c28742ea377049cd2be23f4269603d5b9b1da93627c44aec29c64aba0cf30c11

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/11/2026, 13:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Astro-Setup.exe
Size 7.5MB
Sample261107-qfz1wsys2j
SHA256 c28742ea377049cd2be23f4269603d5b9b1da93627c44aec29c64aba0cf30c11
MD5 ee9d36f73c1698348b66cb1704c68406
SHA1 d1a2cbdea0adb4c3a2c90a6f4b2764664448f1a1
SHA512 053abc159772e74ff8d76e26bc9199c5f4a9016d6ca69738082102813af02960a97f3eef9f167d71b144c1b6451091487062b54a2be1a1fef064f5e6752fafb7
SSDEEP 49152:bywq7e7cujy4HhkI+RpajNRxDB8xvMR11/a0hwDlmktHInzPj4qnmkd6O0Y6IyBm:bbXLFeA1dqlmuMkc6/z38aoEw
TLSH
T155868C03FCA555E9C0AAD23585629253BA317C485B3523E77FA0F3392F76BC06AB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
100	powershell.exe
3964	powershell.exe
728	powershell.exe
916	powershell.exe

Modifies Windows Firewall 2 TTPs 4 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5056	netsh.exe
5156	netsh.exe
4416	netsh.exe
1792	netsh.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Astroplay servidor.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Astroplay servidor.lnk	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
1404	Astroplay.exe
3192	Astroplay.exe
5216	Astroplay.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Astroplay\logo.ico	Astro-Setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4344_1014668584\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4344_1014668584\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4344_287034503\nav_config.json	msedge.exe
File opened for modification	C:\Program Files\Astroplay\.permiso	Astro-Setup.exe
File opened for modification	C:\Program Files\Astroplay\Astroplay.exe.new	Astro-Setup.exe
File opened for modification	C:\Program Files\Astroplay\.permiso	Astroplay.exe
File opened for modification	C:\Program Files\Astroplay\logo.ico	Astroplay.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4344_1495847954\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4344_287034503\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1236	cmd.exe
4752	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Astro-Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Astro-Setup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2008	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{683B6B97-4E2A-465B-B02B-7AAA2C4200C1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
100	powershell.exe
100	powershell.exe
3964	powershell.exe
3964	powershell.exe
728	powershell.exe
728	powershell.exe
728	powershell.exe
916	powershell.exe
916	powershell.exe
916	powershell.exe
5708	msedge.exe
5708	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	100	powershell.exe
Token: SeDebugPrivilege	3964	powershell.exe
Token: SeDebugPrivilege	728	powershell.exe
Token: SeDebugPrivilege	916	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4344	msedge.exe
4344	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 100	1280	Astro-Setup.exe	92
PID 1280 wrote to memory of 3964	1280	Astro-Setup.exe	95
PID 3964 wrote to memory of 1236	3964	powershell.exe	100
PID 1236 wrote to memory of 4416	1236	cmd.exe	102
PID 1236 wrote to memory of 1792	1236	cmd.exe	104
PID 1280 wrote to memory of 3192	1280	Astro-Setup.exe	105
PID 1280 wrote to memory of 4344	1280	Astro-Setup.exe	106
PID 4344 wrote to memory of 4288	4344	msedge.exe	107
PID 4344 wrote to memory of 2764	4344	msedge.exe	108
PID 4344 wrote to memory of 2008	4344	msedge.exe	109
PID 4344 wrote to memory of 2764	4344	msedge.exe	108
PID 4344 wrote to memory of 2764	4344	msedge.exe	108
PID 4344 wrote to memory of 1804	4344	msedge.exe	110
PID 4344 wrote to memory of 1804	4344	msedge.exe	110
PID 4344 wrote to memory of 3196	4344	msedge.exe	111
PID 4344 wrote to memory of 4192	4344	msedge.exe	112
PID 4344 wrote to memory of 3196	4344	msedge.exe	111
PID 4344 wrote to memory of 3196	4344	msedge.exe	111
PID 4344 wrote to memory of 4192	4344	msedge.exe	112
PID 4344 wrote to memory of 4192	4344	msedge.exe	112
PID 4344 wrote to memory of 2632	4344	msedge.exe	114
PID 4344 wrote to memory of 3820	4344	msedge.exe	115
PID 4344 wrote to memory of 2632	4344	msedge.exe	114
PID 4344 wrote to memory of 2632	4344	msedge.exe	114
PID 4344 wrote to memory of 3820	4344	msedge.exe	115
PID 4344 wrote to memory of 3820	4344	msedge.exe	115
PID 4344 wrote to memory of 2500	4344	msedge.exe	117
PID 4344 wrote to memory of 2500	4344	msedge.exe	117
PID 4344 wrote to memory of 1480	4344	msedge.exe	119
PID 4344 wrote to memory of 1480	4344	msedge.exe	119
PID 4344 wrote to memory of 2448	4344	msedge.exe	120
PID 4344 wrote to memory of 880	4344	msedge.exe	121
PID 4344 wrote to memory of 2448	4344	msedge.exe	120
PID 4344 wrote to memory of 880	4344	msedge.exe	121
PID 4344 wrote to memory of 3584	4344	msedge.exe	123
PID 4344 wrote to memory of 432	4344	msedge.exe	124
PID 4344 wrote to memory of 432	4344	msedge.exe	124
PID 4344 wrote to memory of 392	4344	msedge.exe	125
PID 4344 wrote to memory of 392	4344	msedge.exe	125
PID 4344 wrote to memory of 3068	4344	msedge.exe	126
PID 4344 wrote to memory of 3068	4344	msedge.exe	126
PID 4344 wrote to memory of 1708	4344	msedge.exe	127
PID 4344 wrote to memory of 1708	4344	msedge.exe	127
PID 4344 wrote to memory of 1008	4344	msedge.exe	135
PID 4344 wrote to memory of 1008	4344	msedge.exe	135
PID 1404 wrote to memory of 728	1404	Astroplay.exe	129
PID 1404 wrote to memory of 916	1404	Astroplay.exe	131
PID 916 wrote to memory of 4752	916	powershell.exe	133
PID 4752 wrote to memory of 5056	4752	cmd.exe	136
PID 4752 wrote to memory of 5156	4752	cmd.exe	137
PID 1404 wrote to memory of 5216	1404	Astroplay.exe	138
PID 1404 wrote to memory of 5320	1404	Astroplay.exe	139
PID 4344 wrote to memory of 5332	4344	msedge.exe	140
PID 4344 wrote to memory of 5332	4344	msedge.exe	140
PID 4344 wrote to memory of 5332	4344	msedge.exe	140
PID 4344 wrote to memory of 5800	4344	msedge.exe	143
PID 4344 wrote to memory of 5808	4344	msedge.exe	144
PID 4344 wrote to memory of 5816	4344	msedge.exe	145
PID 4344 wrote to memory of 6128	4344	msedge.exe	146
PID 4344 wrote to memory of 6128	4344	msedge.exe	146
PID 4344 wrote to memory of 5392	4344	msedge.exe	148
PID 4344 wrote to memory of 5392	4344	msedge.exe	148
PID 4344 wrote to memory of 4592	4344	msedge.exe	149
PID 4344 wrote to memory of 4592	4344	msedge.exe	149

C:\Users\Admin\AppData\Local\Temp\Astro-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Astro-Setup.exe"
1⤵
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnAAoAJABlAHgAZQA9ACcAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEEAcwB0AHIAbwBwAGwAYQB5AFwAQQBzAHQAcgBvAHAAbABhAHkALgBlAHgAZQAnADsAIAAkAGQAaQByAD0AJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwAQQBzAHQAcgBvAHAAbABhAHkAJwA7ACAAJABpAGMAbwA9ACcAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEEAcwB0AHIAbwBwAGwAYQB5AFwAbABvAGcAbwAuAGkAYwBvACcACgAkAHMAaAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAFcAUwBjAHIAaQBwAHQALgBTAGgAZQBsAGwACgAjACAAbABpAG0AcABpAGUAegBhACAAZABlACAAbABvAHMAIABhAGMAYwBlAHMAbwBzACAAZABpAHIAZQBjAHQAbwBzACAAZABlACAAdgBlAHIAcwBpAG8AbgBlAHMAIABhAG4AdABlAHIAaQBvAHIAZQBzACwAIABwAGEAcgBhACAAcQB1AGUAIABuAG8AIABxAHUAZQBkAGUAbgAgAGQAdQBwAGwAaQBjAGEAZABvAHMACgAkAG8AbABkAD0AWwBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoARwBlAHQARgBvAGwAZABlAHIAUABhAHQAaAAoACcARABlAHMAawB0AG8AcAAnACkAOwAgACQAbwBsAGQAcAA9AFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEcAZQB0AEYAbwBsAGQAZQByAFAAYQB0AGgAKAAnAFAAcgBvAGcAcgBhAG0AcwAnACkAOwAgACQAbwBsAGQAcwA9AFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEcAZQB0AEYAbwBsAGQAZQByAFAAYQB0AGgAKAAnAFMAdABhAHIAdAB1AHAAJwApAAoAZgBvAHIAZQBhAGMAaAAgACgAJABuACAAaQBuACAAQAAoACIAUAByAGkAZQB0AHQAbwAnAHMAIABBAGQAbQBpAG4AaQBzAHQAcgBhAGMAaQDzAG4AIgAsACIAQQBzAHQAcgBvAHAAbABhAHkAIABBAGQAbQBpAG4AaQBzAHQAcgBhAGMAaQDzAG4AIgApACkAIAB7AAoAIAAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAbwBsAGQAIAAoACQAbgAgACsAIAAnAC4AbABuAGsAJwApACkACgAgACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBSAGUAYwB1AHIAcwBlACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAJABvAGwAZABwACAAJABuACkACgB9AAoAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAJABvAGwAZABzACAAJwBQAHIAaQBlAHQAdABvACAAcwBlAHIAdgBpAGQAbwByAC4AbABuAGsAJwApAAoAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBSAGUAYwB1AHIAcwBlACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFUAbgBpAG4AcwB0AGEAbABsAFwAUAByAGkAZQB0AHQAbwBBAGQAbQBpAG4AJwAKAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0AUgBlAGMAdQByAHMAZQAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAJwBIAEsAQwBVADoAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABVAG4AaQBuAHMAdABhAGwAbABcAEEAcwB0AHIAbwBwAGwAYQB5AEEAZABtAGkAbgAnAAoAZgB1AG4AYwB0AGkAbwBuACAATAAoACQAcABhAHQAaAAsACQAYQAsACQAZAApAHsAIAAkAHMAPQAkAHMAaAAuAEMAcgBlAGEAdABlAFMAaABvAHIAdABjAHUAdAAoACQAcABhAHQAaAApADsAIAAkAHMALgBUAGEAcgBnAGUAdABQAGEAdABoAD0AJABlAHgAZQA7ACAAJABzAC4AQQByAGcAdQBtAGUAbgB0AHMAPQAkAGEAOwAgACQAcwAuAFcAbwByAGsAaQBuAGcARABpAHIAZQBjAHQAbwByAHkAPQAkAGQAaQByADsAIAAkAHMALgBEAGUAcwBjAHIAaQBwAHQAaQBvAG4APQAkAGQAOwAgACQAcwAuAEkAYwBvAG4ATABvAGMAYQB0AGkAbwBuAD0AJABpAGMAbwA7ACAAJABzAC4AUwBhAHYAZQAoACkAIAB9AAoAJABkAGUAcwBrAD0AWwBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoARwBlAHQARgBvAGwAZABlAHIAUABhAHQAaAAoACcARABlAHMAawB0AG8AcAAnACkAOwAgACQAcAByAG8AZwA9AFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEcAZQB0AEYAbwBsAGQAZQByAFAAYQB0AGgAKAAnAFAAcgBvAGcAcgBhAG0AcwAnACkAOwAgACQAcwB0AGEAcgB0AD0AWwBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoARwBlAHQARgBvAGwAZABlAHIAUABhAHQAaAAoACcAUwB0AGEAcgB0AHUAcAAnACkACgAjACAAUwBpACAAZQBuACAAZQBzAHQAYQAgAFAAQwAgAHkAYQAgAGgAYQB5ACAAbwB0AHIAYQAgAGkAbgBzAHQAYQBsAGEAYwBpAPMAbgAgAGMAbwBuACAAZQBsACAAbQBpAHMAbQBvACAAbgBvAG0AYgByAGUAIAAoAHAAbwByACAAZQBqAGUAbQBwAGwAbwAsACAAbABhACAAdgBlAHIAcwBpAPMAbgAgAHAAcgBvAHAAaQBhACAAeQAgAGwAYQAgAGQAZQAgAHUAbgAKACMAIABjAGwAaQBlAG4AdABlACAAYwBvAG4AdgBpAHYAaQBlAG4AZABvACAAcABhAHIAYQAgAHAAcgBvAGIAYQByACkALAAgAHMAZQAgAGwAZQAgAGEAZwByAGUAZwBhACAAdQBuAGEAIABhAGMAbABhAHIAYQBjAGkA8wBuACAAcABhAHIAYQAgAG4AbwAgAHAAaQBzAGEAcgAgAGUAbAAgAGEAYwBjAGUAcwBvACAAZABpAHIAZQBjAHQAbwAgAGQAZQBsACAAbwB0AHIAbwAuAAoAJABuAGEAbQBlAD0AJwBBAHMAdAByAG8AIABBAGQAbQBpAG4AaQBzAHQAcgBhAGMAaQDzAG4AJwAKACQAbABuAGsAPQBKAG8AaQBuAC0AUABhAHQAaAAgACQAZABlAHMAawAgACgAJABuAGEAbQBlACAAKwAgACcALgBsAG4AawAnACkACgBpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAAJABsAG4AawApACAAewAgACQAdAA9ACQAcwBoAC4AQwByAGUAYQB0AGUAUwBoAG8AcgB0AGMAdQB0ACgAJABsAG4AawApAC4AVABhAHIAZwBlAHQAUABhAHQAaAA7ACAAaQBmACAAKAAkAHQAIAAtAGEAbgBkACAAJAB0ACAALQBuAGUAIAAkAGUAeABlACkAIAB7ACAAJABuAGEAbQBlACAAPQAgACQAbgBhAG0AZQAgACsAIAAnACAAKABBAHMAdAByAG8AcABsAGEAeQApACcAIAB9ACAAfQAKACQAbQBlAG4AdQA9AEoAbwBpAG4ALQBQAGEAdABoACAAJABwAHIAbwBnACAAJABuAGEAbQBlAAoATgBlAHcALQBJAHQAZQBtACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlACAAJABtAGUAbgB1ACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKAEwAIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAJABkAGUAcwBrACAAKAAkAG4AYQBtAGUAIAArACAAJwAuAGwAbgBrACcAKQApACAAJwAtAC0AbwBwAGUAbgAnACAAIgBBAGIAcgBpAHIAIABBAHMAdAByAG8AIABBAGQAbQBpAG4AaQBzAHQAcgBhAGMAaQDzAG4AIAC3ACAAVAB1ACAAbgBlAGcAbwBjAGkAbwAgAG8AcgBkAGUAbgBhAGQAbwAgAHkAIABwAHIAbwBkAHUAYwB0AGkAdgBvACIACgBMACAAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAbQBlAG4AdQAgACgAJABuAGEAbQBlACAAKwAgACcALgBsAG4AawAnACkAKQAgACcALQAtAG8AcABlAG4AJwAgACIAQQBiAHIAaQByACAAQQBzAHQAcgBvACAAQQBkAG0AaQBuAGkAcwB0AHIAYQBjAGkA8wBuACIACgBMACAAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAbQBlAG4AdQAgACIAQwBvAG4AZQBjAHQAYQByACAAYwBlAGwAdQBsAGEAcgBlAHMALgBsAG4AawAiACkAIAAnAC0ALQBwAGgAbwBuAGUAcwAnACAAIgBWAGUAcgAgAGwAYQAgAGQAaQByAGUAYwBjAGkA8wBuACAAcABhAHIAYQAgAGMAbwBuAGUAYwB0AGEAcgAgAGMAZQBsAHUAbABhAHIAZQBzACIACgBMACAAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAbQBlAG4AdQAgACIARABlAHMAaQBuAHMAdABhAGwAYQByAC4AbABuAGsAIgApACAAJwAtAC0AdQBuAGkAbgBzAHQAYQBsAGwAJwAgACIARABlAHMAaQBuAHMAdABhAGwAYQByACAAQQBzAHQAcgBvACAAQQBkAG0AaQBuAGkAcwB0AHIAYQBjAGkA8wBuACIACgBMACAAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAcwB0AGEAcgB0ACAAIgBBAHMAdAByAG8AcABsAGEAeQAgAHMAZQByAHYAaQBkAG8AcgAuAGwAbgBrACIAKQAgACcALQAtAHMAZQByAHYAZQAnACAAIgBTAGUAcgB2AGkAZABvAHIAIABkAGUAIABBAHMAdAByAG8AIABBAGQAbQBpAG4AaQBzAHQAcgBhAGMAaQDzAG4AIgAKACQAZgBzAD0AJABzAGgALgBDAHIAZQBhAHQAZQBTAGgAbwByAHQAYwB1AHQAKAAoAEoAbwBpAG4ALQBQAGEAdABoACAAJABtAGUAbgB1ACAAIgBNAGkAcwAgAGQAYQB0AG8AcwAgAHkAIABwAGwAYQBuAGkAbABsAGEAcwAuAGwAbgBrACIAKQApADsAIAAkAGYAcwAuAFQAYQByAGcAZQB0AFAAYQB0AGgAPQAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABBAHMAdAByAG8AcABsAGEAeQBcAGQAYQB0AGEAXABSAGUAZwBpAHMAdAByAG8AcwAnADsAIAAkAGYAcwAuAEQAZQBzAGMAcgBpAHAAdABpAG8AbgA9ACIAUABsAGEAbgBpAGwAbABhAHMAIABkAGUAIABFAHgAYwBlAGwAIABjAG8AbgAgAHYAZQBuAHQAYQBzACwAIABnAGEAcwB0AG8AcwAgAGUAIABpAG4AdgBlAG4AdABhAHIAaQBvACIAOwAgACQAZgBzAC4AUwBhAHYAZQAoACkACgAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFUAbgBpAG4AcwB0AGEAbABsAFwAQQBzAHQAcgBvAHAAbABhAHkAQQBkAG0AaQBuACcACgBOAGUAdwAtAEkAdABlAG0AIAAtAEYAbwByAGMAZQAgACQAawAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAARABpAHMAcABsAGEAeQBOAGEAbQBlACAALQBWAGEAbAB1AGUAIAAiAEEAcwB0AHIAbwAgAEEAZABtAGkAbgBpAHMAdAByAGEAYwBpAPMAbgAiACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsAAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAawAgAC0ATgBhAG0AZQAgAEQAaQBzAHAAbABhAHkAVgBlAHIAcwBpAG8AbgAgAC0AVgBhAGwAdQBlACAAJwAyAC4AMQAuADAAJwAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIABQAHUAYgBsAGkAcwBoAGUAcgAgAC0AVgBhAGwAdQBlACAAIgBQAHIAaQBlAHQAdABvACcAcwAiACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsAAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAawAgAC0ATgBhAG0AZQAgAEMAbwBtAG0AZQBuAHQAcwAgAC0AVgBhAGwAdQBlACAAIgBUAHUAIABuAGUAZwBvAGMAaQBvACAAbwByAGQAZQBuAGEAZABvACAAeQAgAHAAcgBvAGQAdQBjAHQAaQB2AG8AIgAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIABJAG4AcwB0AGEAbABsAEwAbwBjAGEAdABpAG8AbgAgAC0AVgBhAGwAdQBlACAAJABkAGkAcgAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIABEAGkAcwBwAGwAYQB5AEkAYwBvAG4AIAAtAFYAYQBsAHUAZQAgACQAaQBjAG8AIAAtAEYAbwByAGMAZQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAVQBuAGkAbgBzAHQAYQBsAGwAUwB0AHIAaQBuAGcAIAAtAFYAYQBsAHUAZQAgACgAJwAiACcAKwAkAGUAeABlACsAJwAiACAALQAtAHUAbgBpAG4AcwB0AGEAbABsACcAKQAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIABOAG8ATQBvAGQAaQBmAHkAIAAtAFYAYQBsAHUAZQAgADEAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAG8AcgBkACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsAAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAawAgAC0ATgBhAG0AZQAgAE4AbwBSAGUAcABhAGkAcgAgAC0AVgBhAGwAdQBlACAAMQAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcAbwByAGQAIAAtAEYAbwByAGMAZQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand dAByAHkAIAB7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAYwBtAGQALgBlAHgAZQAgAC0AVgBlAHIAYgAgAFIAdQBuAEEAcwAgAC0AVwBhAGkAdAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGMAJwAsACcAbgBlAHQAcwBoACAAYQBkAHYAZgBpAHIAZQB3AGEAbABsACAAZgBpAHIAZQB3AGEAbABsACAAZABlAGwAZQB0AGUAIAByAHUAbABlACAAbgBhAG0AZQA9AEEAcwB0AHIAbwBwAGwAYQB5ACAAPgBuAHUAbAAgADIAPgAmADEAIAAmACAAbgBlAHQAcwBoACAAYQBkAHYAZgBpAHIAZQB3AGEAbABsACAAZgBpAHIAZQB3AGEAbABsACAAYQBkAGQAIAByAHUAbABlACAAbgBhAG0AZQA9AEEAcwB0AHIAbwBwAGwAYQB5ACAAZABpAHIAPQBpAG4AIABhAGMAdABpAG8AbgA9AGEAbABsAG8AdwAgAHAAcgBvAHQAbwBjAG8AbAA9AFQAQwBQACAAbABvAGMAYQBsAHAAbwByAHQAPQA4ADcAOAA3ACAAcAByAG8AZgBpAGwAZQA9AGEAbgB5ACAAcgBlAG0AbwB0AGUAaQBwAD0ATABvAGMAYQBsAFMAdQBiAG4AZQB0ACcAIAB9ACAAYwBhAHQAYwBoACAAewB9AA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3964
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall delete rule name=Astroplay >nul 2>&1 & netsh advfirewall firewall add rule name=Astroplay dir=in action=allow protocol=TCP localport=8787 profile=any remoteip=LocalSubnet
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1236
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall delete rule name=Astroplay
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4416
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name=Astroplay dir=in action=allow protocol=TCP localport=8787 profile=any remoteip=LocalSubnet
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:1792
- C:\Program Files\Astroplay\Astroplay.exe
  "C:\Program Files\Astroplay\Astroplay.exe" --serve --port 8787
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://localhost:8787/
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x334,0x7ffe9ac5c188,0x7ffe9ac5c194,0x7ffe9ac5c1a0
    3⤵
    PID:4288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,1388934995898376191,18391804127508006685,262144 --field-trial-handle=2376,i,2495053060291175459,5858388356391543925,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:2
    3⤵
    PID:2764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,17997420032378377384,4798154421742260004,524288 --field-trial-handle=2376,i,2495053060291175459,5858388356391543925,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,16376102611972083360,8968323468569761764,524288 --field-trial-handle=2376,i,2495053060291175459,5858388356391543925,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:8
    3⤵
    PID:1804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,3530113188967532498,12063012629746551084,2097152 --field-trial-handle=2376,i,2495053060291175459,5858388356391543925,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:3196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,623866948759354472,13754845377380906520,2097152 --field-trial-handle=2376,i,2495053060291175459,5858388356391543925,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
    3⤵
    PID:4192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,11280661041745937349,7370536085222601032,2097152 --field-trial-handle=2376,i,2495053060291175459,5858388356391543925,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:2
    3⤵
    PID:2632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,8648458560464484712,15289456871292483345,2097152 --field-trial-handle=2376,i,2495053060291175459,5858388356391543925,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
    3⤵
    PID:3820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,4083142406920381177,17074017613146002781,524288 --field-trial-handle=2376,i,2495053060291175459,5858388356391543925,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
    3⤵
    PID:2500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,9486661572764492954,17030609032667172406,524288 --field-trial-handle=2376,i,2495053060291175459,5858388356391543925,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
    3⤵
    PID:1480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,9289387338496154494,10744690623169805923,524288 --field-trial-handle=2376,i,2495053060291175459,5858388356391543925,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
    3⤵
    PID:2448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3508,i,11143868251835270985,2528684451669774952,524288 --field-trial-handle=2376,i,2495053060291175459,5858388356391543925,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
    3⤵
    PID:880
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,15536230472503100132,9697594998614841342,524288 --field-trial-handle=2376,i,2495053060291175459,5858388356391543925,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
    3⤵
    PID:2156
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,15536230472503100132,9697594998614841342,524288 --field-trial-handle=2376,i,2495053060291175459,5858388356391543925,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
    3⤵
    PID:3584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,1507400145056055009,17389044793933493729,524288 --field-trial-handle=2376,i,2495053060291175459,5858388356391543925,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
    3⤵
    PID:432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,1984192172287129742,2140761949384599001,524288 --field-trial-handle=2376,i,2495053060291175459,5858388356391543925,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
    3⤵
    PID:392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,5922994501484387092,15014377454320779500,524288 --field-trial-handle=2376,i,2495053060291175459,5858388356391543925,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
    3⤵
    PID:3068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,15992548876172944070,499935961532040835,524288 --field-trial-handle=2376,i,2495053060291175459,5858388356391543925,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
    3⤵
    PID:1708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,3911721315747579842,17355434221307378948,524288 --field-trial-handle=2376,i,2495053060291175459,5858388356391543925,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:8
    3⤵
    PID:1008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5952,i,9227223669610808291,8129577355398195068,2097152 --field-trial-handle=2376,i,2495053060291175459,5858388356391543925,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:1
    3⤵
    PID:5332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,16528164338650640740,6955775858839408033,524288 --field-trial-handle=2376,i,2495053060291175459,5858388356391543925,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:8
    3⤵
    PID:5800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4796,i,8645035380268937322,8034869630161470698,524288 --field-trial-handle=2376,i,2495053060291175459,5858388356391543925,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:8
    3⤵
    PID:5808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4780,i,5620413422608027981,7573606587603059030,524288 --field-trial-handle=2376,i,2495053060291175459,5858388356391543925,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:8
    3⤵
    PID:5816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,8605554472253703832,10038064606393205484,524288 --field-trial-handle=2376,i,2495053060291175459,5858388356391543925,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
    3⤵
    PID:6128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,3363295863648672312,17843952424927531379,524288 --field-trial-handle=2376,i,2495053060291175459,5858388356391543925,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:8
    3⤵
    PID:5392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=864,i,12752723710058615165,6249187168878276173,524288 --field-trial-handle=2376,i,2495053060291175459,5858388356391543925,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:8
    3⤵
    PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4760,i,13351480141179578607,7626759535587764510,524288 --field-trial-handle=2376,i,2495053060291175459,5858388356391543925,262144 --variations-seed-version --mojo-platform-channel-handle=868 /prefetch:8
    3⤵
    PID:5032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,16484314921628837897,6492473442845405813,524288 --field-trial-handle=2376,i,2495053060291175459,5858388356391543925,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:8
    3⤵
    PID:5512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6244,i,2066745455197686981,18011350203094664475,262144 --field-trial-handle=2376,i,2495053060291175459,5858388356391543925,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5708

C:\PROGRA~1\ASTROP~1\Astroplay.exe
C:\PROGRA~1\ASTROP~1\ASTROP~1.EXE
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnAAoAJABlAHgAZQA9ACcAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEEAcwB0AHIAbwBwAGwAYQB5AFwAQQBzAHQAcgBvAHAAbABhAHkALgBlAHgAZQAnADsAIAAkAGQAaQByAD0AJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwAQQBzAHQAcgBvAHAAbABhAHkAJwA7ACAAJABpAGMAbwA9ACcAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEEAcwB0AHIAbwBwAGwAYQB5AFwAbABvAGcAbwAuAGkAYwBvACcACgAkAHMAaAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAFcAUwBjAHIAaQBwAHQALgBTAGgAZQBsAGwACgAjACAAbABpAG0AcABpAGUAegBhACAAZABlACAAbABvAHMAIABhAGMAYwBlAHMAbwBzACAAZABpAHIAZQBjAHQAbwBzACAAZABlACAAdgBlAHIAcwBpAG8AbgBlAHMAIABhAG4AdABlAHIAaQBvAHIAZQBzACwAIABwAGEAcgBhACAAcQB1AGUAIABuAG8AIABxAHUAZQBkAGUAbgAgAGQAdQBwAGwAaQBjAGEAZABvAHMACgAkAG8AbABkAD0AWwBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoARwBlAHQARgBvAGwAZABlAHIAUABhAHQAaAAoACcARABlAHMAawB0AG8AcAAnACkAOwAgACQAbwBsAGQAcAA9AFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEcAZQB0AEYAbwBsAGQAZQByAFAAYQB0AGgAKAAnAFAAcgBvAGcAcgBhAG0AcwAnACkAOwAgACQAbwBsAGQAcwA9AFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEcAZQB0AEYAbwBsAGQAZQByAFAAYQB0AGgAKAAnAFMAdABhAHIAdAB1AHAAJwApAAoAZgBvAHIAZQBhAGMAaAAgACgAJABuACAAaQBuACAAQAAoACIAUAByAGkAZQB0AHQAbwAnAHMAIABBAGQAbQBpAG4AaQBzAHQAcgBhAGMAaQDzAG4AIgAsACIAQQBzAHQAcgBvAHAAbABhAHkAIABBAGQAbQBpAG4AaQBzAHQAcgBhAGMAaQDzAG4AIgApACkAIAB7AAoAIAAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAbwBsAGQAIAAoACQAbgAgACsAIAAnAC4AbABuAGsAJwApACkACgAgACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBSAGUAYwB1AHIAcwBlACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAJABvAGwAZABwACAAJABuACkACgB9AAoAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAJABvAGwAZABzACAAJwBQAHIAaQBlAHQAdABvACAAcwBlAHIAdgBpAGQAbwByAC4AbABuAGsAJwApAAoAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBSAGUAYwB1AHIAcwBlACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFUAbgBpAG4AcwB0AGEAbABsAFwAUAByAGkAZQB0AHQAbwBBAGQAbQBpAG4AJwAKAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0AUgBlAGMAdQByAHMAZQAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAJwBIAEsAQwBVADoAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABVAG4AaQBuAHMAdABhAGwAbABcAEEAcwB0AHIAbwBwAGwAYQB5AEEAZABtAGkAbgAnAAoAZgB1AG4AYwB0AGkAbwBuACAATAAoACQAcABhAHQAaAAsACQAYQAsACQAZAApAHsAIAAkAHMAPQAkAHMAaAAuAEMAcgBlAGEAdABlAFMAaABvAHIAdABjAHUAdAAoACQAcABhAHQAaAApADsAIAAkAHMALgBUAGEAcgBnAGUAdABQAGEAdABoAD0AJABlAHgAZQA7ACAAJABzAC4AQQByAGcAdQBtAGUAbgB0AHMAPQAkAGEAOwAgACQAcwAuAFcAbwByAGsAaQBuAGcARABpAHIAZQBjAHQAbwByAHkAPQAkAGQAaQByADsAIAAkAHMALgBEAGUAcwBjAHIAaQBwAHQAaQBvAG4APQAkAGQAOwAgACQAcwAuAEkAYwBvAG4ATABvAGMAYQB0AGkAbwBuAD0AJABpAGMAbwA7ACAAJABzAC4AUwBhAHYAZQAoACkAIAB9AAoAJABkAGUAcwBrAD0AWwBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoARwBlAHQARgBvAGwAZABlAHIAUABhAHQAaAAoACcARABlAHMAawB0AG8AcAAnACkAOwAgACQAcAByAG8AZwA9AFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEcAZQB0AEYAbwBsAGQAZQByAFAAYQB0AGgAKAAnAFAAcgBvAGcAcgBhAG0AcwAnACkAOwAgACQAcwB0AGEAcgB0AD0AWwBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoARwBlAHQARgBvAGwAZABlAHIAUABhAHQAaAAoACcAUwB0AGEAcgB0AHUAcAAnACkACgAjACAAUwBpACAAZQBuACAAZQBzAHQAYQAgAFAAQwAgAHkAYQAgAGgAYQB5ACAAbwB0AHIAYQAgAGkAbgBzAHQAYQBsAGEAYwBpAPMAbgAgAGMAbwBuACAAZQBsACAAbQBpAHMAbQBvACAAbgBvAG0AYgByAGUAIAAoAHAAbwByACAAZQBqAGUAbQBwAGwAbwAsACAAbABhACAAdgBlAHIAcwBpAPMAbgAgAHAAcgBvAHAAaQBhACAAeQAgAGwAYQAgAGQAZQAgAHUAbgAKACMAIABjAGwAaQBlAG4AdABlACAAYwBvAG4AdgBpAHYAaQBlAG4AZABvACAAcABhAHIAYQAgAHAAcgBvAGIAYQByACkALAAgAHMAZQAgAGwAZQAgAGEAZwByAGUAZwBhACAAdQBuAGEAIABhAGMAbABhAHIAYQBjAGkA8wBuACAAcABhAHIAYQAgAG4AbwAgAHAAaQBzAGEAcgAgAGUAbAAgAGEAYwBjAGUAcwBvACAAZABpAHIAZQBjAHQAbwAgAGQAZQBsACAAbwB0AHIAbwAuAAoAJABuAGEAbQBlAD0AJwBBAHMAdAByAG8AIABBAGQAbQBpAG4AaQBzAHQAcgBhAGMAaQDzAG4AJwAKACQAbABuAGsAPQBKAG8AaQBuAC0AUABhAHQAaAAgACQAZABlAHMAawAgACgAJABuAGEAbQBlACAAKwAgACcALgBsAG4AawAnACkACgBpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAAJABsAG4AawApACAAewAgACQAdAA9ACQAcwBoAC4AQwByAGUAYQB0AGUAUwBoAG8AcgB0AGMAdQB0ACgAJABsAG4AawApAC4AVABhAHIAZwBlAHQAUABhAHQAaAA7ACAAaQBmACAAKAAkAHQAIAAtAGEAbgBkACAAJAB0ACAALQBuAGUAIAAkAGUAeABlACkAIAB7ACAAJABuAGEAbQBlACAAPQAgACQAbgBhAG0AZQAgACsAIAAnACAAKABBAHMAdAByAG8AcABsAGEAeQApACcAIAB9ACAAfQAKACQAbQBlAG4AdQA9AEoAbwBpAG4ALQBQAGEAdABoACAAJABwAHIAbwBnACAAJABuAGEAbQBlAAoATgBlAHcALQBJAHQAZQBtACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlACAAJABtAGUAbgB1ACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKAEwAIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAJABkAGUAcwBrACAAKAAkAG4AYQBtAGUAIAArACAAJwAuAGwAbgBrACcAKQApACAAJwAtAC0AbwBwAGUAbgAnACAAIgBBAGIAcgBpAHIAIABBAHMAdAByAG8AIABBAGQAbQBpAG4AaQBzAHQAcgBhAGMAaQDzAG4AIAC3ACAAVAB1ACAAbgBlAGcAbwBjAGkAbwAgAG8AcgBkAGUAbgBhAGQAbwAgAHkAIABwAHIAbwBkAHUAYwB0AGkAdgBvACIACgBMACAAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAbQBlAG4AdQAgACgAJABuAGEAbQBlACAAKwAgACcALgBsAG4AawAnACkAKQAgACcALQAtAG8AcABlAG4AJwAgACIAQQBiAHIAaQByACAAQQBzAHQAcgBvACAAQQBkAG0AaQBuAGkAcwB0AHIAYQBjAGkA8wBuACIACgBMACAAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAbQBlAG4AdQAgACIAQwBvAG4AZQBjAHQAYQByACAAYwBlAGwAdQBsAGEAcgBlAHMALgBsAG4AawAiACkAIAAnAC0ALQBwAGgAbwBuAGUAcwAnACAAIgBWAGUAcgAgAGwAYQAgAGQAaQByAGUAYwBjAGkA8wBuACAAcABhAHIAYQAgAGMAbwBuAGUAYwB0AGEAcgAgAGMAZQBsAHUAbABhAHIAZQBzACIACgBMACAAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAbQBlAG4AdQAgACIARABlAHMAaQBuAHMAdABhAGwAYQByAC4AbABuAGsAIgApACAAJwAtAC0AdQBuAGkAbgBzAHQAYQBsAGwAJwAgACIARABlAHMAaQBuAHMAdABhAGwAYQByACAAQQBzAHQAcgBvACAAQQBkAG0AaQBuAGkAcwB0AHIAYQBjAGkA8wBuACIACgBMACAAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAcwB0AGEAcgB0ACAAIgBBAHMAdAByAG8AcABsAGEAeQAgAHMAZQByAHYAaQBkAG8AcgAuAGwAbgBrACIAKQAgACcALQAtAHMAZQByAHYAZQAnACAAIgBTAGUAcgB2AGkAZABvAHIAIABkAGUAIABBAHMAdAByAG8AIABBAGQAbQBpAG4AaQBzAHQAcgBhAGMAaQDzAG4AIgAKACQAZgBzAD0AJABzAGgALgBDAHIAZQBhAHQAZQBTAGgAbwByAHQAYwB1AHQAKAAoAEoAbwBpAG4ALQBQAGEAdABoACAAJABtAGUAbgB1ACAAIgBNAGkAcwAgAGQAYQB0AG8AcwAgAHkAIABwAGwAYQBuAGkAbABsAGEAcwAuAGwAbgBrACIAKQApADsAIAAkAGYAcwAuAFQAYQByAGcAZQB0AFAAYQB0AGgAPQAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABBAHMAdAByAG8AcABsAGEAeQBcAGQAYQB0AGEAXABSAGUAZwBpAHMAdAByAG8AcwAnADsAIAAkAGYAcwAuAEQAZQBzAGMAcgBpAHAAdABpAG8AbgA9ACIAUABsAGEAbgBpAGwAbABhAHMAIABkAGUAIABFAHgAYwBlAGwAIABjAG8AbgAgAHYAZQBuAHQAYQBzACwAIABnAGEAcwB0AG8AcwAgAGUAIABpAG4AdgBlAG4AdABhAHIAaQBvACIAOwAgACQAZgBzAC4AUwBhAHYAZQAoACkACgAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFUAbgBpAG4AcwB0AGEAbABsAFwAQQBzAHQAcgBvAHAAbABhAHkAQQBkAG0AaQBuACcACgBOAGUAdwAtAEkAdABlAG0AIAAtAEYAbwByAGMAZQAgACQAawAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAARABpAHMAcABsAGEAeQBOAGEAbQBlACAALQBWAGEAbAB1AGUAIAAiAEEAcwB0AHIAbwAgAEEAZABtAGkAbgBpAHMAdAByAGEAYwBpAPMAbgAiACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsAAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAawAgAC0ATgBhAG0AZQAgAEQAaQBzAHAAbABhAHkAVgBlAHIAcwBpAG8AbgAgAC0AVgBhAGwAdQBlACAAJwAyAC4AMQAuADAAJwAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIABQAHUAYgBsAGkAcwBoAGUAcgAgAC0AVgBhAGwAdQBlACAAIgBQAHIAaQBlAHQAdABvACcAcwAiACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsAAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAawAgAC0ATgBhAG0AZQAgAEMAbwBtAG0AZQBuAHQAcwAgAC0AVgBhAGwAdQBlACAAIgBUAHUAIABuAGUAZwBvAGMAaQBvACAAbwByAGQAZQBuAGEAZABvACAAeQAgAHAAcgBvAGQAdQBjAHQAaQB2AG8AIgAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIABJAG4AcwB0AGEAbABsAEwAbwBjAGEAdABpAG8AbgAgAC0AVgBhAGwAdQBlACAAJABkAGkAcgAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIABEAGkAcwBwAGwAYQB5AEkAYwBvAG4AIAAtAFYAYQBsAHUAZQAgACQAaQBjAG8AIAAtAEYAbwByAGMAZQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAVQBuAGkAbgBzAHQAYQBsAGwAUwB0AHIAaQBuAGcAIAAtAFYAYQBsAHUAZQAgACgAJwAiACcAKwAkAGUAeABlACsAJwAiACAALQAtAHUAbgBpAG4AcwB0AGEAbABsACcAKQAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIABOAG8ATQBvAGQAaQBmAHkAIAAtAFYAYQBsAHUAZQAgADEAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAG8AcgBkACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsAAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAawAgAC0ATgBhAG0AZQAgAE4AbwBSAGUAcABhAGkAcgAgAC0AVgBhAGwAdQBlACAAMQAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcAbwByAGQAIAAtAEYAbwByAGMAZQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand dAByAHkAIAB7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAYwBtAGQALgBlAHgAZQAgAC0AVgBlAHIAYgAgAFIAdQBuAEEAcwAgAC0AVwBhAGkAdAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGMAJwAsACcAbgBlAHQAcwBoACAAYQBkAHYAZgBpAHIAZQB3AGEAbABsACAAZgBpAHIAZQB3AGEAbABsACAAZABlAGwAZQB0AGUAIAByAHUAbABlACAAbgBhAG0AZQA9AEEAcwB0AHIAbwBwAGwAYQB5ACAAPgBuAHUAbAAgADIAPgAmADEAIAAmACAAbgBlAHQAcwBoACAAYQBkAHYAZgBpAHIAZQB3AGEAbABsACAAZgBpAHIAZQB3AGEAbABsACAAYQBkAGQAIAByAHUAbABlACAAbgBhAG0AZQA9AEEAcwB0AHIAbwBwAGwAYQB5ACAAZABpAHIAPQBpAG4AIABhAGMAdABpAG8AbgA9AGEAbABsAG8AdwAgAHAAcgBvAHQAbwBjAG8AbAA9AFQAQwBQACAAbABvAGMAYQBsAHAAbwByAHQAPQA4ADcAOAA3ACAAcAByAG8AZgBpAGwAZQA9AGEAbgB5ACAAcgBlAG0AbwB0AGUAaQBwAD0ATABvAGMAYQBsAFMAdQBiAG4AZQB0ACcAIAB9ACAAYwBhAHQAYwBoACAAewB9AA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:916
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall delete rule name=Astroplay >nul 2>&1 & netsh advfirewall firewall add rule name=Astroplay dir=in action=allow protocol=TCP localport=8787 profile=any remoteip=LocalSubnet
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4752
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall delete rule name=Astroplay
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5056
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name=Astroplay dir=in action=allow protocol=TCP localport=8787 profile=any remoteip=LocalSubnet
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5156
- C:\Program Files\Astroplay\Astroplay.exe
  "C:\Program Files\Astroplay\Astroplay.exe" --serve --port 8787
  2⤵
  - Executes dropped EXE
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://localhost:8787/
  2⤵
  PID:5320

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4776

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:1008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Astroplay.exe

Path C:\Program Files\Astroplay\Astroplay.exe
Size 7.5MB
SHA256 c28742ea377049cd2be23f4269603d5b9b1da93627c44aec29c64aba0cf30c11
MD5 ee9d36f73c1698348b66cb1704c68406
SHA1 d1a2cbdea0adb4c3a2c90a6f4b2764664448f1a1
SHA512 053abc159772e74ff8d76e26bc9199c5f4a9016d6ca69738082102813af02960a97f3eef9f167d71b144c1b6451091487062b54a2be1a1fef064f5e6752fafb7
SSDEEP 49152:bywq7e7cujy4HhkI+RpajNRxDB8xvMR11/a0hwDlmktHInzPj4qnmkd6O0Y6IyBm:bbXLFeA1dqlmuMkc6/z38aoEw
TLSH
T155868C03FCA555E9C0AAD23585629253BA317C485B3523E77FA0F3392F76BC06AB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.ico

Path C:\Program Files\Astroplay\logo.ico
Size 72KB
SHA256 47c5cbd39460be3b3bfa12d0788545d8a7b3300350dc939afbaccdd31f4279c0
MD5 01507787af96c6c757fa04a753f8acca
SHA1 ccdaaca60b5771be3ba4c261b0ca89b0041f4e79
SHA512 cf6b597c25c9f6e522d864a3dcdca736f0293235956403c7bca1a6566c2a5ddd2d7d0fe87db2f56c472f7b3c5d6c348780ed0bd66275ac2b1fb0a3358cc423df
SSDEEP 1536:L76rcYW1UwAYjgdeEi1Go6xEtNcADaC4gUZMUpzcM+A06UCI14S8XhW4aoMcXn:P6rcYqRlkKNcAG/gAzX+njySaWdoMC
TLSH
T1317302CD5F07A924ED03BDF5C30798E84BE624E81E22ED774276461E268A1958AF1373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4344_1014668584\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4344_1495847954\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

nav_config.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4344_287034503\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

inventario-actual.csv.tmp

Path C:\Users\Admin\AppData\Local\Astroplay\data\Registros\inventario-actual.csv.tmp
Size 113B
SHA256 20bd759f09f68b43427d2eccf93f73ac83a8baea9bf2d09b597a3d9e81d4149b
MD5 1fceec3bd35adfe23acebce801166883
SHA1 30f013f92e40940ac0498b806ab04e9fec01e3ba
SHA512 18dd2e67a82521361a8b86bd5d53dd6c7eee700f2a58d228806fc5126f5392ebf2818dc4fe1ff7239e7af9470ce66ff47c0d1a0576ef72d803ed6531cbee6e18
TLSH
T15DB09266992A23EB07A0362097C4F285E9AE609A863A01AAC120C50A0045A00C36BE3E
MD5 SHA1 SHA512 TLSH

Submit Download

resumen-diario.csv.tmp

Path C:\Users\Admin\AppData\Local\Astroplay\data\Registros\resumen-diario.csv.tmp
Size 180B
SHA256 29943d3a148bdabeae1db537133b5911c6288914742b2bdac1b2429874668b9d
MD5 501c187bdd6ec96d22c3a6c56f14d5b2
SHA1 a4a16dfc689e46c8a61763ea136ef040cbb87112
SHA512 d99ab1ed91fafaf1c567c642cd034e0477ce318e844686b0444ee0055e928c78b814471fc1e2f455ebfe6756b1a10dc9081f81b7f88edc8c2d463a37ad158638
TLSH
T146C0220E0C023BF1454AC20E3313A129B04CAACD210CC1B077398A38C0C02C2CCB0523
MD5 SHA1 SHA512 TLSH

Submit Download

datos-2026-11-07.json

Path C:\Users\Admin\AppData\Local\Astroplay\data\backups\datos-2026-11-07.json
Size 20B
SHA256 520698645a007a04d195527716a9b82a7999a7dd9ff71f2395c4eb236fafef4a
MD5 73147ff99189cd97ab165fb0caf6079b
SHA1 a5905abdd0cde6c765d2ec1ff28ef482071f593f
SHA512 fa081ee81c403828a2152511de74f209fa090d19c0cb05a7ea82f0a4377ef0070148c9ba30944600ff17a9155f3754e709c8f389081e6cdc3be051394696d6b3
MD5 SHA1 SHA512

Submit Download

licencia.json

Path C:\Users\Admin\AppData\Local\Astroplay\data\licencia.json
Size 198B
SHA256 2ec4e08c22dd437f22c602a8ada788db737beffba389a9e2f63aff292a00381e
MD5 f2659ab1e817bba7b7dcc83d4879fc2d
SHA1 59e4bb288ad18831a31e5ea9b33ad2d4707f4de0
SHA512 63d063692907a6ddf56415e2f234ac131267dbc41a151b0818f05b4acf1b6074337818adc679518be4ef2862192990ec07291e5901fe9b69beeb6f2b8dbeeec2
TLSH
T193D0123A485508270DE40111503B10873B04ED9B43843427E367DD24824E57B15F75BD
MD5 SHA1 SHA512 TLSH

Submit Download

prietto.log

Path C:\Users\Admin\AppData\Local\Astroplay\data\prietto.log
Size 391B
SHA256 2f552cac9f049a45769f9243bc260b0a0ac552d76726c778f45ca80639ccccf3
MD5 1856a849d6fc7531e955cd82e5bb1984
SHA1 e504819428267684bcb29caade4eb233106eba5d
SHA512 aec26268291799cf07501933b442a7731499a458abaac7e927696da5e53bea7cd43bec3a8e3d746ea422c5a1298c6ce2e775951635ef5e2e1c8a43497b73097a
TLSH
T1FAE09B47A4CA857D404D0017C5F3B98CC5BC1654BF5F7B895354ECA822C741D7596CE5
MD5 SHA1 SHA512 TLSH

Submit Download

lucide.js

Path C:\Users\Admin\AppData\Local\Astroplay\data\vendor\lucide.js
Size 349KB
SHA256 3411692820cb8d47543f69496aa25fd603a358f4498046f41c508a5a3342210e
MD5 be92f985b6e9aa4c37648c5eea72a759
SHA1 583df3e9565c63fc6dca4c8d75f01c48534851ae
SHA512 a304b6ff97428a209931a5313203d126d8ba8799610ac6667e878444ce734a3438109c993b059b98e3f5d3e9a1d0560b6c85a65b5bb4085160570b370f96a018
SSDEEP 3072:K4Zr8BFW9+0HJBnj1CmOp3S7PMKstZ4hvdQpPO4L+ZZ2jDojUTrsuwHXQNhTkC+D:QeMS7LCT/siJkC+bss
TLSH
T1C27496AFCFC9265F496AE3881A4BB0111FED63BE370A8C12758ED137E155816DCB3621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxing.js

Path C:\Users\Admin\AppData\Local\Astroplay\data\vendor\zxing.js
Size 328KB
SHA256 d7cc8f69dd70bdcf3ac00c9ae572bf2acb9f4132ba379c72df842e4db918652d
MD5 bc4aee4e60193999c1917a1e14715007
SHA1 9e41ea8b1293ff426f786b99dfb476791410ed05
SHA512 6452cadd21ea25d15f3da063272a1da6dace83d9d0662d79fbd3653e26202748c936aab2ce096ab1e1a0ee2716fdceea5733a1c48c3f5b8573f20f19dc4c90b3
SSDEEP 6144:hwGpN8bzNmbO5fJUghtVWkem0RYNu92gsLTOVCY8bzNEiLdrV4FKDqVpo+JBrbV:CGoJPhtVWkem0RYQ8gsLTOVMdre
TLSH
T12364E9A033E260F797DA16CA04A15051F66D65A9380E147CFFACADC76819CC392FAF35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

version.txt

Path C:\Users\Admin\AppData\Local\Astroplay\data\version.txt
Size 5B
SHA256 8248f7772687aff0b103b36898908deb82126337f933e49a5ac04829093c58ff
MD5 5337810b0c500ace9c4cd745f4b8bcf5
SHA1 d1325bb186bd83303245e504f7c6eceae7f19e44
SHA512 5753b285d3f7881f06c35bb16931cf2a5408f13701855d5c7b2810f34e9bb266392d80ff15253a79f89d30a9ed0eec3be0e7e81677a7dbfa1e15a3907a50b02e
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
TLSH
T1BF610E323375B1D4C9567F072E2819C053BF8396EA94AF5CB29C621ED92641B8F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

69c5e47b-25f8-4ec4-80a3-6726e6ef75f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\69c5e47b-25f8-4ec4-80a3-6726e6ef75f9.tmp
Size 8KB
SHA256 a3263b850cbabf6c1770a32a962bb9799e17eecbf597fd50b34d7f4594fbd9ca
MD5 847127eca76669be7358564eb4cdda3a
SHA1 275f0ee59575db2f3b77984f7c62883a5afdce53
SHA512 22f023cf652d9e6b3aeea6d2e9a1c03fe942a5d2448dd0e916aaaa1e44b06165dcd80102ec8ae5517dc58dc058acf5a3f23147ed50c159407788259c91d45668
SSDEEP 192:YONE6wlDlQmiUyQNI4X58gZDOKaFbAWWaWveoqRMU6:YONE6kDTI4X58EDOJbAWWaZcU6
TLSH
T145121830B479EC371DE6A109F58736939FA521B7E945AF84D6E81A1C00D679C278FC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b81d8521f4289b1259fa60587a7bc7131f06581c3a734224a7de2fe2669bfb7
MD5 46bc1ee7f1b3386bbc305d48ade31614
SHA1 b5e469cf75c16715fb850bd86db01e329da2928e
SHA512 09a97914c725107f4c125aa0ff0826f0410030841011f0bc5c9eed9e023261ab13abc5f59c9c311d02baf1b25e7398de5ea81438c8a8ede3cc60ca3906edfce9
TLSH
T152D022F2B3A208E8CCC02A3C20030B080208C8000C83B320C832C0C22ECEBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

28df278f-7aa6-4fa4-9c31-13f10af26408.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\28df278f-7aa6-4fa4-9c31-13f10af26408.tmp
Size 32KB
SHA256 b6085eb338658aa147947ad2c5a23da850ab3e7ec8e03c29ebe9fc64051a05cc
MD5 3346ba588f7282660353f94182ea9324
SHA1 386f4ed8237773d698b5ed74ba6208911130b58d
SHA512 ab90fcf5057975e4ba1d2391aa9fc18eec6bd0ac7da691cc29ae86cc6faf72e199b5f0cbc8345ae8eff3edceae15539fa57749ece7bd0ac78ed4e07703bac7e9
SSDEEP 768:1yy4JPX7pLuLj/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVTRjiLlc2Tb3ror:1yy4JPREj/DWvbtBhu1jaKRjiLm0bkdN
TLSH
T105E2EA3B780CCA7E4F800A9DED1E7F9F7EA8028B96D8C95047F9945C02D67EA51160DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

72998154-6b96-4e87-b80f-afe9b295c24f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\72998154-6b96-4e87-b80f-afe9b295c24f.tmp
Size 10KB
SHA256 5fdaf90609ddb1bd2d5bbf3f0d2d7b9cb78e5f42920f6092931c3ef91e558655
MD5 3436a57d25310a3ea818507a4b4244b1
SHA1 6b7ca2e0b9f6381146b9bff365ce29406cc58fc7
SHA512 68ca745ba9ace475fa60bd8b22e0d09a5f36135f93fa6ec7c5343b555e94a9602273c5a9b971668f3b4797a8be9c63002241173f73070170e4b37ea5d72bc704
SSDEEP 192:sxZdYRysj/fwssZNStLjjIdpJXHW6+WNzpVfYrpLsjIg5f2J:sxZdYtj/fwsKcLj8BHbXfDdC
TLSH
T14D32FB626E28B93B9CC7E20DBB157F53E6F6513291841E44AAFC861C05E7BCD224741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 88d240fc69ca9150a6db2a1b0511ef18dd937d64be55bcd9cc92c52c2fd7cbbc
MD5 2477b7b29b64eb6f75053e23700bef07
SHA1 36a1e3555d37634a926994fc285d8317021c3e31
SHA512 32f1b3c8120dd36375ac59427dce15bb489bd6e79e9b126f0db691510bf578a3750b705ce1e1c4a9c4f155f93e588ae450d281f4299a5ff736a77689a33087e1
TLSH
T1CDE026C488CCC22EA28CA44B11F86B4CC2C1369A93E16E0E2708C48C7243058E3866B1
MD5 SHA1 SHA512 TLSH

Submit Download

f_000069

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000069
Size 231KB
SHA256 0d6879534514d7939c83714c92dd1b90692e067c42b5e80e4645a67208ab7f0f
MD5 1ec8bf285ec5aa6f8bb2b07c2f9d4a22
SHA1 ca734b61ae1f953b13946e6562c1fe03b0634f9a
SHA512 e969a61912ec69b6283203090b19e48a2dc760f11b5aa9055251dd0e4c98ce411a5f44cc3b6ba5bac53fe2a7ef3fe851d5a78a2d885352f9d0c3fcfd8764022f
SSDEEP 6144:T+4oPrci/S430dsJaWxRwNTR4sUT6Y3fjlVagq0:T+D06JBQWa70
TLSH
T1AC347C21F5B685B67C33227D639EA61C3B29A057CC0DCEAEBBC461218F853F99DD1604
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006a
Size 531KB
SHA256 b23036627cb375d3eabbbb73ef5f81006da832c027843ab1346a21bf6e9bcff8
MD5 dd5b186f0dfe01d0176e55f699ee7c0e
SHA1 e994ca25d7f6040c398ea785539f1cf3ec52f3d8
SHA512 5fa84da48d9592d86f1c62f95caa9eeba77b69b2d9144c55ebc5e934bec82c4cbce0ea2ce113ccf967bd9820e23ebf31d0ff72b7a057ad49727a99fb4e90d061
SSDEEP 6144:TSUq29dLFsUT8le5PzvoNODU6DNVYGE65SoYZjgpe9DmvvMIJzLcAY:TU2KazvoQ66ULkVvMIJzoz
TLSH
T145C45B94E179BFEDF97605E0446F800D722E5B99C90E8874B478FC251A5C484BAABFCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 4cf4622623fff3332f1ed11f1bf3aeaf533d79f29606739b5776af7c66789d9e
MD5 d095fa964598b76833cb4a0fdefe4321
SHA1 ec49cc72f9b39dc077b33fa5009b655e5c0d7ee1
SHA512 2892e7a1d6babc0f11ede650ebacc897cbe19eb04e54e9a7ddf7a3c739b29c45df984c0ceaf169c9898a4c94cde882e2d44b32410e41a2f1956467df424863bc
TLSH
T1E351817A555A88D4FF5840F0DEE984873DB8697D69C38E0A37B0DCB6B8027797804C90
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 e52269632fab129e63f7964eaafceb3679df7d43166c314e2274684b4ca4cc5c
MD5 714980552fe6611fd09e28284003b1c1
SHA1 fc42cec8ba657c61998ae68e000642cf672f66f5
SHA512 b0d1cab63a299c3eb265b1b2b38ec90c2e4f1dce6568b52404c7b4d094b3f6b7fede09551340ca0d693a85648eb4a2213f4005c146c7a45b2ec26e9ae6729ec6
TLSH
T159514FBA454A48D0FF5850F0DEE985873DB8A97D55C3DE0A37B4DCB6A9427797804C80
MD5 SHA1 SHA512 TLSH

Submit Download

8f360174-b2be-4844-ae0c-7fd721e37860.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\8f360174-b2be-4844-ae0c-7fd721e37860.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

94799690-7f23-44b7-a6b8-c037281a1123.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\94799690-7f23-44b7-a6b8-c037281a1123.tmp
Size 1KB
SHA256 54a0304699a4cbc58cf30d93791f43c11f2f85b3da0bdb127fb07f549c575720
MD5 0cb9778f711a252d0e081781954ba682
SHA1 abae8f75ac1fa6359d4da164c479d0d60cc1e8a3
SHA512 1788370dc0c6539f755cfd54a6970dad19354e997ee6c2835078ca25bfc34a7a1326ce0f1871bb4b232f668b71484ec2e30f40d00d306ce75248c37cb65b4a1c
TLSH
T12C41AEF3C3E8856E890156F0AB186E2BDE2D0A55432C3D9AC9E4AF1B93F3471D14199F
MD5 SHA1 SHA512 TLSH

Submit Download

ad3bf9e5-0e02-450b-9e9c-f79da0181c94.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ad3bf9e5-0e02-450b-9e9c-f79da0181c94.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

dd44c940-d902-407d-85cd-b5a999a5e7db.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\dd44c940-d902-407d-85cd-b5a999a5e7db.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 9db16a48bf877994b893bac0fbd40206a68b7c8a5cb6643ba435a54be3da4605
MD5 0e75f01d96f9a916e616746f5c31cc99
SHA1 dcadf0b7e5ac76ebb30cc28fe0d41af149e32906
SHA512 39b034122a3b6537b94215dd5048a995a204e44086991600d97b8ad491cc18552933f2aca2c309b1735e285d41fea677978fae323f953735a9b3d232539d1cfb
SSDEEP 192:sxZLRysj/fws9ZNStLjjIdpJDHW6+WNzA3/YrVBsjIg4J:sxZLtj/fwsHcLj8lHbo/Lc
TLSH
T1FC22DB526E28B53B8CC7E21DBB25BF53E6F9513291841E48EAFC861C04E7ADD224741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da76ab46-3cd7-48a5-a5cf-90bd1e0fb43f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\da76ab46-3cd7-48a5-a5cf-90bd1e0fb43f.tmp
Size 10KB
SHA256 f113e1c2416e111b68fe99dc2b36747bc886124a637af9fa3a6a8c277fb0304c
MD5 00eeeb0e4cc1d4407f678223b36c319b
SHA1 28c75bd3bfa114f0c7adf64d70eb47fdadad0f14
SHA512 1043f58c6ee36f5ac171d10509659543c811382fd22aa32a6433e4e9da995f2a4f990d7954eb2add2c3d1ffafaa055a98752cb40827911ed19dc74c56a882fc6
SSDEEP 192:sxZdYRysj/fws3ZNStLjjIdpJXHW6+WNzpVfYrgBsjIg5p2J:sxZdYtj/fwspcLj8BHbXfeLC
TLSH
T1D222EA526E28B53B8CC7E219BB257F53E6FA513291841E44EAFC861C04E7BCD224781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ee6900e4-7eec-4b58-a764-25d4511bbe61.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ee6900e4-7eec-4b58-a764-25d4511bbe61.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d651da97-d93f-459d-80e1-e79a766d6e05.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d651da97-d93f-459d-80e1-e79a766d6e05.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b7d539af5d0778ff059bd1b0f7b3b02eacd8ac79e88385d20949030d2cdc97fb
MD5 4c20cb32a86b353b8f6aa598084fb135
SHA1 158a382a0b8e7dfd77e62d9dc9b06d98a3d1cadd
SHA512 e180ec5500e3d4901c3ae23efaf35a5619906ff85059a9f1c6cef7fd05914bfb3bce2636d8d52a7f4be5291e455c1d7e06689aac74d771ed56817a014b7e56fa
SSDEEP 192:1ON46wlDgQmiUybNW4X58gZDOKaFbAIDlbQUU6:1ON46kgKW4X58EDOJbAsrU6
TLSH
T18402E935B9787C7B8EF2AE09F58B36139FA5106BE6512F80CAE81A2C00D765C1347922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

a75e88ae-2e35-4778-8b61-a9406e326c51.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a75e88ae-2e35-4778-8b61-a9406e326c51.tmp
Size 18KB
SHA256 f61d5d1d464ca01ebec16e13e494b8cdfa6ba4161c2cf7a7a404e1788bc55b92
MD5 0bb64bd7fbc8b27ff1faa9cd3413c6f9
SHA1 252619cb6cd8643af9bb0f2b24a58bab7a54705a
SHA512 bbcfd0dd9adba44043570ee7c54f0a82cc312fbe5b8051bafcdbf511fe4277a34f4ddea5cd93cf1f57a6ad0a87db76064ac6919dce3a1013f562c9ab5e58bf8e
SSDEEP 384:ncQkUSv0sNhZmZ9FdP2HX58EDOJbAWWaecH7vBEnmt9AIIlp:c0/JJQa4OdWcH75E4mLr
TLSH
T103828D31A47AAD3709F7A109F28A3693AFF4A1A7D8C40F50D9DD9B2C00C678D234BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6c7ec96-6ea1-4130-a7e1-81a0e47c584a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\e6c7ec96-6ea1-4130-a7e1-81a0e47c584a.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

eb35596d-2acf-4880-afb5-7ca9a0ed3741.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\eb35596d-2acf-4880-afb5-7ca9a0ed3741.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

f6a3e5e3-44b6-450e-82f6-07aaf17f51c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\f6a3e5e3-44b6-450e-82f6-07aaf17f51c4.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

e668657b-819d-44fe-a8b5-fe85e893b143.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e668657b-819d-44fe-a8b5-fe85e893b143.tmp
Size 28KB
SHA256 35226b1b6039d8a648a2902ac8681648903ec9296ccb747b249acf28aef0f0fd
MD5 030aa8387b5c4a201d16981092c57ba1
SHA1 1a0a240d034d4e9cbc095672fc42725c513487e8
SHA512 e19655491f2990c1ff094f51b3fabcb2b9b92409eeb9f90457b66736c6dbeb9537a376b3fe45a8a3667cb2150f7372ee4b21fdcfc5dc9d02f4f98696fc85e1e8
SSDEEP 384:neiFzQkUSv3zsNz8TUNTUlIlZmZ9kdP2XDfwVX58EDOJbAWWaVcH7vBEnmt9AIIr:1FdjGwgiwJl1a4OdtcH75E4mLr
TLSH
T14DD292F594D79936E9AE5387A73D3D869EBCD153B4884980FB885D1CCC822BFD30A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

40129b53-e270-49cb-b07a-05e1cb70ddad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\40129b53-e270-49cb-b07a-05e1cb70ddad.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f8baa2f5-9614-4984-ab84-27b19f3ac216.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f8baa2f5-9614-4984-ab84-27b19f3ac216.tmp
Size 18KB
SHA256 05786e3b26082c08d1596810ac0fb2b2acfd7881bc2ba9dd3a323acbd3a3b2c8
MD5 a4a97b81ae1a76e4c57079cfd33bba4a
SHA1 c1416cd52b81524bac66bf5e375721c056a2f084
SHA512 c821ed3db04e63dac6ef39d49dbc52f4e6f17dd217d5cd578c3eefb868d7f9d7aa98e7cd5357bf02fc2ade3b06a07952ed48ff4c73b698438f4ebb7f4a2cf529
SSDEEP 384:nrQkUSv0sNh8mZ92duHX58EDOJbAWWaecH7vBEnmt9AIIlp:l0w6Wa4OdWcH75E4mLr
TLSH
T197828D31A47AAD3709F7A109F28A36939FF4A1A7D8C41F90D9DD9B2C00C678C234BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 37819070071b7ca20257351048b6ee80005f2c03e1e1c4115011a90143241b37
MD5 a937c977469ab40a13c56fbcba50e449
SHA1 f5dc8767fa35b490f5e08500f220c947edcd83b9
SHA512 f90588235a2cf427fb931206df6c1ee32f0f5052e5141fef05e8077552207a927bbd36b50d26eccb4e6bbe8cf2ffffae950f6aab2c58155fb57972fa6278aaec
TLSH
T1F041575CA2F90148B3B76F5AABF7A86D487EB8772E06D05D10110E4E0636B01D872737
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 beebad969e102cfce9dff9e0a99964107519004cf31634fb450cb2569fb71094
MD5 a9988ff7f4ec50f9ed42934110e5ba44
SHA1 50dafb43a55b345044cd9b330aafce316ad43fac
SHA512 2dc1ee06a76fb19222f540553b57bcd720bc84860c528bff19eb32cdfdad65275fd36051fed85272c578c87078784225baca89ca86200245cd69f26b603bd16a
TLSH
T1E5217837B3DCC921CC86163A109D9C1176B683C7819EDF9FABC4D614A07F999CB71294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
MD5 d8b9a260789a22d72263ef3bb119108c
SHA1 376a9bd48726f422679f2cd65003442c0b6f6dd5
SHA512 550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9d5367afff64011b621c73c310c4b8bda206ec02726aadc0b17572d90888b25d
MD5 8e7a623fcc311b5017c82b1181911569
SHA1 048d36afc6481760c53cff348c05744d98f3cce7
SHA512 3848945ad50086a6af42f9640bcebf3fecac3d8a6f2012eeb786a2def1a68f94848350bfec9115687b98f4e0bba643e807fbf1efd715d676e0d634f158e5d231
TLSH
T18A215227B39CC9A1CC86163A109D9C1176A683C780AEDFDF6BC0D614A1AF998CB61290
MD5 SHA1 SHA512 TLSH

Submit Download

6f021a6c-5f98-4c18-976e-19ce971e05c4.tmp

Path C:\Users\Admin\AppData\Local\Temp\6f021a6c-5f98-4c18-976e-19ce971e05c4.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

954c5a3b-deab-4a0a-bb20-2a14c42e7482.tmp

Path C:\Users\Admin\AppData\Local\Temp\954c5a3b-deab-4a0a-bb20-2a14c42e7482.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_jigfpman.vax.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jigfpman.vax.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

9641dc1f-7162-4f03-9684-bbea0803a3dd.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4344_1053313557\9641dc1f-7162-4f03-9684-bbea0803a3dd.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4344_1053313557\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4344_978245090\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Astro Administración.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Astro Administración\Astro Administración.lnk
Size 1KB
SHA256 5c640988f402f392d069f972f65bf41450be35f9aa238ff2b44cd2ae490d1d27
MD5 d640327923249cb1fa00f8247b65ee48
SHA1 c11f657b2d3927a6a2dc7eb23868697f59286adc
SHA512 578e26f6b6acea9982dd08e4e8e42321985c1a1465346dff77093c8d2e4762de7cbadd46d55558379f1e3a6e97198e0931ac47581a44c9e0535193d8e618bec5
TLSH
T181419E1A27A41B65F7F357357AA34D31423FAC03DA194B0A538852C908B82057424F67
MD5 SHA1 SHA512 TLSH

Submit Download

Conectar celulares.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Astro Administración\Conectar celulares.lnk
Size 2KB
SHA256 1378d58abe523d3a7dd7af0259a7ccc2cb80cd87331e2004ae9c859179468ea5
MD5 c38eecd93cfaf8cd0f24769081970455
SHA1 a431ba84f86bfa535c76e761a19db44fc1f92692
SHA512 dbb709692d435509a1666c1f4d7b211ee655154e0a7960792f3273ae75586c1d5898cf49f549670602b436406071110b17f22042d0aa8584ecfa4153d494bec7
TLSH
T10E41AC1927A41B66F7F39335BAB20D35463FBC02DA194B0A53C802C908B86057824F27
MD5 SHA1 SHA512 TLSH

Submit Download

Desinstalar.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Astro Administración\Desinstalar.lnk
Size 1KB
SHA256 ee4820fdf3734f65909b0fad158520610af830364fd377aba7996f05a36f7644
MD5 4e4cd83b84f5b3d16e8732424fc122ab
SHA1 62aef61d6849250ae69044a717d7e02ed1962c7e
SHA512 3ae746661b991c4e04f17350321e1153cb1a3e29ab65dc812fb6b1a26e04c42cfcf5ccfb9807b173b4922b96d7c65fc1f5ecb94f4ed9c2346a13829d7e0b521d
TLSH
T136419E1927A41B65F3F35735BEA20D31463FAC03DA194F0A538842CD08B8605B474F27
MD5 SHA1 SHA512 TLSH

Submit Download

Mis datos y planillas.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Astro Administración\Mis datos y planillas.lnk
Size 1KB
SHA256 cbdba00fcd9baec0a5c4a915be7dae9b360c41e72dcfc7edd5f6f3c17418154a
MD5 adb00232781c4cb44d167503bf54c419
SHA1 a4255587cfd9318e7ddf9c9fa3bab26a385d29ec
SHA512 da9d7a8ebbf4c1f86825c84cb5a815415a85322eb816c9653b8589ef7c1f832cb3b035707b3f7523dc9b5eb9f1f737bd8493bd617d7773fde4c5bceaf31f20fe
TLSH
T12911F7068E921B12EBF7CF7099EB6A21CE766C46EF955F1A014480883474A05B9B5F2B
MD5 SHA1 SHA512 TLSH

Submit Download

Astroplay servidor.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Astroplay servidor.lnk
Size 1KB
SHA256 e955f6a7dbb82dd3358052f864be3218bf6aeee5ed44efd92925d4b638e1e406
MD5 2ae619af35c872f06232a4981562fd77
SHA1 9f40adab8a6b3ac011e5e82805eae68d7e165291
SHA512 bf0e778604fbdaea15fa2e8df982548eb682e1bb1edb957765250ee85e44f4803d4a7be3c99077c66b73b4aee9bff26f9724cd681c4984588138a3912ed51b1c
TLSH
T1AB419E1A27B51F65F3F35735BAA24D35463FAC02EA194F0A538852C908B82057574F27
MD5 SHA1 SHA512 TLSH

Submit Download

Astro Administración.lnk

Path C:\Users\Admin\Desktop\Astro Administración.lnk
Size 2KB
SHA256 eb02068cea627f384e9af35bb961a39399b7ba5c89db92ae9d1a397c83cbaff9
MD5 5817bc3b719b9371a96d696ac35796a3
SHA1 fb616d73f27a72a9378da81cbe327254ee07a57d
SHA512 46bf812d4871e1dd060b71e0376fe8c71348c7dae49966eef6330c8f4bcfeda6129fe41552bdde01aa87e15c139c48719d46370113086aa2b1140b4b4f909faa
TLSH
T120419E1627B41766F7F39335BAA30D35463FBC03DA294B4B538853C908B46057564F6B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/100-13-0x000001AFC2A50000-0x000001AFC2A72000-memory.dmp

Download

memory/100-6-0x000001AFC2B10000-0x000001AFC2B20000-memory.dmp

Download

memory/100-5-0x000001AFC2B10000-0x000001AFC2B20000-memory.dmp

Download

memory/3964-37-0x000001C41D930000-0x000001C41DB4C000-memory.dmp

Download

memory/3964-25-0x000001C41CBA0000-0x000001C41CBB0000-memory.dmp

Download

memory/3964-26-0x000001C41CBA0000-0x000001C41CBB0000-memory.dmp

Download