2e4342fc1117141b6f3d6366d9a64ae3a57683af202bfad0e90f3ae11839eb19

Analysis

user interaction
yes
max time kernel
50s
max time network
52s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AstroCommandCenter.msi
Size 12.2MB
Sample260826-wlevsshk3z
SHA256 2e4342fc1117141b6f3d6366d9a64ae3a57683af202bfad0e90f3ae11839eb19
MD5 b68abbb3094c91521db24a60a750618b
SHA1 0181256a2c8840ff05961c6221fbe73d4191a6bb
SHA512 b18498e20ddfeac5dc7488394884751f893b2f281a5838d40411414f3c8e1c894b43e62c166caf621d8aa3daeafa6b6bc38d5139ad1c1ed855f3e646eccaf966
SSDEEP 393216:a27s9vyhLVYck1RITtrsGuMOyha+wIGs:ah9vuKc0IfOylwIG
TLSH
T16BD612359A96D526C36ACB78DC2FF7000B79FD1C5F2DD83099EA76BA96B46C42483403
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4512	ASTRO Command Center.exe
2784	ASTRO Command Center.exe

Loads dropped DLL 18 IoCs

pid	Process
1384	MsiExec.exe
4512	ASTRO Command Center.exe
4512	ASTRO Command Center.exe
4512	ASTRO Command Center.exe
4512	ASTRO Command Center.exe
4512	ASTRO Command Center.exe
4512	ASTRO Command Center.exe
2784	ASTRO Command Center.exe
2784	ASTRO Command Center.exe
2784	ASTRO Command Center.exe
2784	ASTRO Command Center.exe
2784	ASTRO Command Center.exe
2784	ASTRO Command Center.exe
4512	ASTRO Command Center.exe
2784	ASTRO Command Center.exe
2784	ASTRO Command Center.exe
2784	ASTRO Command Center.exe
2784	ASTRO Command Center.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	3664	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in Program Files directory 36 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A50 Wireless\Astro EQ\STUDIO.astroeq	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\Qt5Gui.dll	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\Qt5Widgets.dll	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A50 Wireless\Astro EQ\MEDIA.astroeq	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A50 Wireless\Astro EQ\ASTRO.astroeq	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\Qt5Xml.dll	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro MixAmp Pro TR\Astro EQ\TOURNAMENT.astroeq	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro MixAmp Pro TR\Astro EQ\ASTRO.astroeq	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\qt.conf	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro MixAmp Pro TR\Astro EQ\BALANCED.astroeq	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A20 Wireless\Astro EQ\PRO.astroeq	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A20 Wireless\Astro EQ\ASTRO.astroeq	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\libeay32.dll	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\qtplugins\platforms\qwindows.dll	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro MixAmp Pro TR\Astro Profiles\ASTRO_Default_MixAmp_Pro_TR.agp	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A50 Wireless (Mimas)\Astro EQ\STUDIO.astroeq	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A50 Wireless (Mimas)\Astro EQ\A50 MOD KIT.astroeq	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A20 Wireless\Astro EQ\STUDIO.astroeq	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A20 Wireless\Astro Profiles\Astro_A20_Wireless_default_profile.agp	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\libssl32.dll	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\ASTRO Command Center.exe	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\qtplugins\imageformats\qico.dll	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\qtplugins\iconengines\qsvgicon.dll	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\Qt5Network.dll	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\quazip.dll	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\ssleay32.dll	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A50 Wireless (Mimas)\Astro EQ\MEDIA.astroeq	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\forced_fw\mimas_190705151435_tm-35155_tr-43_rm-34843_rr-43.afw	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro MixAmp Pro TR\Astro EQ\NATURAL BASS.astroeq	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A50 Wireless\Astro EQ\A50 MOD KIT.astroeq	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A50 Wireless\Astro EQ\PRO.astroeq	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\qtplugins\imageformats\qsvg.dll	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\Qt5Core.dll	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\Qt5Svg.dll	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A50 Wireless (Mimas)\Astro EQ\PRO.astroeq	msiexec.exe
File created	C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A50 Wireless (Mimas)\Astro EQ\ASTRO.astroeq	msiexec.exe

Drops file in Windows directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2A7706F16B1EB014E8737E5B6B5D6770\1.0.226\msvcp140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2A7706F16B1EB014E8737E5B6B5D6770\1.0.226\msvcp140_2.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2A7706F16B1EB014E8737E5B6B5D6770\1.0.226\vccorlib140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File created	C:\Windows\Installer\e59ab9a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59ab98.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB3A6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2A7706F16B1EB014E8737E5B6B5D6770\1.0.226	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2A7706F16B1EB014E8737E5B6B5D6770\1.0.226\concrt140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2A7706F16B1EB014E8737E5B6B5D6770\1.0.226\vcruntime140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File created	C:\Windows\Installer\{1F6077A2-E1B6-410B-8E37-E7B5B6D57607}\ProgramIcon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{1F6077A2-E1B6-410B-8E37-E7B5B6D57607}\ProgramIcon.ico	msiexec.exe
File created	C:\Windows\SystemTemp\~DF484A68E31CEA9983.TMP	msiexec.exe
File created	C:\Windows\Installer\e59ab98.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1F6077A2-E1B6-410B-8E37-E7B5B6D57607}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAD07E0B057CE17EB.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2A7706F16B1EB014E8737E5B6B5D6770\1.0.226\concrt140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2A7706F16B1EB014E8737E5B6B5D6770\1.0.226\msvcp140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2A7706F16B1EB014E8737E5B6B5D6770\1.0.226\vccorlib140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2A7706F16B1EB014E8737E5B6B5D6770\1.0.226\vcruntime140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2A7706F16B1EB014E8737E5B6B5D6770	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2A7706F16B1EB014E8737E5B6B5D6770\1.0.226\msvcp140_1.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2A7706F16B1EB014E8737E5B6B5D6770\1.0.226\msvcp140_1.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2A7706F16B1EB014E8737E5B6B5D6770\1.0.226\msvcp140_2.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4F342B176B225533.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD57BDACFF19567A5.TMP	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3664	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ASTRO Command Center.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ASTRO Command Center.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770\ProductIcon = "C:\\Windows\\Installer\\{1F6077A2-E1B6-410B-8E37-E7B5B6D57607}\\ProgramIcon.ico"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2A7706F16B1EB014E8737E5B6B5D6770\ProductFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2A7706F16B1EB014E8737E5B6B5D6770\VCRedistRelease	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2A7706F16B1EB014E8737E5B6B5D6770	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770\PackageCode = "8D0A275532114CB45AAF96D07F54472A"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770\Version = "16777442"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FE3BCEAD0CAB31C4D957678A3D29F91B\2A7706F16B1EB014E8737E5B6B5D6770	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770\ProductName = "ASTRO Command Center"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FE3BCEAD0CAB31C4D957678A3D29F91B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770\SourceList\PackageName = "AstroCommandCenter.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2A7706F16B1EB014E8737E5B6B5D6770\Language = "1033"	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2784	ASTRO Command Center.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1412	msiexec.exe
1412	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2784	ASTRO Command Center.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3664	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3664	msiexec.exe
Token: SeSecurityPrivilege	1412	msiexec.exe
Token: SeCreateTokenPrivilege	3664	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3664	msiexec.exe
Token: SeLockMemoryPrivilege	3664	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3664	msiexec.exe
Token: SeMachineAccountPrivilege	3664	msiexec.exe
Token: SeTcbPrivilege	3664	msiexec.exe
Token: SeSecurityPrivilege	3664	msiexec.exe
Token: SeTakeOwnershipPrivilege	3664	msiexec.exe
Token: SeLoadDriverPrivilege	3664	msiexec.exe
Token: SeSystemProfilePrivilege	3664	msiexec.exe
Token: SeSystemtimePrivilege	3664	msiexec.exe
Token: SeProfSingleProcessPrivilege	3664	msiexec.exe
Token: SeIncBasePriorityPrivilege	3664	msiexec.exe
Token: SeCreatePagefilePrivilege	3664	msiexec.exe
Token: SeCreatePermanentPrivilege	3664	msiexec.exe
Token: SeBackupPrivilege	3664	msiexec.exe
Token: SeRestorePrivilege	3664	msiexec.exe
Token: SeShutdownPrivilege	3664	msiexec.exe
Token: SeDebugPrivilege	3664	msiexec.exe
Token: SeAuditPrivilege	3664	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3664	msiexec.exe
Token: SeChangeNotifyPrivilege	3664	msiexec.exe
Token: SeRemoteShutdownPrivilege	3664	msiexec.exe
Token: SeUndockPrivilege	3664	msiexec.exe
Token: SeSyncAgentPrivilege	3664	msiexec.exe
Token: SeEnableDelegationPrivilege	3664	msiexec.exe
Token: SeManageVolumePrivilege	3664	msiexec.exe
Token: SeImpersonatePrivilege	3664	msiexec.exe
Token: SeCreateGlobalPrivilege	3664	msiexec.exe
Token: SeCreateTokenPrivilege	3664	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3664	msiexec.exe
Token: SeLockMemoryPrivilege	3664	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3664	msiexec.exe
Token: SeMachineAccountPrivilege	3664	msiexec.exe
Token: SeTcbPrivilege	3664	msiexec.exe
Token: SeSecurityPrivilege	3664	msiexec.exe
Token: SeTakeOwnershipPrivilege	3664	msiexec.exe
Token: SeLoadDriverPrivilege	3664	msiexec.exe
Token: SeSystemProfilePrivilege	3664	msiexec.exe
Token: SeSystemtimePrivilege	3664	msiexec.exe
Token: SeProfSingleProcessPrivilege	3664	msiexec.exe
Token: SeIncBasePriorityPrivilege	3664	msiexec.exe
Token: SeCreatePagefilePrivilege	3664	msiexec.exe
Token: SeCreatePermanentPrivilege	3664	msiexec.exe
Token: SeBackupPrivilege	3664	msiexec.exe
Token: SeRestorePrivilege	3664	msiexec.exe
Token: SeShutdownPrivilege	3664	msiexec.exe
Token: SeDebugPrivilege	3664	msiexec.exe
Token: SeAuditPrivilege	3664	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3664	msiexec.exe
Token: SeChangeNotifyPrivilege	3664	msiexec.exe
Token: SeRemoteShutdownPrivilege	3664	msiexec.exe
Token: SeUndockPrivilege	3664	msiexec.exe
Token: SeSyncAgentPrivilege	3664	msiexec.exe
Token: SeEnableDelegationPrivilege	3664	msiexec.exe
Token: SeManageVolumePrivilege	3664	msiexec.exe
Token: SeImpersonatePrivilege	3664	msiexec.exe
Token: SeCreateGlobalPrivilege	3664	msiexec.exe
Token: SeCreateTokenPrivilege	3664	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3664	msiexec.exe
Token: SeLockMemoryPrivilege	3664	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3664	msiexec.exe
3664	msiexec.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3664	msiexec.exe
1412	msiexec.exe
1384	MsiExec.exe
2784	ASTRO Command Center.exe
2784	ASTRO Command Center.exe
2784	ASTRO Command Center.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 1384	1412	msiexec.exe	90
PID 1412 wrote to memory of 4216	1412	msiexec.exe	95
PID 1412 wrote to memory of 4512	1412	msiexec.exe	97

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\AstroCommandCenter.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3664

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 79D0BCAF886417B2544EB962CEDA9950 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1384
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4216
- C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\ASTRO Command Center.exe
  "C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\ASTRO Command Center.exe" -show
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4512

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3852

C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\ASTRO Command Center.exe
"C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\ASTRO Command Center.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59ab99.rbs

Path C:\Config.Msi\e59ab99.rbs
Size 22KB
SHA256 a8fd6c4401d73a66a93b40f55e830d4575681fabd2e5fb2d81c8b506030408ff
MD5 c008032b5df4d8767a60c18c06b5fbc3
SHA1 3c5a95221f609ecd701de6cbd604998dab0ac652
SHA512 09b92079fd327bd9ed4eda2f79e7c1d96b5bfa1c6135adb38fe5e9e61b612cb1cc42ed99790a3637b3ceaf7761af218da5341df964d5557f71c81855e49b0698
SSDEEP 384:FUuHwE0YWA9RClRnPsd3Eu3SSYbcaID/DvCuCd:FUSNCXnPsd3EuCSYbcaIbOuA
TLSH
T1E3A23543298282F6F8D355B1BBD30F2533B25F70936E061F0ADC297A7D87B862671295
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ASTRO Command Center.exe

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\ASTRO Command Center.exe
Size 2.8MB
SHA256 991e558129af98765cba4f02b10fa5cc4d537e2b6bb4bd3032ca010832eb2dcf
MD5 c0e64bd79e071c17ee1246180eb4b373
SHA1 e0808d7755d13563e212d927d6f36b8c07984c3d
SHA512 859de816b14cd6af94defffb315eadde1886ec67ee1db62bc3f90635a127b9ae8c06bda28c257860547ff68a238ddc16169888da45bb538945d35eaf6fc4ad4b
SSDEEP 49152:8qmYxHOi7v8Ow/Zs1h5e+ZHkJcLbVL/sU6Zj:7mYxH52Zs1h0+DLbqU
TLSH
T18FD56C312E5AC426D32693B99C6FFBA1872DBD0E0F18A8F3B4ED356A57745C11DA2013
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Core.dll

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\Qt5Core.dll
Size 5.1MB
SHA256 b967ade09a9338320e0db4e5da11a2ac396950f0eed689b28bd31686b7baf018
MD5 b517914bd1779b312611b5a52b0ef24a
SHA1 5d7ee138e70eca65d35a76bd2285453a764daaf6
SHA512 cab8a6a8b4c8eca738348812e530e5b186a88a08f65949753e6bdcc3c7bf1ffa79fa48ae718be4173b14ca4a3b6fbb0af240c800fbd426989d8a0ae7646425f5
SSDEEP 98304:53QkIHj14FdDhqJsv6tWKFdu9CjzHveRnZyxEdm4:5gdnJsv6tWKFdu9CjzHeH
TLSH
T196369E917F978176E5A2D270C87B671F4029E9024B1245CBD3DC360A9A79AE13F3B70B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Gui.dll

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\Qt5Gui.dll
Size 5.7MB
SHA256 ab160992f30dc69b97feedd2fcaf7528a56fc98a3f30a166c1076589340ac8be
MD5 c4a857dee5656921baba1e19d2b099b6
SHA1 7e3e634d5b2f101ea2838ec2c13158113ce33e62
SHA512 8456610a8d84606ec5784dca12b1ed34ceee6e7c716871db4165fc0ca9042fae097fe0c37afb645eab860cd09d1d559fe6a8040a980387ef425d9af366441e53
SSDEEP 98304:+8oNJzx4w24LwWotu+PNlwL9PmEZ23CeG:kBbUuCPwNj2Cb
TLSH
T1DE563BD1B1827173C9A2D2BE670F663F9077A956C34483C38699AF8554703FA0F7BA06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Network.dll

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\Qt5Network.dll
Size 1.1MB
SHA256 ddc9894e36231d749265155ba02f2d70ec5e006cea34010750b220ce49ce391a
MD5 a00d38af148cc8a6481ef182f86b77ed
SHA1 76b401ee60ca094d3da04524401e5d6eb80d3bb6
SHA512 0bfc7d1ad67d8ba837a76f91876ab4cf452712017d0698bdc4e4c6496b084829bd03d93f76ab6a9bc0793b8ba1216fef9de927b849842ed362e135715ef5b9fd
SSDEEP 24576:TNfY4/b8d22Gmou3ZjRkjZgUPiV69DrOMxpqDc0EGQVzKa+:7Ad22GrziVaSDckf
TLSH
T1CC355B62F38304F2F88951B5891ABF7BCA3BB214471656C7EA0C6EC6D9917C1193F1CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Svg.dll

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\Qt5Svg.dll
Size 265KB
SHA256 50d06d42a71101e6fb7589676a67a0d763f39fe66dddf3d036b08aeaaf5dc71e
MD5 0e8c3d38a0a28a3de3dab77da32d412a
SHA1 714b244a8cd86cb25eb7245ffe122582013a092f
SHA512 1ce342cce2c0987d4b8677fd466e783978336bc6cc1519a86a52846a752e2a3d7b45ddc00a02847f49e08b4bb231be29aa1e7fdab7a050cc165605ee9ebc28fc
SSDEEP 6144:O4II9g1KI2MdfiJl/13VytiQ8y8DvEt/Q7FYxyFUUv6Wa32VXxWFaHKXh:OP/V6Jd7LKR
TLSH
T1F0444A52B2430DA1D68DE378785F2B2BDA3AA14203798FEBC2999C2179253F05DF7345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Widgets.dll

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\Qt5Widgets.dll
Size 4.4MB
SHA256 4a12866260ff266eeffe0b4d8eaf27ed064682f00e8907bd53956f446e23c496
MD5 eb4aea9ff7c75da2a4925e83f8defe3e
SHA1 efa4566fb9e7a4de722a177956dff0f43d88638a
SHA512 42fb74b3a1e08e2652c8a0459eb04e3b21446f82be4c07736a08d2d20f681781201154c9e48dadd55118c8ed2b53e324ef1708e36e169458ddaa57d21d6a4cd3
SSDEEP 98304:n1CmFlF05UMNO1ulAjhDfTbz7quDp+bXa6gYzdkSPD1UZlH6uV75uDdHBclxooGJ:Rf59iJ5n
TLSH
T136267D93F6C242B1D8D6C178495F6B63CA36B0CB4B9552E7D38DEF4664202E02E7F246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Xml.dll

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\Qt5Xml.dll
Size 150KB
SHA256 398f670ea5dc065e7796346bca1c2ad5d2c01b1325a93e82ef921f5f36769d06
MD5 d2ec84fdfea3f694a3b8415e1dc61ad2
SHA1 511fa6f7e2e3d9596542f91cd297eacec75f499b
SHA512 deaa75577c7e2553f16499977d170831ca87a140bb0d7a1ea515f2c6df0372c180acf416aee720123351e8eb71c534585bb509c13b073ba332141b643b60ad8f
SSDEEP 3072:TcxDXrgrVb0x+ULoJ0yDqM8NlJ0cJnIGUAH22lt54kxzEs:gxDXrgxb0AHqyD6lnXt54k1
TLSH
T1BAE319F2726542A2F0B382341C5F5A3EEA7FE91C43B542D3E35D6D2389246E15E3B246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ASTRO.astroeq

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A20 Wireless\Astro EQ\ASTRO.astroeq
Size 257B
SHA256 d19a8df35ab05a9f6b1653986ea454f9308f9305b80d22d7294af3baba6ce590
MD5 74ed038bf1561cead10d247658ed5a7b
SHA1 7df3470bf18f6e75c176c121bde9b2b6a3e332a2
SHA512 06d1b58d3de257a0112a92d35ffdde2f01748182cff96cc1da7da082e051dedaab9d951d23dec8a763631eca13c26742b1050b5e18b192ad11a5d769951d65b2
TLSH
T16DD0928A440A905CDACF68FC9C21DCC901A1ACA56FDBDB35506BB11E3E90F5110D8085
MD5 SHA1 SHA512 TLSH

Submit Download

STUDIO.astroeq

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A20 Wireless\Astro EQ\STUDIO.astroeq
Size 259B
SHA256 4793f9cfd1727aa2f58dd21d2c3d73b6fbe287c704bc4a975e78bd60d0d6a62f
MD5 d50f1e9df1b08bb84a682683910350ba
SHA1 05e04e2687effc7754924fadc1cbd586773fd474
SHA512 c65a9281767c4549e492e5b9cdcd4e0b0e7c0602107681866c65956063672fc8520095399dc75e718e55048c8f9480c66493af65d27dc37f77fdd7b6bfe7846f
TLSH
T1F8D0928A042A91ACC58E15F88C00DDD915919CAAAFCFC7B5806FB1093ED8E6100ED845
MD5 SHA1 SHA512 TLSH

Submit Download

Astro_A20_Wireless_default_profile.agp

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A20 Wireless\Astro Profiles\Astro_A20_Wireless_default_profile.agp
Size 1KB
SHA256 a8d230a3bb890696212749dc1a8ded5ce5ea6cf3edc00d6ce366db4c57c2f607
MD5 6c452236d81d531e20edf370ef2c7b02
SHA1 92b9f5eeac0e7be162837e1994b9b540f3ceb76e
SHA512 3e953e24e250fc85baad32d2ea9227672bed1a985802d9a565660a87c5504686a35d1991d617128a9d05006a63c4eeb365b65e54832483d93b394e967b5ce5b0
TLSH
T14D31A2854C8A907ACF9FF2F44A16C68D88A074D457CA873343F7B58E95A0DE71398D42
MD5 SHA1 SHA512 TLSH

Submit Download

A50 MOD KIT.astroeq

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A50 Wireless (Mimas)\Astro EQ\A50 MOD KIT.astroeq
Size 275B
SHA256 4d85e0bc052c25e30d83f6fe13618594c8cbb1bccb66d8916c238ba3882e39e3
MD5 f4c24b12294f030c1afe8019c5371374
SHA1 6b24679f345377bc8f3cd286fd36ad8010b10ef4
SHA512 64ff556ca57f6c0655fd9f720191327fe36e95c342251b19cb8919d1c0d0c50897ea34bf499e85ebf522ae38eb40395a234f1918f14f338e584210ad01874433
TLSH
T17AD0928A855F917CD9CF18F08D10DCCD0690AC269BDBE77490ABB53937A1F9110ED081
MD5 SHA1 SHA512 TLSH

Submit Download

A50 MOD KIT.astroeq

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A50 Wireless\Astro EQ\A50 MOD KIT.astroeq
Size 268B
SHA256 9b95bf57573bfede771cd463dd2f4488c8ae93a0fad44f62d642d1c4903fc15b
MD5 8fe09ee8c59179e8800076b838aac24e
SHA1 bb369ff11f8085ddd496eb0559c8c88840ac0a5f
SHA512 12e20c9ddb570a7b360d26ae2a3a9efb994c30dba08296faf7186302005565137610827dc44384fc938049f1b5e9c6033b9b0a5b6e775c97f6d64498fa053f09
TLSH
T108D0C986455E857CC9CF14F89C50CCCD05919C624FDFC7B5916BB51E3AC1F5210E8054
MD5 SHA1 SHA512 TLSH

Submit Download

ASTRO.astroeq

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A50 Wireless\Astro EQ\ASTRO.astroeq
Size 258B
SHA256 6c6a1bd6098e389b978d5751aaf8ca233c12811e5fcf1b05e8edc9085e049264
MD5 a4ec82ffb0baf3ff721f750bc267caee
SHA1 35e181df8afacb462a41a7349867caf5433c7d1d
SHA512 41354cae528f63c5d16897035622b07f11fd73da86019056d945b3117aa5817aeef831aed5d791831d5ebf7a585c3a7749a8f3c072271775036a3bc693c25941
TLSH
T1F7D0928A042AA1ACC98F15FD8C01DDC915919CA9AFCFC7B4806FB1093AD8E5110DD845
MD5 SHA1 SHA512 TLSH

Submit Download

MEDIA.astroeq

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A50 Wireless\Astro EQ\MEDIA.astroeq
Size 260B
SHA256 d1156ecfdeff0f9b199da73b3877cef824bebeb0a73107a3c6df86d45ec0c799
MD5 8584d442ee006bd720c42e346f08f0d5
SHA1 c1f5bf00c72a3fd6c4eb26dab8fe2769590ba55d
SHA512 3397b251cf013603721f9c2f53916916a67934d6f02146b815dfc61ea30d5d6dba6ad014e0eccfb11b7b5139f9f72865cad93e25c055492f8174433f621b9062
TLSH
T18AD0928A091B50A8C98F15FC8C11EDD901A09C66AFCBC735512BB5197BE1F5110E8041
MD5 SHA1 SHA512 TLSH

Submit Download

PRO.astroeq

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A50 Wireless\Astro EQ\PRO.astroeq
Size 259B
SHA256 5da2890323ce3d7bb0fd05aa998e5128e8571be0338c57462a4eb7ec841cca24
MD5 3c4e408a75ca1fe1d2f66d88a7efede9
SHA1 e6d217b94fbedceca803b5e6151c5f0c60ec7d98
SHA512 e7f8e54e85027ec7120125227d70cbfb85abd748c83182a3bdf9462b817fab921a46616cb0b3e21ec5287abfd37fcf362590138a3fc1bb425482c59785c64d49
TLSH
T151D0928A051E90ACC8CF05FC8C41DCCA01919C6AAFCBD775516BB51C7AD1F5210E8081
MD5 SHA1 SHA512 TLSH

Submit Download

STUDIO.astroeq

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro A50 Wireless\Astro EQ\STUDIO.astroeq
Size 258B
SHA256 e7779509dce27f5a4198271753915af7ab19ef69e8ae36d70ec4a6a7cdb671a2
MD5 d1534fc240dc3a9818b3e160f423dcc7
SHA1 c8e83b222aa0a0ed988ff259c0547ba11e98808b
SHA512 a704f6c06c40b1ffeb9b29fa431293f2363b9561068333aad3ecf1fdce9972a5b5fa9c746b11ad4ed2862296d70eab2b8ba6b9da5799cfc10527dd620ae8da5a
TLSH
T16ED0C98A440A904CDA8F54FC9C21ECCA01E09CA96FDFDB35506FF11D7DD0F5210E8085
MD5 SHA1 SHA512 TLSH

Submit Download

ASTRO.astroeq

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro MixAmp Pro TR\Astro EQ\ASTRO.astroeq
Size 261B
SHA256 41284d782467bcbc483dfee9ea12fc97fe8f38c2e5dfb47aa7162fffe5645d9c
MD5 9ab341e4dedebced907846c05313d7af
SHA1 c9f2a435f5068707bea4e9b205eda32b093bd4e8
SHA512 ff1d0e646b8796a7b0cac781094610b5f6ca273e7c73c497eaaa5dc904ce2596431d5053571974345c07d54e96339133a5699fa546741edd0e79be504c7d8a4f
TLSH
T17FD0928A052A90BCC8CF15FC8C01DCC901519C6AAFCBD775512BB11C7AA1E5120E8081
MD5 SHA1 SHA512 TLSH

Submit Download

BALANCED.astroeq

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro MixAmp Pro TR\Astro EQ\BALANCED.astroeq
Size 262B
SHA256 01bb52ce11faf443124bfa29c20f34bb4ce71378a92d1948519a7cb86a6083c0
MD5 e8a252616a3cdfd768961046b6ecfb14
SHA1 4d30d2ed8639201f804a2f8dd261eaab19827571
SHA512 1dc5cb276a78f9cdcb20be5eb9d8279afb2c4d29ca3f7cbe92d781530270c5403d6fdea30ae381178222e41ab67683d0c0fef3eb6fc7a2fbcb8d375b5d5cf00d
TLSH
T121D0928A050A406CC58F04FCCC50DEC91251AC2AAFCBC774412BB1193AD0F8510EC080
MD5 SHA1 SHA512 TLSH

Submit Download

NATURAL BASS.astroeq

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro MixAmp Pro TR\Astro EQ\NATURAL BASS.astroeq
Size 264B
SHA256 f4983943e97ad985f4454a1db9f4a21436d7137bc7fa99f918f1de7366fe39c7
MD5 ed9f51cecde56fafd2abe469bb50fbe4
SHA1 49ae6c0e7ab11b95b74ab637a2b831f460e8665b
SHA512 76da39953489252b72be5ce02b9e9ce501e15dbf175c8636f7d7809160db816337c6dfc27c58f94cb0715b73999154bbef3becdc5dcd9a141acc834254469f4f
TLSH
T176D09286490B6098DB8E10FD9C25EDC901A09C6AABCBCB74412FB2197EA1E5110E8081
MD5 SHA1 SHA512 TLSH

Submit Download

TOURNAMENT.astroeq

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro MixAmp Pro TR\Astro EQ\TOURNAMENT.astroeq
Size 263B
SHA256 75183fac94ca4abe1169a2069773a8359c23d0cb274a8402983e2823b965184c
MD5 15b704b7f14e34dfbbf3d9c5244c9f19
SHA1 4bf60596e02bae354bbf2a2e4eddd0ca4324bc61
SHA512 eeb05ee3de821ab11659e39f509c7f4b80c4649465c391d85b5748796375068be035db3b05a0d706ccfd459c5e6311777174f7044d0febfb7e6b266f78dd31a4
TLSH
T185D0928A042B65ADC68F15FC9C01DDC915919CAABFCBC7B4816FB2093AD8F5110ED855
MD5 SHA1 SHA512 TLSH

Submit Download

ASTRO_Default_MixAmp_Pro_TR.agp

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\assets\Astro MixAmp Pro TR\Astro Profiles\ASTRO_Default_MixAmp_Pro_TR.agp
Size 2KB
SHA256 f4d298382370ed52428694f1617aaf956c8fef7b36f9f763855d41e0cce299fc
MD5 cf0565a7ceda382b62f3e74051d990f2
SHA1 5df1fd744277bad50ea7fc47b0f2e15949083d5d
SHA512 77d2534521346be3074a65668c020458d0c991473dc04508d50a11f412381eb6606caf83f7925aad55f09d2df35d4bc2aadcbf86f88e172b651737d1a037f367
TLSH
T15641BE454C8A907ACF9FF6F44A17C28C49A074A157CA873B03F7B58E9AB0DE31398D46
MD5 SHA1 SHA512 TLSH

Submit Download

qt.conf

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\qt.conf
Size 30B
SHA256 6a5af4838e31c4fa4183deba6b2ee4db51d0bede8d5531a3b4bdddeee1e3d131
MD5 dc09a645c5ba9eb20f93ca30fa7ba4a5
SHA1 fc6bfee49329370d477340c9b488491dbc1dcee3
SHA512 d2f6744ac437c603795d8fd9f666a0979cfa3ec9c3a1bf496e82e04e95d5b2da953aee01fd79f38560515a41b14c87d777aeb14445365d6750408484fdd1a572
MD5 SHA1 SHA512

Submit Download

qsvgicon.dll

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\qtplugins\iconengines\qsvgicon.dll
Size 34KB
SHA256 d9e295d76a5d73c33da67a0326c2bd43b90b7b4e19e03a4637c4a0eab6b3ce04
MD5 cfeb113baba89e047269a103cd60e8c8
SHA1 8f4d01ae36870566f3642910dc3288066f9fd27c
SHA512 57332e93a71101196d0cb5411b7c1f3aee00f7b2887e33bdfbe06a872dfa5afe0db9099927ddcddb1463dd7a59f78eb68fb246fbb6e77d6164bad57f89480565
SSDEEP 768:oE7X1LJChKSkvyOLvVkxeZvhMgpEk41tmmzA:3T4K7jVk8ZvhM2Ek4fj8
TLSH
T1A3F24AE2662910E3F2569630355CEE27C83EFBB01BC1C5C7D72B5A5958563F27E3820A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qico.dll

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\qtplugins\imageformats\qico.dll
Size 31KB
SHA256 4862df5f6eb95a35de772d6fc339d6bf611b5f7b197d4edfba3e2bd42f4e8510
MD5 95660dcf5679a1a75af9e6b22e40db3e
SHA1 2f07377ae459b60fa6e26813c8c491564e608ffd
SHA512 d7b3de6ed65780d5d98c7310aa0bc48c8ce7ec1c593adc8d34e2c9a48181fdf26782e0a700807be9b5d6ad1d9a72806d69811512a7e9abaeac3253279462c683
SSDEEP 768:sfCWKJEH+0wYyCqPWHy37BejWoC56sMumzgz3mfb:8l7+0w0QWHy37BejNC56sMLIWz
TLSH
T1B4E25C41EB1A94F3D6578A70199E9737DB38BA604FC18787ABE386112C563E33E3420D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvg.dll

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\qtplugins\imageformats\qsvg.dll
Size 26KB
SHA256 2a1b19e014563e3b3ccda0025604f94c08427598cc8c534f18b12a3340b27ffc
MD5 d0783c4c78a86c6470b90e39c9065b74
SHA1 4c9ed41b8d292f4104a72a365a903af3559907f0
SHA512 4397fc387026781b5a3da42e776518629ab9f0423a194e7d760c4feb80eb9712aa6e262a85ca1b93cc9f78df1ca136615bfd1ecc58604a7d47e305b020b44e01
SSDEEP 768:759K0WZmBaxfz0Yu646rA9fJ0hTBmFmzI:CBZmB4oYu646rUh0hTBmg8
TLSH
T17EC26C43F71A54B3D26B96B42698976BDC3DF1504BD2DB8B9F1386441CA83E12E3820E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\qtplugins\platforms\qwindows.dll
Size 1.2MB
SHA256 2565fe1111bf0ba6b98683030b8da92f77da877d0a981f712184e4ce5018b723
MD5 85aa93ec804343839e9710de5bc728f1
SHA1 3186488ae25d55249898ce968c911dc48bda3950
SHA512 d54cdc252436b7f71f83bd9af2f9bdacfe2f9d478a4502959498fa3eb7b8cb822cb5caf1d68297cd95c97a64c2706373fe2cbce22e620ada6b731dd9bad199ae
SSDEEP 12288:uYCQWyni5LoUmhY4or3D8kSqjPfmK7UpOVpYAlCRegIe5ZpzNAoKu15XSxDyfEWJ:fniF3z39xPePpOkaXze5ZtN4bZa0c
TLSH
T1D0459F41A77245F1E4891774035EAB3BCA39621C0727C5D3F3947E92F9222E36A3B35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

quazip.dll

Path C:\Program Files (x86)\Astro Gaming\ASTRO Command Center\quazip.dll
Size 124KB
SHA256 e12aebf9e54c4f34916510dee073fd42da81997f4b89397bd3982519c7088cb6
MD5 bf25d7ddc32e8684bb05e45faa6de075
SHA1 285da75da5b0f2e543f80108041ebec9080e8658
SHA512 8e4e555d1eb65e847937c0dcccc5d891ccf7942eafcabb4e3354d4b21f498f230e2c99285d100194ba661a03a14677b263a662024801d6de04cfecd6c3321883
SSDEEP 3072:QaUme2MXALa/STXghuqcSj4aZWbquwalk9GZ36/N8:Qv2YcSqbquwalHiN8
TLSH
T1A5C35B52762B81BBE59D507C0C2C872FD22BD7B98F5682C3E3195B5608309D3EE35197
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI66CE.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI66CE.tmp
Size 113KB
SHA256 aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7
MD5 4fdd16752561cf585fed1506914d73e0
SHA1 f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424
SHA512 3695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600
SSDEEP 1536:YImZwomOndvrhsgz56GoiFmntw1ebC0fsWk0FlcdOJKJpPpxyNokVbY4:jewOdvregz5L/mxb7FUOsrPpxyN7/
TLSH
T19EB37C1275D0C072E8BE0E3D45748A715F7E7930EF648AEB635812694FB42C0AE39E67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59ab9a.msi

Path C:\Windows\Installer\e59ab9a.msi
Size 12.2MB
SHA256 2e4342fc1117141b6f3d6366d9a64ae3a57683af202bfad0e90f3ae11839eb19
MD5 b68abbb3094c91521db24a60a750618b
SHA1 0181256a2c8840ff05961c6221fbe73d4191a6bb
SHA512 b18498e20ddfeac5dc7488394884751f893b2f281a5838d40411414f3c8e1c894b43e62c166caf621d8aa3daeafa6b6bc38d5139ad1c1ed855f3e646eccaf966
SSDEEP 393216:a27s9vyhLVYck1RITtrsGuMOyha+wIGs:ah9vuKc0IfOylwIG
TLSH
T16BD612359A96D526C36ACB78DC2FF7000B79FD1C5F2DD83099EA76BA96B46C42483403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 bd2741c2474c124f11f65a8897d058d166c98c0a1ccad03f9ee40ad45ab29418
MD5 46b06885255e68590d79439e18705ed6
SHA1 786ce66680d50567bc0ed1ab1c43506f424ac6d0
SHA512 fb950314c5093d9e52da5a1debf1d059b3ac405e0dee202ef1886db7495ef5886b932b617da2e5e81329b84bfca89050918eae7d477203e92959df26a0097384
SSDEEP 24576:dFo3DMPZdoO/vvTL/Sg88iFQvrumHb7P0BKudxSUKpyKpb9cMoRWclmd4+K:BHs
TLSH
T1A857B42436F92200E7F79E3DA8F06A234D397D5BAC15DE8D45511B4E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{701b68f1-d01e-4747-996a-acf8e9230819}_OnDiskSnapshotProp

Path \??\Volume{c61f3bad-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{701b68f1-d01e-4747-996a-acf8e9230819}_OnDiskSnapshotProp
Size 6KB
SHA256 6f4892a69e962a8069ceca8ab0076a67ac77c0df1f541c032da4f0baa52b94e6
MD5 4494d1520bcdfd0bcf40ac170549a294
SHA1 fa47bda59fb2b15e77ea639f81d2c5b170c69289
SHA512 65aa59e6e6303bd0340d0f593ea03f00adf65eaf895425c47139327b15e9f32b0dbc2edd848032d5e95c8578914b87a09487667ce09cc07d1b4f7d7d9af710a0
SSDEEP 96:Fj5667ECvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:uBeb++uVmN
TLSH
T1C6D189085AF54711E2B3AB7129F18557A837B811EF33CB8E0198238E6631A10F935F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download