4e2f9ca2465bfe062afc8c5fab2c99e5648da79fd967615bea38e56c4b334fcbe47f4c1b4a8fcd5308868eecbaec963c476beac3818e15e5ccfae3a2251ebd18bb3f32b33075487fab4b2137bba530462019df1c04feee13ad48b2010fa0257e6efc10bb790469c19298cdc6fa04a696994b72465a0ffac3fce01fb212efd68f89bf2a5cf31385c15aae69700c1df5aa5a739aae9847f3c51a83ad9945b8cbf4f0871e5dba85cd4d2a6fe00a3c616c70fe880ce1c2864741908d342e3ce005d7fb1dc13b0e105cbd120aa86749e39e791fdff5bd6f7ada62f030b6de35754eb7653188d1198ba astrozabal.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 astrozabal.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A astrozabal.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a7e00000001000000080000000080826f22e7dc011d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e77f0000000100000016000000301406082b0601050507030306082b060105050703046200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 astrozabal.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 6b00000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb6580f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb6587f0000000100000016000000301406082b0601050507030306082b06010505070304140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d777e00000001000000080000000080826f22e7dc01030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 astrozabal.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\022D0582FA88CE140C0679DE7F1410E945D7A56D astrozabal.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\022D0582FA88CE140C0679DE7F1410E945D7A56D\Blob = 0f00000001000000200000002f7265a1d1385e1decf7419f774976c48609c250c025d3aa5d73c3f9efc845fe0b0000000100000038000000480041005200490043004100200054004c0053002000520053004100200052006f006f007400200043004100200032003000320031000000620000000100000020000000d95d0e8eda79525bf9beb11b14d2100d3294985f0c62d9fabd9cd999eccb7b1d53000000010000001f000000301d301b060567810c010130123010060a2b0601040182373c0101030200c0090000000100000016000000301406082b0601050507030206082b060105050703011400000001000000140000000a4823a660a4920a33ea935bc557ea254dbd12ee1d00000001000000100000007fd52fb9e073588a3e1099811be860a8030000000100000014000000022d0582fa88ce140c0679de7f1410e945d7a56d2000000001000000a8050000308205a43082038ca003020102021039ca931cef43f3c68e93c7f46489387e300d06092a864886f70d01010b0500306c310b300906035504061302475231373035060355040a0c2e48656c6c656e69632041636164656d696320616e6420526573656172636820496e737469747574696f6e732043413124302206035504030c1b48415249434120544c532052534120526f6f742043412032303231301e170d3231303231393130353533385a170d3435303231333130353533375a306c310b300906035504061302475231373035060355040a0c2e48656c6c656e69632041636164656d696320616e6420526573656172636820496e737469747574696f6e732043413124302206035504030c1b48415249434120544c532052534120526f6f74204341203230323130820222300d06092a864886f70d01010105000382020f003082020a02820201008bc2e7af659b056796c90d24b9d00e64fccee224182c847f7751cb041136b85eed6971a79ee425099767c147c2cf911636623d3804e15182ffacd2b469dd2eec11a345ee6b6b3b4cbf8c8da41e9d11b9e938f97a0e0c98e2231dd14e63d4e7b84144fb6baf6bda1fd3c591885ba48992d181e68c3958a0d66943a9ad9852586edb0afb6bcf68fae3a45e3a45739807ea5f0272de0ca5b39faea91db71db3fc8a59e76e7265adf530942307f382164b35989c53bb2fcae45ad9c78d1dfc9899fb2ca4826bf02a1f8e0b5f715c5cae427b298981cb03a399ca889e0b40094133dbe6587afdae9970c05a0fd61386712f7669fc90dddb2d6ed1f29bf51a6b9e6f158c7af04b28a0223880246c36a43bf23091f37813cfc13f35abf11d1123b543229e0192b71802e511d182db1500cc6137c12a7c9ae1d0bab35046ee82ac9d31f8fb23e203004870a3092679155360f3385cad38ea81006314b9335edd0bdba045071a3309f84db4a702a669f4c2590588658556ae4bcbe0de3c7d2d1ac8e9fb1fa3614ad62a13ad774c1a189b910f58d80654c597f8aa3f208aa685a677f6a6fc1ce2ee6e94332a8350840ae54f86f85045780081eb5b68e3268dcc7b5c51f4142c40be1a601d7a72611d1f632d88aacea2459008fc6bbeb3502a5afda8481846d6904092900a845e6831f8ebed0dd31dc67d9918555627652e8d45c524eccee30203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140a4823a660a4920a33ea935bc557ea254dbd12ee300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201003e9048aa6e621525667b0cd58c8b899dd7ed4e07ef9cd0145f5e50bd689690a41411aa686d0935394009daf4092c34a57b598449299774c8071e476df2ce1c5026e39e3d40533ff77f967610c546a5d0204b50f4353b18f4556a411b4706683cbb090862d95f5542aaac5385ac95563656abe4058cc5a8da1fa369bd530fc4ffdccae37ef24c888647461af300f58091a2dc4342949b20f0d1cdb2eb2c53c253784a4f0494419a8f2732c1e54919bff1f2c28ba80a393128b47d62362c4dec1f33b67e776d7e50f09f0ed7118fcf18c5e327fe26ef059dcfcf37c5d07bda3bb016840c3a93d6be17db0f3e0e197809c7a90272224bf73776ba75c485035a63d5b17505c2b9bd94ad8c1599a7937df6c5f3aa74cf0485949800f4e2f9ca2465bfe062afc8c5fab2c99e5648da79fd967615bea38e56c4b334fcbe47f4c1b4a8fcd5308868eecbaec963c476beac3818e15e5ccfae3a2251ebd18bb3f32b33075487fab4b2137bba530462019df1c04feee13ad48b2010fa0257e6efc10bb790469c19298cdc6fa04a696994b72465a0ffac3fce01fb212efd68f89bf2a5cf31385c15aae69700c1df5aa5a739aae9847f3c51a83ad9945b8cbf4f0871e5dba85cd4d2a6fe00a3c616c70fe880ce1c2864741908d342e3ce005d7fb1dc13b0e105cbd120aa86749e39e791fdff5bd6f7ada62f030b6de35754eb7653188d1198ba astrozabal.exe Key created \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280 astrozabal.exe Set value (data) \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280\Blob = 0300000001000000140000009e99a48a9960b14926bb7f3b02e22da2b0ab72801400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191836b000000010000002000000028689b30e4c306aab53b027b29e36ad6dd1dcf4b953994482ca84bdc1ecac9960f00000001000000200000008408d5e5010ab8da67eb33a7d79ace944dd0ac103ae6ead3ff30dec571066b0319000000010000001000000014d4b19434670e6dc091d154abb20edc5c000000010000000400000000080000180000000100000010000000fd960962ac6938e0d4b0769aa1a64e26200000000100000079040000308204753082035da003020102020900a70e4a4c3482b77f300d06092a864886f70d01010b05003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3039303930323030303030305a170d3334303632383137333931365a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a381f03081ed300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183301f0603551d23041830168014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7304f06082b0601050507010104433041301c06082b060105050730018610687474703a2f2f6f2e7373322e75732f302106082b060105050730028615687474703a2f2f782e7373322e75732f782e63657230260603551d1f041f301d301ba019a0178615687474703a2f2f732e7373322e75732f722e63726c30110603551d20040a300830060604551d2000300d06092a864886f70d01010b05000382010100231de38a57ca7de917794cf11e55fdcc536e3e470fdfc655f2b20436ed801f53c45d34286bbec755fc67eacb3f7f90b233cd1b58108202f8f82ff51360d405cef18108c1dda775974f18b96ddef7939108ba7e402cedc1eabb769e3306771d0d087f53dd1b64ab8227f169d54d5eaef4a1c375a758442df23c7098acba69b695777f0f315e2cfca0873a4769f0795ff41454a4955e1178126027ce9fc277ff2353775dbaffea59e7dbcfaf9296ef249a35107a9c91c60e7d99f63f19dff57254e115a907597b83bf522e468cb20064761c48d3d879e86e56ccae2c0390d7193899e4ca09195bff0796b0a87f3449df56a9f7b05fed33ed8c47b730035df4038c astrozabal.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb6587f0000000100000016000000301406082b0601050507030306082b06010505070304140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d777e00000001000000080000000080826f22e7dc01030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 astrozabal.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5052 msedgewebview2.exe 5052 msedgewebview2.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 1348 msedgewebview2.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5524 astrozabal.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 5524 wrote to memory of 1348 5524 astrozabal.exe 89 PID 1348 wrote to memory of 4268 1348 msedgewebview2.exe 90 PID 1348 wrote to memory of 3332 1348 msedgewebview2.exe 91 PID 1348 wrote to memory of 3332 1348 msedgewebview2.exe 91 PID 1348 wrote to memory of 3332 1348 msedgewebview2.exe 91 PID 1348 wrote to memory of 3332 1348 msedgewebview2.exe 91 PID 1348 wrote to memory of 3020 1348 msedgewebview2.exe 92 PID 1348 wrote to memory of 2716 1348 msedgewebview2.exe 93 PID 1348 wrote to memory of 2716 1348 msedgewebview2.exe 93 PID 1348 wrote to memory of 2716 1348 msedgewebview2.exe 93 PID 1348 wrote to memory of 4140 1348 msedgewebview2.exe 94 PID 1348 wrote to memory of 4140 1348 msedgewebview2.exe 94 PID 1348 wrote to memory of 4140 1348 msedgewebview2.exe 94 PID 1348 wrote to memory of 4140 1348 msedgewebview2.exe 94 PID 1348 wrote to memory of 4140 1348 msedgewebview2.exe 94 PID 1348 wrote to memory of 4372 1348 msedgewebview2.exe 99 PID 1348 wrote to memory of 4372 1348 msedgewebview2.exe 99 PID 1348 wrote to memory of 4372 1348 msedgewebview2.exe 99 PID 1348 wrote to memory of 1824 1348 msedgewebview2.exe 100 PID 1348 wrote to memory of 1824 1348 msedgewebview2.exe 100 PID 1348 wrote to memory of 1824 1348 msedgewebview2.exe 100 PID 1348 wrote to memory of 1400 1348 msedgewebview2.exe 101 PID 1348 wrote to memory of 1400 1348 msedgewebview2.exe 101 PID 1348 wrote to memory of 1400 1348 msedgewebview2.exe 101 PID 1348 wrote to memory of 5052 1348 msedgewebview2.exe 102 PID 1348 wrote to memory of 5548 1348 msedgewebview2.exe 103 PID 1348 wrote to memory of 5548 1348 msedgewebview2.exe 103 PID 1348 wrote to memory of 5548 1348 msedgewebview2.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\astrozabal.exe"C:\Users\Admin\AppData\Local\Temp\astrozabal.exe"1⤵
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=astrozabal.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5524.3816.2243362341141217670 /pfhostedapp:50a444c84c5cb3d3554a46a4754ac4e02a29b9872⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView /prefetch:4 /pfhostedapp:50a444c84c5cb3d3554a46a4754ac4e02a29b987 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x168,0x19c,0x7ffe41545fd8,0x7ffe41545fe4,0x7ffe41545ff03⤵PID:4268
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView" --webview-exe-name=astrozabal.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1744 --field-trial-handle=1756,i,14648020412729041223,86708475340205168,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:50a444c84c5cb3d3554a46a4754ac4e02a29b9873⤵PID:3332
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView" --webview-exe-name=astrozabal.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2188 --field-trial-handle=1756,i,14648020412729041223,86708475340205168,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:50a444c84c5cb3d3554a46a4754ac4e02a29b9873⤵PID:3020
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView" --webview-exe-name=astrozabal.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1936 --field-trial-handle=1756,i,14648020412729041223,86708475340205168,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:50a444c84c5cb3d3554a46a4754ac4e02a29b9873⤵PID:2716
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView" --webview-exe-name=astrozabal.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3408 --field-trial-handle=1756,i,14648020412729041223,86708475340205168,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:50a444c84c5cb3d3554a46a4754ac4e02a29b987 /prefetch:13⤵PID:4140
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView" --webview-exe-name=astrozabal.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3728 --field-trial-handle=1756,i,14648020412729041223,86708475340205168,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:50a444c84c5cb3d3554a46a4754ac4e02a29b9873⤵PID:4372
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView" --webview-exe-name=astrozabal.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2064 --field-trial-handle=1756,i,14648020412729041223,86708475340205168,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:50a444c84c5cb3d3554a46a4754ac4e02a29b9873⤵PID:1824
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView" --webview-exe-name=astrozabal.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2064 --field-trial-handle=1756,i,14648020412729041223,86708475340205168,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:50a444c84c5cb3d3554a46a4754ac4e02a29b9873⤵PID:1400
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView" --webview-exe-name=astrozabal.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4568 --field-trial-handle=1756,i,14648020412729041223,86708475340205168,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:50a444c84c5cb3d3554a46a4754ac4e02a29b9873⤵
- Suspicious behavior: EnumeratesProcesses
PID:5052
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView" --webview-exe-name=astrozabal.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4516 --field-trial-handle=1756,i,14648020412729041223,86708475340205168,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:50a444c84c5cb3d3554a46a4754ac4e02a29b9873⤵PID:5548
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5312
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 55fdad8eae81b3a54e8b39973560540d4937025bf05d5455772f146b287a196e
- MD5 e768a8da5dd890f6d332e0543f833076
- SHA1 9445bc9720d4a0b5a82d469f82ded052c84657f3
- SHA512 0e34c02ca1ca67ad4d031bf599d2ad7444ab3542b9443f86bd879b8a44d3d90db467082853bbb56268b456da95468e67b34749e6b41d873015c275ff935415e6
- TLSH T16BD0121732020238C41021731512610D0502C32F420E80035428D55E1A440901A07842
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 7097a33560b191ab4ae56105a2cbe2add6fa8dc2feba0e43c4cdc7b47d284ef5
- MD5 5f36409297db5daee750ed35da19f527
- SHA1 81949ffbe469f2107d4bf5b566abaf2d2da227d8
- SHA512 103fd14d992dce5cad877c938ad21aa5a577a98baf76e1325375439ab9901bf3d1df804a1ef1cf047a893b49a18922e086fc9f7f20ac71c50fce04f3ae492b3e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 288B
- SHA256 b14c39694abc8286c0381d28cd50c80554017e4a7d2ad8aa756cb29256733eba
- MD5 9d17f5863e127036b2ab8905e0b1590a
- SHA1 6d5eb1496d55813d7de05c2be96559a4b9fd2a15
- SHA512 73a2f3e32d6e70a0a7b02cf216a43aecf170cfa5daa910a9d65a41cefa46a1647aef91b00a939844f431a0be8df58b30921f3b0fb25cfb9505d22a785280c8e7
- TLSH T199D0122035485F45D30F9D7015D19B60727C0690027FDFCD97AE4F30D8523566591519
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59bb38.TMP
- Size 48B
- SHA256 025cd820480af077168ab4c0285090582a3226a6e8ca01261f1fb69f984b45f9
- MD5 ed9aa00069d976c3181ffa9259557086
- SHA1 6a4c72ecb636feb5794ebac67c8d61bd4f086ccf
- SHA512 79586ee73b83725d0a9070a214c84ae8b8990267d444385f4c317a38621c70017c3e7e69a47811d134f147fb60d9dcd429f7aef0dd7ed7cf414646d06815c74d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Network\Network Persistent State
- Size 1KB
- SHA256 a1a776c61a8f81da10b58fb19fecc405b6c78cd0c114dfe8eef9a79596b7a97d
- MD5 5c45154c593102421425338047546e3b
- SHA1 634311e36a2157aa2f72898dd3eebab372bb6fc3
- SHA512 a3bd0983f805c1b781b4980f2cb7c922f90c24fe8267a8b9549cb34e6599edc87bb658511dbefb55aeb642610f0b670a0044a3a9f03371654653702b2e47384c
- TLSH T1A321A3A2C2E4C67D894116F477353D17C92D050992283E27CDDAEFAB57D2475E21144F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Network\Network Persistent State~RFe5a7dfb.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Preferences
- Size 6KB
- SHA256 ef8755211e7a33cb7c3cbb12d9a465909e2b6cfc0acae3783698334ed0da4e7b
- MD5 f14ab505b5c00d69b182f906d5c975b7
- SHA1 a49d56b09bac6c4c2010e8944e5e9e105c7cbe09
- SHA512 36274927e2905eb5916e79de14b422b304dc8edb66c6ac351b383a3f9c480245a0a79b4c4574405d7a9aeebeed0723e58a0eb545bbd4ca0ac5f76cb61f367ae8
- SSDEEP 96:stY/dbEqlGcb9xkRyo5h16Z0qs7/x+6MhmuecJQQ1ejeXK+gL28XM1C7K:st8BF7onqsV+FdQQQjhpG6K
- TLSH T1F1D1B7025E24797B4CCBE509BA29BB17D3F9A07261D01E58EBFD952C04DB6DC231790B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Service Worker\CacheStorage\7c0a3bc891327ef5159cf5d251c4e0d2ec0f4c59\0ea31372-9d62-45bc-a295-ad196a44dcec\index
- Size 24B
- SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
- MD5 54cb446f628b2ea4a5bce5769910512e
- SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
- SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Service Worker\CacheStorage\7c0a3bc891327ef5159cf5d251c4e0d2ec0f4c59\0ea31372-9d62-45bc-a295-ad196a44dcec\index-dir\the-real-index
- Size 264B
- SHA256 fcb0d465eec6160ad2d0d899bec993bb0900e0c0592092eff72ef5f085a34ed9
- MD5 48ce2a2795d53fb28cd420c83080b5df
- SHA1 4df559fa781e00228bf48a90ab689c75d15c7c01
- SHA512 4062cb246b1c3579d16428603a07260d89e8c4a8b18444c97e502ee78637bf0ddffd573e8e3494bd68de04732133bd5491c8949a96686f70c24f7e885e208845
- TLSH T1D6D0C01FDC811225C581093802C61E510311BC205E3B0367C5D688DBFBF53E2DC5224E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Service Worker\CacheStorage\7c0a3bc891327ef5159cf5d251c4e0d2ec0f4c59\0ea31372-9d62-45bc-a295-ad196a44dcec\index-dir\the-real-index~RFe59c598.TMP
- Size 48B
- SHA256 fe4b8c6f438080a1fc3fb8a86f4ba99b10c9e9707f23ccee8773e86f8fba9065
- MD5 9eea5f3df6f674e5966675c94e5fd306
- SHA1 ebf2339dcce172696591bf74374649aa95b31615
- SHA512 1aa178c3708f68547bbe471a9fa3b274e31d845ef9d9645f2e143e3c11f81b513e0090f2e0f7a90aba7cac470308dea1950baa7c32c64d35c2bfea03270e5ce6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Service Worker\CacheStorage\7c0a3bc891327ef5159cf5d251c4e0d2ec0f4c59\index.txt
- Size 130B
- SHA256 69ec6c5f6cc67099aa33a7fb2d84f0962e2e92fb8ebe7741f358705cb03f5bd6
- MD5 c79db6138688d415eb83e5e5044e6fc7
- SHA1 0ea7f66a5c17885919478730fcfe98c5d8639b36
- SHA512 d25bd7aa5ccb41286951a472b389ed35cf45620a65ed4c48e1649621469caf52cdcfa35e68e1002889b62367f1f81b505589586478ad4588a57b03617244f375
- TLSH T187C09B8F4BD1D418CD7455E777D48C69854910F5447C28C4F64C4C8852D420D7475359
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Service Worker\CacheStorage\7c0a3bc891327ef5159cf5d251c4e0d2ec0f4c59\index.txt~RFe59c5c7.TMP
- Size 131B
- SHA256 65d0e884ed09f246237906a1cd87d994188961277fbe2e169a5b3a8ddfd7bae1
- MD5 9e61b3262ccfd21e5be5a949b2a806bc
- SHA1 dd31a379ea0a0b792c30acf2421f0d429aa5dd08
- SHA512 11ad8f0ecb7d4559aea71e1f7d96ab7d9e3dcd222dda333babbd1263bee8995a2f45654dfcfcee5d7fc230930c0953955572c74c031e88d840f2746ea2df03de
- TLSH T135C09B4F45919408DA755593B7D48C2989490CF548BD2844F94D7CC891F010E7564354
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 72B
- SHA256 5ae2d666d9c88fc2f1f63e6075cf2c826b050aa5940210cc6d769543cb92ae90
- MD5 835b151c83978b897ba6729097b9d969
- SHA1 9de2515d14055a7ba857084de169b16b6d7f37ef
- SHA512 9f848267812d08e530ac9cdd98e8165fb3a7784ae6cda99cd425eeb6b3f34b98e65469fd793f4b5b8f397252b924e9706d6769048c0d67a9303accfc99b6b560
- TLSH T13BA0023701522252C02606B07C5516C523519D35510637B342D11785DDF36619296350
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59c4dd.TMP
- Size 48B
- SHA256 2ae2c29c45877813ac48bf71ce1bf39c45ff4cac39afa8a54ce3a6a7174d5aa0
- MD5 480fdc68192ede7fb387dd0b12b51b38
- SHA1 84a24364bdcee3d1d9bb0be5ead737fc8d8007a6
- SHA512 170ef30c612b91c7e1de3b89856d7452c497895b499837bf79e07deb8111f6a9804939121377b9108e98d9da4100f26d975e87c919d4a204bc83c23e06ee1e51
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Site Characteristics Database\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Default\f30bd9fa-38d9-49a5-ae22-5fd6b19863af.tmp
- Size 6KB
- SHA256 be9206c93c972b6c992c230b608c185b3028db3e166f682ad418ecd8e7e63da0
- MD5 79be280d76fcf5bb4b5afeeff40238f8
- SHA1 94ea7c5f0beeec266e895cf2ed01dc6ff5d10be7
- SHA512 51090726c4158f5e3b0137b7f41e3e27eecba1ab68eb2321769d6c8a625f76203a053f68b696301a003fe2515bd695c1cf8de1f7d6e8de938012062b12cf5900
- SSDEEP 96:stY/dbEq+cb9xkRyo5h16Z0qs7/x+6MhmuecJQQ1ejeXK+gR28XM1C7K:st8B77onqsV+FdQQQjh7G6K
- TLSH T18BD1B7015E24797B4CCEE509BA29BB17D2F9A07270D11E58EBFD962C04DB5DC231790B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\GraphiteDawnCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\GraphiteDawnCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\GraphiteDawnCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\GraphiteDawnCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Local State
- Size 15KB
- SHA256 6954e34e00f94b806565b2b702236388f44a66fe9b2f2020ac80f16e03023da0
- MD5 94ab8fa378054204754ca9b22b6d7705
- SHA1 9f707ac440a0f31017663c61f681820b07098f00
- SHA512 258427841370493d310fb3ce509dcf6668f72c90785a40dacb4d1b9aa44e6f1fcffe23eebe2c5d85449160360235dfcebf3bfd2cc5e962531f318065e4d90e5b
- SSDEEP 384:I+aQikB+z/xvxjg/qhEwNBSHGi6NjAVdpdqP9zs:H/UxvxjgC+fF0jUdqPFs
- TLSH T17D72AE2755297E33A5FBEA057D5D1B9BCBB8C4B250C16EB48AADAF0D06C72981302C16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Local State
- Size 2KB
- SHA256 907dfb4e284d7c21fbd3ce90a68463d7c61cdfd7525051f3f276416b7aafc75f
- MD5 739d234dce7cb626b7a3c87a7d20f6dd
- SHA1 65ec230a6486dc0e04e4098f932c54be5c5f578b
- SHA512 305f2abc492026f722d4b860c54592ab5a0059098c7e6c8e746e50e2c38778cee889d79ba874f43d90d9395f1972084704b8475ba04d81237c886f225cb09e60
- TLSH T1ED51957368149B3799EB4B05794A3E72CE39906195612F61E7DD6F1C00C715C2351C37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Local State
- Size 3KB
- SHA256 4b917ebb64a955c1444634a762b892d650d31ceb471360d099217968de591829
- MD5 e08385e75c6d1f6db03fd3db5c0353cc
- SHA1 41c23ff8ef6b754853d5308c31513ca855e9b499
- SHA512 9424f38129089544cd010478d9a9bfc5c2dd8d9cfda2a5020caa626828d8a09b7eac51e51eb0cf3c2f91ab39a181769e83a9d01f6813834776510207e8096cc7
- TLSH T1B361B8336934AA374DFB8E05B8863B26E7699033E4953FA1D6EC2F0C01C72881351C27
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.astrozabal.app\EBWebView\Local State~RFe596920.TMP
- Size 1KB
- SHA256 863501cd7c7cde45a43b3004e1033b0a8288021fa5bcdd9e9d0bb859b874f093
- MD5 f8589d03245bdb7768671c6ca11a9b25
- SHA1 fa6bef2e6a39199094505d7a54c57b3c179c1a58
- SHA512 0b3f034a9f4bfe7c45a2c87e6e0c9bc58aa45bdfee97cff422b71c13d027ba3981e2583ce0756c95e8ad4c1ba2470826709322028ad0436c1afb82295ecf4f5b
- TLSH T1412172B3A1245B32AC9A5747710A7A679E24507A81514E10F2DE9B1C01D714C953AC33
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-bn.hyb
- Size 703B
- SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
- MD5 8961fdd3db036dd43002659a4e4a7365
- SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
- SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
- TLSH T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-mr.hyb
- Size 687B
- SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
- MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
- SHA1 d0914fb069469d47a36d339ca70164253fccf022
- SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
- TLSH T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1348_737750562\hyph-nn.hyb
- Size 141KB
- SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
- MD5 f2d8fe158d5361fc1d4b794a7255835a
- SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
- SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
- SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
- TLSH T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
- MD5 SHA1 SHA512 SSDEEP TLSH