c28742ea377049cd2be23f4269603d5b9b1da93627c44aec29c64aba0cf30c11

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 13:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Astro-Setup.exe
Size 7.5MB
Sample261107-qfz1wsys2j
SHA256 c28742ea377049cd2be23f4269603d5b9b1da93627c44aec29c64aba0cf30c11
MD5 ee9d36f73c1698348b66cb1704c68406
SHA1 d1a2cbdea0adb4c3a2c90a6f4b2764664448f1a1
SHA512 053abc159772e74ff8d76e26bc9199c5f4a9016d6ca69738082102813af02960a97f3eef9f167d71b144c1b6451091487062b54a2be1a1fef064f5e6752fafb7
SSDEEP 49152:bywq7e7cujy4HhkI+RpajNRxDB8xvMR11/a0hwDlmktHInzPj4qnmkd6O0Y6IyBm:bbXLFeA1dqlmuMkc6/z38aoEw
TLSH
T155868C03FCA555E9C0AAD23585629253BA317C485B3523E77FA0F3392F76BC06AB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3432	powershell.exe
5688	powershell.exe
4688	powershell.exe
2064	powershell.exe

Modifies Windows Firewall 2 TTPs 4 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4788	netsh.exe
2280	netsh.exe
1260	netsh.exe
4560	netsh.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Astroplay servidor.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Astroplay servidor.lnk	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
4164	Astroplay.exe
3908	Astroplay.exe
3356	Astroplay.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Astroplay\.permiso	Astroplay.exe
File opened for modification	C:\Program Files\Astroplay\logo.ico	Astroplay.exe
File opened for modification	C:\Program Files\Astroplay\.permiso	Astro-Setup.exe
File opened for modification	C:\Program Files\Astroplay\logo.ico	Astro-Setup.exe
File opened for modification	C:\Program Files\Astroplay\Astroplay.exe.new	Astro-Setup.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_1777593740\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_1954107400\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_48820475\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_1752998812\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_871903886\_locales\ar\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4236	cmd.exe
4768	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Astro-Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Astro-Setup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3420	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-560646293-820748483-2532804640-1000\{A5E980FD-174B-4E95-9C02-8FD346406373}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3432	powershell.exe
3432	powershell.exe
5688	powershell.exe
5688	powershell.exe
4688	powershell.exe
4688	powershell.exe
4688	powershell.exe
2064	powershell.exe
2064	powershell.exe
2064	powershell.exe
5428	msedge.exe
5428	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3432	powershell.exe
Token: SeDebugPrivilege	5688	powershell.exe
Token: SeDebugPrivilege	4688	powershell.exe
Token: SeDebugPrivilege	2064	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 3432	3372	Astro-Setup.exe	89
PID 3372 wrote to memory of 5688	3372	Astro-Setup.exe	94
PID 5688 wrote to memory of 4236	5688	powershell.exe	96
PID 4236 wrote to memory of 4560	4236	cmd.exe	98
PID 4236 wrote to memory of 4788	4236	cmd.exe	99
PID 4164 wrote to memory of 4688	4164	Astroplay.exe	100
PID 3372 wrote to memory of 3908	3372	Astro-Setup.exe	102
PID 3372 wrote to memory of 6032	3372	Astro-Setup.exe	103
PID 6032 wrote to memory of 2864	6032	msedge.exe	104
PID 6032 wrote to memory of 3420	6032	msedge.exe	105
PID 6032 wrote to memory of 1672	6032	msedge.exe	106
PID 6032 wrote to memory of 1672	6032	msedge.exe	106
PID 6032 wrote to memory of 1672	6032	msedge.exe	106
PID 6032 wrote to memory of 3528	6032	msedge.exe	107
PID 6032 wrote to memory of 3528	6032	msedge.exe	107
PID 6032 wrote to memory of 5568	6032	msedge.exe	110
PID 6032 wrote to memory of 2364	6032	msedge.exe	109
PID 6032 wrote to memory of 5568	6032	msedge.exe	110
PID 6032 wrote to memory of 5568	6032	msedge.exe	110
PID 6032 wrote to memory of 2364	6032	msedge.exe	109
PID 6032 wrote to memory of 2364	6032	msedge.exe	109
PID 6032 wrote to memory of 5880	6032	msedge.exe	111
PID 6032 wrote to memory of 5880	6032	msedge.exe	111
PID 6032 wrote to memory of 5880	6032	msedge.exe	111
PID 6032 wrote to memory of 1368	6032	msedge.exe	112
PID 6032 wrote to memory of 1368	6032	msedge.exe	112
PID 6032 wrote to memory of 1368	6032	msedge.exe	112
PID 4164 wrote to memory of 2064	4164	Astroplay.exe	113
PID 6032 wrote to memory of 2492	6032	msedge.exe	115
PID 6032 wrote to memory of 2492	6032	msedge.exe	115
PID 2064 wrote to memory of 4768	2064	powershell.exe	116
PID 4768 wrote to memory of 2280	4768	cmd.exe	118
PID 4768 wrote to memory of 1260	4768	cmd.exe	119
PID 6032 wrote to memory of 1188	6032	msedge.exe	120
PID 6032 wrote to memory of 1188	6032	msedge.exe	120
PID 6032 wrote to memory of 5420	6032	msedge.exe	121
PID 6032 wrote to memory of 5420	6032	msedge.exe	121
PID 4164 wrote to memory of 3356	4164	Astroplay.exe	122
PID 4164 wrote to memory of 1884	4164	Astroplay.exe	123
PID 6032 wrote to memory of 4280	6032	msedge.exe	124
PID 6032 wrote to memory of 4280	6032	msedge.exe	124
PID 6032 wrote to memory of 4280	6032	msedge.exe	124
PID 6032 wrote to memory of 3260	6032	msedge.exe	126
PID 6032 wrote to memory of 5748	6032	msedge.exe	127
PID 6032 wrote to memory of 5748	6032	msedge.exe	127
PID 6032 wrote to memory of 2804	6032	msedge.exe	130
PID 6032 wrote to memory of 2804	6032	msedge.exe	130
PID 6032 wrote to memory of 4220	6032	msedge.exe	131
PID 6032 wrote to memory of 4220	6032	msedge.exe	131
PID 6032 wrote to memory of 1056	6032	msedge.exe	132
PID 6032 wrote to memory of 1056	6032	msedge.exe	132
PID 6032 wrote to memory of 3828	6032	msedge.exe	134
PID 6032 wrote to memory of 1668	6032	msedge.exe	135
PID 6032 wrote to memory of 2348	6032	msedge.exe	136
PID 6032 wrote to memory of 5196	6032	msedge.exe	137
PID 6032 wrote to memory of 5196	6032	msedge.exe	137
PID 6032 wrote to memory of 3972	6032	msedge.exe	141
PID 6032 wrote to memory of 3972	6032	msedge.exe	141
PID 6032 wrote to memory of 4608	6032	msedge.exe	142
PID 6032 wrote to memory of 4608	6032	msedge.exe	142
PID 6032 wrote to memory of 1768	6032	msedge.exe	143
PID 6032 wrote to memory of 1768	6032	msedge.exe	143
PID 6032 wrote to memory of 5428	6032	msedge.exe	144
PID 6032 wrote to memory of 1924	6032	msedge.exe	145

C:\Users\Admin\AppData\Local\Temp\Astro-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Astro-Setup.exe"
1⤵
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnAAoAJABlAHgAZQA9ACcAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEEAcwB0AHIAbwBwAGwAYQB5AFwAQQBzAHQAcgBvAHAAbABhAHkALgBlAHgAZQAnADsAIAAkAGQAaQByAD0AJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwAQQBzAHQAcgBvAHAAbABhAHkAJwA7ACAAJABpAGMAbwA9ACcAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEEAcwB0AHIAbwBwAGwAYQB5AFwAbABvAGcAbwAuAGkAYwBvACcACgAkAHMAaAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAFcAUwBjAHIAaQBwAHQALgBTAGgAZQBsAGwACgAjACAAbABpAG0AcABpAGUAegBhACAAZABlACAAbABvAHMAIABhAGMAYwBlAHMAbwBzACAAZABpAHIAZQBjAHQAbwBzACAAZABlACAAdgBlAHIAcwBpAG8AbgBlAHMAIABhAG4AdABlAHIAaQBvAHIAZQBzACwAIABwAGEAcgBhACAAcQB1AGUAIABuAG8AIABxAHUAZQBkAGUAbgAgAGQAdQBwAGwAaQBjAGEAZABvAHMACgAkAG8AbABkAD0AWwBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoARwBlAHQARgBvAGwAZABlAHIAUABhAHQAaAAoACcARABlAHMAawB0AG8AcAAnACkAOwAgACQAbwBsAGQAcAA9AFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEcAZQB0AEYAbwBsAGQAZQByAFAAYQB0AGgAKAAnAFAAcgBvAGcAcgBhAG0AcwAnACkAOwAgACQAbwBsAGQAcwA9AFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEcAZQB0AEYAbwBsAGQAZQByAFAAYQB0AGgAKAAnAFMAdABhAHIAdAB1AHAAJwApAAoAZgBvAHIAZQBhAGMAaAAgACgAJABuACAAaQBuACAAQAAoACIAUAByAGkAZQB0AHQAbwAnAHMAIABBAGQAbQBpAG4AaQBzAHQAcgBhAGMAaQDzAG4AIgAsACIAQQBzAHQAcgBvAHAAbABhAHkAIABBAGQAbQBpAG4AaQBzAHQAcgBhAGMAaQDzAG4AIgApACkAIAB7AAoAIAAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAbwBsAGQAIAAoACQAbgAgACsAIAAnAC4AbABuAGsAJwApACkACgAgACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBSAGUAYwB1AHIAcwBlACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAJABvAGwAZABwACAAJABuACkACgB9AAoAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAJABvAGwAZABzACAAJwBQAHIAaQBlAHQAdABvACAAcwBlAHIAdgBpAGQAbwByAC4AbABuAGsAJwApAAoAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBSAGUAYwB1AHIAcwBlACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFUAbgBpAG4AcwB0AGEAbABsAFwAUAByAGkAZQB0AHQAbwBBAGQAbQBpAG4AJwAKAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0AUgBlAGMAdQByAHMAZQAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAJwBIAEsAQwBVADoAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABVAG4AaQBuAHMAdABhAGwAbABcAEEAcwB0AHIAbwBwAGwAYQB5AEEAZABtAGkAbgAnAAoAZgB1AG4AYwB0AGkAbwBuACAATAAoACQAcABhAHQAaAAsACQAYQAsACQAZAApAHsAIAAkAHMAPQAkAHMAaAAuAEMAcgBlAGEAdABlAFMAaABvAHIAdABjAHUAdAAoACQAcABhAHQAaAApADsAIAAkAHMALgBUAGEAcgBnAGUAdABQAGEAdABoAD0AJABlAHgAZQA7ACAAJABzAC4AQQByAGcAdQBtAGUAbgB0AHMAPQAkAGEAOwAgACQAcwAuAFcAbwByAGsAaQBuAGcARABpAHIAZQBjAHQAbwByAHkAPQAkAGQAaQByADsAIAAkAHMALgBEAGUAcwBjAHIAaQBwAHQAaQBvAG4APQAkAGQAOwAgACQAcwAuAEkAYwBvAG4ATABvAGMAYQB0AGkAbwBuAD0AJABpAGMAbwA7ACAAJABzAC4AUwBhAHYAZQAoACkAIAB9AAoAJABkAGUAcwBrAD0AWwBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoARwBlAHQARgBvAGwAZABlAHIAUABhAHQAaAAoACcARABlAHMAawB0AG8AcAAnACkAOwAgACQAcAByAG8AZwA9AFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEcAZQB0AEYAbwBsAGQAZQByAFAAYQB0AGgAKAAnAFAAcgBvAGcAcgBhAG0AcwAnACkAOwAgACQAcwB0AGEAcgB0AD0AWwBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoARwBlAHQARgBvAGwAZABlAHIAUABhAHQAaAAoACcAUwB0AGEAcgB0AHUAcAAnACkACgAjACAAUwBpACAAZQBuACAAZQBzAHQAYQAgAFAAQwAgAHkAYQAgAGgAYQB5ACAAbwB0AHIAYQAgAGkAbgBzAHQAYQBsAGEAYwBpAPMAbgAgAGMAbwBuACAAZQBsACAAbQBpAHMAbQBvACAAbgBvAG0AYgByAGUAIAAoAHAAbwByACAAZQBqAGUAbQBwAGwAbwAsACAAbABhACAAdgBlAHIAcwBpAPMAbgAgAHAAcgBvAHAAaQBhACAAeQAgAGwAYQAgAGQAZQAgAHUAbgAKACMAIABjAGwAaQBlAG4AdABlACAAYwBvAG4AdgBpAHYAaQBlAG4AZABvACAAcABhAHIAYQAgAHAAcgBvAGIAYQByACkALAAgAHMAZQAgAGwAZQAgAGEAZwByAGUAZwBhACAAdQBuAGEAIABhAGMAbABhAHIAYQBjAGkA8wBuACAAcABhAHIAYQAgAG4AbwAgAHAAaQBzAGEAcgAgAGUAbAAgAGEAYwBjAGUAcwBvACAAZABpAHIAZQBjAHQAbwAgAGQAZQBsACAAbwB0AHIAbwAuAAoAJABuAGEAbQBlAD0AJwBBAHMAdAByAG8AIABBAGQAbQBpAG4AaQBzAHQAcgBhAGMAaQDzAG4AJwAKACQAbABuAGsAPQBKAG8AaQBuAC0AUABhAHQAaAAgACQAZABlAHMAawAgACgAJABuAGEAbQBlACAAKwAgACcALgBsAG4AawAnACkACgBpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAAJABsAG4AawApACAAewAgACQAdAA9ACQAcwBoAC4AQwByAGUAYQB0AGUAUwBoAG8AcgB0AGMAdQB0ACgAJABsAG4AawApAC4AVABhAHIAZwBlAHQAUABhAHQAaAA7ACAAaQBmACAAKAAkAHQAIAAtAGEAbgBkACAAJAB0ACAALQBuAGUAIAAkAGUAeABlACkAIAB7ACAAJABuAGEAbQBlACAAPQAgACQAbgBhAG0AZQAgACsAIAAnACAAKABBAHMAdAByAG8AcABsAGEAeQApACcAIAB9ACAAfQAKACQAbQBlAG4AdQA9AEoAbwBpAG4ALQBQAGEAdABoACAAJABwAHIAbwBnACAAJABuAGEAbQBlAAoATgBlAHcALQBJAHQAZQBtACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlACAAJABtAGUAbgB1ACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKAEwAIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAJABkAGUAcwBrACAAKAAkAG4AYQBtAGUAIAArACAAJwAuAGwAbgBrACcAKQApACAAJwAtAC0AbwBwAGUAbgAnACAAIgBBAGIAcgBpAHIAIABBAHMAdAByAG8AIABBAGQAbQBpAG4AaQBzAHQAcgBhAGMAaQDzAG4AIAC3ACAAVAB1ACAAbgBlAGcAbwBjAGkAbwAgAG8AcgBkAGUAbgBhAGQAbwAgAHkAIABwAHIAbwBkAHUAYwB0AGkAdgBvACIACgBMACAAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAbQBlAG4AdQAgACgAJABuAGEAbQBlACAAKwAgACcALgBsAG4AawAnACkAKQAgACcALQAtAG8AcABlAG4AJwAgACIAQQBiAHIAaQByACAAQQBzAHQAcgBvACAAQQBkAG0AaQBuAGkAcwB0AHIAYQBjAGkA8wBuACIACgBMACAAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAbQBlAG4AdQAgACIAQwBvAG4AZQBjAHQAYQByACAAYwBlAGwAdQBsAGEAcgBlAHMALgBsAG4AawAiACkAIAAnAC0ALQBwAGgAbwBuAGUAcwAnACAAIgBWAGUAcgAgAGwAYQAgAGQAaQByAGUAYwBjAGkA8wBuACAAcABhAHIAYQAgAGMAbwBuAGUAYwB0AGEAcgAgAGMAZQBsAHUAbABhAHIAZQBzACIACgBMACAAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAbQBlAG4AdQAgACIARABlAHMAaQBuAHMAdABhAGwAYQByAC4AbABuAGsAIgApACAAJwAtAC0AdQBuAGkAbgBzAHQAYQBsAGwAJwAgACIARABlAHMAaQBuAHMAdABhAGwAYQByACAAQQBzAHQAcgBvACAAQQBkAG0AaQBuAGkAcwB0AHIAYQBjAGkA8wBuACIACgBMACAAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAcwB0AGEAcgB0ACAAIgBBAHMAdAByAG8AcABsAGEAeQAgAHMAZQByAHYAaQBkAG8AcgAuAGwAbgBrACIAKQAgACcALQAtAHMAZQByAHYAZQAnACAAIgBTAGUAcgB2AGkAZABvAHIAIABkAGUAIABBAHMAdAByAG8AIABBAGQAbQBpAG4AaQBzAHQAcgBhAGMAaQDzAG4AIgAKACQAZgBzAD0AJABzAGgALgBDAHIAZQBhAHQAZQBTAGgAbwByAHQAYwB1AHQAKAAoAEoAbwBpAG4ALQBQAGEAdABoACAAJABtAGUAbgB1ACAAIgBNAGkAcwAgAGQAYQB0AG8AcwAgAHkAIABwAGwAYQBuAGkAbABsAGEAcwAuAGwAbgBrACIAKQApADsAIAAkAGYAcwAuAFQAYQByAGcAZQB0AFAAYQB0AGgAPQAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABBAHMAdAByAG8AcABsAGEAeQBcAGQAYQB0AGEAXABSAGUAZwBpAHMAdAByAG8AcwAnADsAIAAkAGYAcwAuAEQAZQBzAGMAcgBpAHAAdABpAG8AbgA9ACIAUABsAGEAbgBpAGwAbABhAHMAIABkAGUAIABFAHgAYwBlAGwAIABjAG8AbgAgAHYAZQBuAHQAYQBzACwAIABnAGEAcwB0AG8AcwAgAGUAIABpAG4AdgBlAG4AdABhAHIAaQBvACIAOwAgACQAZgBzAC4AUwBhAHYAZQAoACkACgAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFUAbgBpAG4AcwB0AGEAbABsAFwAQQBzAHQAcgBvAHAAbABhAHkAQQBkAG0AaQBuACcACgBOAGUAdwAtAEkAdABlAG0AIAAtAEYAbwByAGMAZQAgACQAawAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAARABpAHMAcABsAGEAeQBOAGEAbQBlACAALQBWAGEAbAB1AGUAIAAiAEEAcwB0AHIAbwAgAEEAZABtAGkAbgBpAHMAdAByAGEAYwBpAPMAbgAiACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsAAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAawAgAC0ATgBhAG0AZQAgAEQAaQBzAHAAbABhAHkAVgBlAHIAcwBpAG8AbgAgAC0AVgBhAGwAdQBlACAAJwAyAC4AMQAuADAAJwAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIABQAHUAYgBsAGkAcwBoAGUAcgAgAC0AVgBhAGwAdQBlACAAIgBQAHIAaQBlAHQAdABvACcAcwAiACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsAAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAawAgAC0ATgBhAG0AZQAgAEMAbwBtAG0AZQBuAHQAcwAgAC0AVgBhAGwAdQBlACAAIgBUAHUAIABuAGUAZwBvAGMAaQBvACAAbwByAGQAZQBuAGEAZABvACAAeQAgAHAAcgBvAGQAdQBjAHQAaQB2AG8AIgAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIABJAG4AcwB0AGEAbABsAEwAbwBjAGEAdABpAG8AbgAgAC0AVgBhAGwAdQBlACAAJABkAGkAcgAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIABEAGkAcwBwAGwAYQB5AEkAYwBvAG4AIAAtAFYAYQBsAHUAZQAgACQAaQBjAG8AIAAtAEYAbwByAGMAZQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAVQBuAGkAbgBzAHQAYQBsAGwAUwB0AHIAaQBuAGcAIAAtAFYAYQBsAHUAZQAgACgAJwAiACcAKwAkAGUAeABlACsAJwAiACAALQAtAHUAbgBpAG4AcwB0AGEAbABsACcAKQAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIABOAG8ATQBvAGQAaQBmAHkAIAAtAFYAYQBsAHUAZQAgADEAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAG8AcgBkACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsAAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAawAgAC0ATgBhAG0AZQAgAE4AbwBSAGUAcABhAGkAcgAgAC0AVgBhAGwAdQBlACAAMQAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcAbwByAGQAIAAtAEYAbwByAGMAZQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand dAByAHkAIAB7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAYwBtAGQALgBlAHgAZQAgAC0AVgBlAHIAYgAgAFIAdQBuAEEAcwAgAC0AVwBhAGkAdAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGMAJwAsACcAbgBlAHQAcwBoACAAYQBkAHYAZgBpAHIAZQB3AGEAbABsACAAZgBpAHIAZQB3AGEAbABsACAAZABlAGwAZQB0AGUAIAByAHUAbABlACAAbgBhAG0AZQA9AEEAcwB0AHIAbwBwAGwAYQB5ACAAPgBuAHUAbAAgADIAPgAmADEAIAAmACAAbgBlAHQAcwBoACAAYQBkAHYAZgBpAHIAZQB3AGEAbABsACAAZgBpAHIAZQB3AGEAbABsACAAYQBkAGQAIAByAHUAbABlACAAbgBhAG0AZQA9AEEAcwB0AHIAbwBwAGwAYQB5ACAAZABpAHIAPQBpAG4AIABhAGMAdABpAG8AbgA9AGEAbABsAG8AdwAgAHAAcgBvAHQAbwBjAG8AbAA9AFQAQwBQACAAbABvAGMAYQBsAHAAbwByAHQAPQA4ADcAOAA3ACAAcAByAG8AZgBpAGwAZQA9AGEAbgB5ACAAcgBlAG0AbwB0AGUAaQBwAD0ATABvAGMAYQBsAFMAdQBiAG4AZQB0ACcAIAB9ACAAYwBhAHQAYwBoACAAewB9AA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5688
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall delete rule name=Astroplay >nul 2>&1 & netsh advfirewall firewall add rule name=Astroplay dir=in action=allow protocol=TCP localport=8787 profile=any remoteip=LocalSubnet
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4236
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall delete rule name=Astroplay
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4560
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name=Astroplay dir=in action=allow protocol=TCP localport=8787 profile=any remoteip=LocalSubnet
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4788
- C:\Program Files\Astroplay\Astroplay.exe
  "C:\Program Files\Astroplay\Astroplay.exe" --serve --port 8787
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://localhost:8787/
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x358,0x7ffc8fb8c188,0x7ffc8fb8c194,0x7ffc8fb8c1a0
    3⤵
    PID:2864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,4891984397534021205,2120303256791742784,524288 --field-trial-handle=2536,i,11901538773293885149,15624450668205778533,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,9604672898692896531,18299027632877364127,262144 --field-trial-handle=2536,i,11901538773293885149,15624450668205778533,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:2
    3⤵
    PID:1672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2184,i,14288290589725830390,12532627219083896157,524288 --field-trial-handle=2536,i,11901538773293885149,15624450668205778533,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:13
    3⤵
    PID:3528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,16177866965573382072,7888287696351953100,2097152 --field-trial-handle=2536,i,11901538773293885149,15624450668205778533,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:2364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,11535835803682077342,967645238068074654,2097152 --field-trial-handle=2536,i,11901538773293885149,15624450668205778533,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:5568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,15700462286239779623,7453499955865212494,2097152 --field-trial-handle=2536,i,11901538773293885149,15624450668205778533,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:9
    3⤵
    PID:5880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,7821527774711681825,17119218720941600474,2097152 --field-trial-handle=2536,i,11901538773293885149,15624450668205778533,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:1
    3⤵
    PID:1368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,16798414204606162429,14526669693288751734,524288 --field-trial-handle=2536,i,11901538773293885149,15624450668205778533,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14
    3⤵
    PID:2492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3800,i,15693952213528006265,12209428925755808794,524288 --field-trial-handle=2536,i,11901538773293885149,15624450668205778533,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:14
    3⤵
    PID:1188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,10934640700446238505,4214903822369680740,524288 --field-trial-handle=2536,i,11901538773293885149,15624450668205778533,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
    3⤵
    PID:5420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5808,i,16529361192176748650,521721209490027637,2097152 --field-trial-handle=2536,i,11901538773293885149,15624450668205778533,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:1
    3⤵
    PID:4280
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,7450565858779947323,9136616179200068039,524288 --field-trial-handle=2536,i,11901538773293885149,15624450668205778533,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
    3⤵
    PID:1276
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,7450565858779947323,9136616179200068039,524288 --field-trial-handle=2536,i,11901538773293885149,15624450668205778533,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
    3⤵
    PID:3260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,11613953190270295367,18071043950696474170,524288 --field-trial-handle=2536,i,11901538773293885149,15624450668205778533,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
    3⤵
    PID:5748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,356751691673714345,2465469467791588766,524288 --field-trial-handle=2536,i,11901538773293885149,15624450668205778533,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:14
    3⤵
    PID:2804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,2206137819194080652,6821637285419748187,524288 --field-trial-handle=2536,i,11901538773293885149,15624450668205778533,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:14
    3⤵
    PID:4220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,8631880437654323730,701727031053050066,524288 --field-trial-handle=2536,i,11901538773293885149,15624450668205778533,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
    3⤵
    PID:1056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,13913763969117844507,2134921081757176437,524288 --field-trial-handle=2536,i,11901538773293885149,15624450668205778533,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
    3⤵
    PID:3828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,997726455697511836,5079290124456172480,524288 --field-trial-handle=2536,i,11901538773293885149,15624450668205778533,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:14
    3⤵
    PID:1668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,3619760160456112692,8557356099713479693,524288 --field-trial-handle=2536,i,11901538773293885149,15624450668205778533,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:14
    3⤵
    PID:2348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,9017548498536079135,9159623394341342650,524288 --field-trial-handle=2536,i,11901538773293885149,15624450668205778533,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:14
    3⤵
    PID:5196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,1258125483697085445,12031378868458150836,524288 --field-trial-handle=2536,i,11901538773293885149,15624450668205778533,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:14
    3⤵
    PID:3972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,8731893874033238926,14264624314932381718,524288 --field-trial-handle=2536,i,11901538773293885149,15624450668205778533,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:14
    3⤵
    PID:4608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,5647508013441136995,5589120610416428836,524288 --field-trial-handle=2536,i,11901538773293885149,15624450668205778533,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
    3⤵
    PID:1768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4652,i,6480740773820638583,1806199301375325968,262144 --field-trial-handle=2536,i,11901538773293885149,15624450668205778533,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,8788011996665052288,433200184890688161,524288 --field-trial-handle=2536,i,11901538773293885149,15624450668205778533,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:14
    3⤵
    PID:1924

C:\PROGRA~1\ASTROP~1\Astroplay.exe
C:\PROGRA~1\ASTROP~1\ASTROP~1.EXE
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnAAoAJABlAHgAZQA9ACcAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEEAcwB0AHIAbwBwAGwAYQB5AFwAQQBzAHQAcgBvAHAAbABhAHkALgBlAHgAZQAnADsAIAAkAGQAaQByAD0AJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwAQQBzAHQAcgBvAHAAbABhAHkAJwA7ACAAJABpAGMAbwA9ACcAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEEAcwB0AHIAbwBwAGwAYQB5AFwAbABvAGcAbwAuAGkAYwBvACcACgAkAHMAaAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAFcAUwBjAHIAaQBwAHQALgBTAGgAZQBsAGwACgAjACAAbABpAG0AcABpAGUAegBhACAAZABlACAAbABvAHMAIABhAGMAYwBlAHMAbwBzACAAZABpAHIAZQBjAHQAbwBzACAAZABlACAAdgBlAHIAcwBpAG8AbgBlAHMAIABhAG4AdABlAHIAaQBvAHIAZQBzACwAIABwAGEAcgBhACAAcQB1AGUAIABuAG8AIABxAHUAZQBkAGUAbgAgAGQAdQBwAGwAaQBjAGEAZABvAHMACgAkAG8AbABkAD0AWwBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoARwBlAHQARgBvAGwAZABlAHIAUABhAHQAaAAoACcARABlAHMAawB0AG8AcAAnACkAOwAgACQAbwBsAGQAcAA9AFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEcAZQB0AEYAbwBsAGQAZQByAFAAYQB0AGgAKAAnAFAAcgBvAGcAcgBhAG0AcwAnACkAOwAgACQAbwBsAGQAcwA9AFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEcAZQB0AEYAbwBsAGQAZQByAFAAYQB0AGgAKAAnAFMAdABhAHIAdAB1AHAAJwApAAoAZgBvAHIAZQBhAGMAaAAgACgAJABuACAAaQBuACAAQAAoACIAUAByAGkAZQB0AHQAbwAnAHMAIABBAGQAbQBpAG4AaQBzAHQAcgBhAGMAaQDzAG4AIgAsACIAQQBzAHQAcgBvAHAAbABhAHkAIABBAGQAbQBpAG4AaQBzAHQAcgBhAGMAaQDzAG4AIgApACkAIAB7AAoAIAAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAbwBsAGQAIAAoACQAbgAgACsAIAAnAC4AbABuAGsAJwApACkACgAgACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBSAGUAYwB1AHIAcwBlACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAJABvAGwAZABwACAAJABuACkACgB9AAoAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAJABvAGwAZABzACAAJwBQAHIAaQBlAHQAdABvACAAcwBlAHIAdgBpAGQAbwByAC4AbABuAGsAJwApAAoAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBSAGUAYwB1AHIAcwBlACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFUAbgBpAG4AcwB0AGEAbABsAFwAUAByAGkAZQB0AHQAbwBBAGQAbQBpAG4AJwAKAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0AUgBlAGMAdQByAHMAZQAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAJwBIAEsAQwBVADoAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABVAG4AaQBuAHMAdABhAGwAbABcAEEAcwB0AHIAbwBwAGwAYQB5AEEAZABtAGkAbgAnAAoAZgB1AG4AYwB0AGkAbwBuACAATAAoACQAcABhAHQAaAAsACQAYQAsACQAZAApAHsAIAAkAHMAPQAkAHMAaAAuAEMAcgBlAGEAdABlAFMAaABvAHIAdABjAHUAdAAoACQAcABhAHQAaAApADsAIAAkAHMALgBUAGEAcgBnAGUAdABQAGEAdABoAD0AJABlAHgAZQA7ACAAJABzAC4AQQByAGcAdQBtAGUAbgB0AHMAPQAkAGEAOwAgACQAcwAuAFcAbwByAGsAaQBuAGcARABpAHIAZQBjAHQAbwByAHkAPQAkAGQAaQByADsAIAAkAHMALgBEAGUAcwBjAHIAaQBwAHQAaQBvAG4APQAkAGQAOwAgACQAcwAuAEkAYwBvAG4ATABvAGMAYQB0AGkAbwBuAD0AJABpAGMAbwA7ACAAJABzAC4AUwBhAHYAZQAoACkAIAB9AAoAJABkAGUAcwBrAD0AWwBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoARwBlAHQARgBvAGwAZABlAHIAUABhAHQAaAAoACcARABlAHMAawB0AG8AcAAnACkAOwAgACQAcAByAG8AZwA9AFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEcAZQB0AEYAbwBsAGQAZQByAFAAYQB0AGgAKAAnAFAAcgBvAGcAcgBhAG0AcwAnACkAOwAgACQAcwB0AGEAcgB0AD0AWwBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoARwBlAHQARgBvAGwAZABlAHIAUABhAHQAaAAoACcAUwB0AGEAcgB0AHUAcAAnACkACgAjACAAUwBpACAAZQBuACAAZQBzAHQAYQAgAFAAQwAgAHkAYQAgAGgAYQB5ACAAbwB0AHIAYQAgAGkAbgBzAHQAYQBsAGEAYwBpAPMAbgAgAGMAbwBuACAAZQBsACAAbQBpAHMAbQBvACAAbgBvAG0AYgByAGUAIAAoAHAAbwByACAAZQBqAGUAbQBwAGwAbwAsACAAbABhACAAdgBlAHIAcwBpAPMAbgAgAHAAcgBvAHAAaQBhACAAeQAgAGwAYQAgAGQAZQAgAHUAbgAKACMAIABjAGwAaQBlAG4AdABlACAAYwBvAG4AdgBpAHYAaQBlAG4AZABvACAAcABhAHIAYQAgAHAAcgBvAGIAYQByACkALAAgAHMAZQAgAGwAZQAgAGEAZwByAGUAZwBhACAAdQBuAGEAIABhAGMAbABhAHIAYQBjAGkA8wBuACAAcABhAHIAYQAgAG4AbwAgAHAAaQBzAGEAcgAgAGUAbAAgAGEAYwBjAGUAcwBvACAAZABpAHIAZQBjAHQAbwAgAGQAZQBsACAAbwB0AHIAbwAuAAoAJABuAGEAbQBlAD0AJwBBAHMAdAByAG8AIABBAGQAbQBpAG4AaQBzAHQAcgBhAGMAaQDzAG4AJwAKACQAbABuAGsAPQBKAG8AaQBuAC0AUABhAHQAaAAgACQAZABlAHMAawAgACgAJABuAGEAbQBlACAAKwAgACcALgBsAG4AawAnACkACgBpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAAJABsAG4AawApACAAewAgACQAdAA9ACQAcwBoAC4AQwByAGUAYQB0AGUAUwBoAG8AcgB0AGMAdQB0ACgAJABsAG4AawApAC4AVABhAHIAZwBlAHQAUABhAHQAaAA7ACAAaQBmACAAKAAkAHQAIAAtAGEAbgBkACAAJAB0ACAALQBuAGUAIAAkAGUAeABlACkAIAB7ACAAJABuAGEAbQBlACAAPQAgACQAbgBhAG0AZQAgACsAIAAnACAAKABBAHMAdAByAG8AcABsAGEAeQApACcAIAB9ACAAfQAKACQAbQBlAG4AdQA9AEoAbwBpAG4ALQBQAGEAdABoACAAJABwAHIAbwBnACAAJABuAGEAbQBlAAoATgBlAHcALQBJAHQAZQBtACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlACAAJABtAGUAbgB1ACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKAEwAIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAJABkAGUAcwBrACAAKAAkAG4AYQBtAGUAIAArACAAJwAuAGwAbgBrACcAKQApACAAJwAtAC0AbwBwAGUAbgAnACAAIgBBAGIAcgBpAHIAIABBAHMAdAByAG8AIABBAGQAbQBpAG4AaQBzAHQAcgBhAGMAaQDzAG4AIAC3ACAAVAB1ACAAbgBlAGcAbwBjAGkAbwAgAG8AcgBkAGUAbgBhAGQAbwAgAHkAIABwAHIAbwBkAHUAYwB0AGkAdgBvACIACgBMACAAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAbQBlAG4AdQAgACgAJABuAGEAbQBlACAAKwAgACcALgBsAG4AawAnACkAKQAgACcALQAtAG8AcABlAG4AJwAgACIAQQBiAHIAaQByACAAQQBzAHQAcgBvACAAQQBkAG0AaQBuAGkAcwB0AHIAYQBjAGkA8wBuACIACgBMACAAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAbQBlAG4AdQAgACIAQwBvAG4AZQBjAHQAYQByACAAYwBlAGwAdQBsAGEAcgBlAHMALgBsAG4AawAiACkAIAAnAC0ALQBwAGgAbwBuAGUAcwAnACAAIgBWAGUAcgAgAGwAYQAgAGQAaQByAGUAYwBjAGkA8wBuACAAcABhAHIAYQAgAGMAbwBuAGUAYwB0AGEAcgAgAGMAZQBsAHUAbABhAHIAZQBzACIACgBMACAAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAbQBlAG4AdQAgACIARABlAHMAaQBuAHMAdABhAGwAYQByAC4AbABuAGsAIgApACAAJwAtAC0AdQBuAGkAbgBzAHQAYQBsAGwAJwAgACIARABlAHMAaQBuAHMAdABhAGwAYQByACAAQQBzAHQAcgBvACAAQQBkAG0AaQBuAGkAcwB0AHIAYQBjAGkA8wBuACIACgBMACAAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAcwB0AGEAcgB0ACAAIgBBAHMAdAByAG8AcABsAGEAeQAgAHMAZQByAHYAaQBkAG8AcgAuAGwAbgBrACIAKQAgACcALQAtAHMAZQByAHYAZQAnACAAIgBTAGUAcgB2AGkAZABvAHIAIABkAGUAIABBAHMAdAByAG8AIABBAGQAbQBpAG4AaQBzAHQAcgBhAGMAaQDzAG4AIgAKACQAZgBzAD0AJABzAGgALgBDAHIAZQBhAHQAZQBTAGgAbwByAHQAYwB1AHQAKAAoAEoAbwBpAG4ALQBQAGEAdABoACAAJABtAGUAbgB1ACAAIgBNAGkAcwAgAGQAYQB0AG8AcwAgAHkAIABwAGwAYQBuAGkAbABsAGEAcwAuAGwAbgBrACIAKQApADsAIAAkAGYAcwAuAFQAYQByAGcAZQB0AFAAYQB0AGgAPQAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABBAHMAdAByAG8AcABsAGEAeQBcAGQAYQB0AGEAXABSAGUAZwBpAHMAdAByAG8AcwAnADsAIAAkAGYAcwAuAEQAZQBzAGMAcgBpAHAAdABpAG8AbgA9ACIAUABsAGEAbgBpAGwAbABhAHMAIABkAGUAIABFAHgAYwBlAGwAIABjAG8AbgAgAHYAZQBuAHQAYQBzACwAIABnAGEAcwB0AG8AcwAgAGUAIABpAG4AdgBlAG4AdABhAHIAaQBvACIAOwAgACQAZgBzAC4AUwBhAHYAZQAoACkACgAkAGsAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFUAbgBpAG4AcwB0AGEAbABsAFwAQQBzAHQAcgBvAHAAbABhAHkAQQBkAG0AaQBuACcACgBOAGUAdwAtAEkAdABlAG0AIAAtAEYAbwByAGMAZQAgACQAawAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAARABpAHMAcABsAGEAeQBOAGEAbQBlACAALQBWAGEAbAB1AGUAIAAiAEEAcwB0AHIAbwAgAEEAZABtAGkAbgBpAHMAdAByAGEAYwBpAPMAbgAiACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsAAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAawAgAC0ATgBhAG0AZQAgAEQAaQBzAHAAbABhAHkAVgBlAHIAcwBpAG8AbgAgAC0AVgBhAGwAdQBlACAAJwAyAC4AMQAuADAAJwAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIABQAHUAYgBsAGkAcwBoAGUAcgAgAC0AVgBhAGwAdQBlACAAIgBQAHIAaQBlAHQAdABvACcAcwAiACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsAAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAawAgAC0ATgBhAG0AZQAgAEMAbwBtAG0AZQBuAHQAcwAgAC0AVgBhAGwAdQBlACAAIgBUAHUAIABuAGUAZwBvAGMAaQBvACAAbwByAGQAZQBuAGEAZABvACAAeQAgAHAAcgBvAGQAdQBjAHQAaQB2AG8AIgAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIABJAG4AcwB0AGEAbABsAEwAbwBjAGEAdABpAG8AbgAgAC0AVgBhAGwAdQBlACAAJABkAGkAcgAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIABEAGkAcwBwAGwAYQB5AEkAYwBvAG4AIAAtAFYAYQBsAHUAZQAgACQAaQBjAG8AIAAtAEYAbwByAGMAZQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABrACAALQBOAGEAbQBlACAAVQBuAGkAbgBzAHQAYQBsAGwAUwB0AHIAaQBuAGcAIAAtAFYAYQBsAHUAZQAgACgAJwAiACcAKwAkAGUAeABlACsAJwAiACAALQAtAHUAbgBpAG4AcwB0AGEAbABsACcAKQAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGsAIAAtAE4AYQBtAGUAIABOAG8ATQBvAGQAaQBmAHkAIAAtAFYAYQBsAHUAZQAgADEAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAG8AcgBkACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsAAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAawAgAC0ATgBhAG0AZQAgAE4AbwBSAGUAcABhAGkAcgAgAC0AVgBhAGwAdQBlACAAMQAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcAbwByAGQAIAAtAEYAbwByAGMAZQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand dAByAHkAIAB7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAYwBtAGQALgBlAHgAZQAgAC0AVgBlAHIAYgAgAFIAdQBuAEEAcwAgAC0AVwBhAGkAdAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGMAJwAsACcAbgBlAHQAcwBoACAAYQBkAHYAZgBpAHIAZQB3AGEAbABsACAAZgBpAHIAZQB3AGEAbABsACAAZABlAGwAZQB0AGUAIAByAHUAbABlACAAbgBhAG0AZQA9AEEAcwB0AHIAbwBwAGwAYQB5ACAAPgBuAHUAbAAgADIAPgAmADEAIAAmACAAbgBlAHQAcwBoACAAYQBkAHYAZgBpAHIAZQB3AGEAbABsACAAZgBpAHIAZQB3AGEAbABsACAAYQBkAGQAIAByAHUAbABlACAAbgBhAG0AZQA9AEEAcwB0AHIAbwBwAGwAYQB5ACAAZABpAHIAPQBpAG4AIABhAGMAdABpAG8AbgA9AGEAbABsAG8AdwAgAHAAcgBvAHQAbwBjAG8AbAA9AFQAQwBQACAAbABvAGMAYQBsAHAAbwByAHQAPQA4ADcAOAA3ACAAcAByAG8AZgBpAGwAZQA9AGEAbgB5ACAAcgBlAG0AbwB0AGUAaQBwAD0ATABvAGMAYQBsAFMAdQBiAG4AZQB0ACcAIAB9ACAAYwBhAHQAYwBoACAAewB9AA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall delete rule name=Astroplay >nul 2>&1 & netsh advfirewall firewall add rule name=Astroplay dir=in action=allow protocol=TCP localport=8787 profile=any remoteip=LocalSubnet
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4768
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall delete rule name=Astroplay
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2280
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name=Astroplay dir=in action=allow protocol=TCP localport=8787 profile=any remoteip=LocalSubnet
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:1260
- C:\Program Files\Astroplay\Astroplay.exe
  "C:\Program Files\Astroplay\Astroplay.exe" --serve --port 8787
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://localhost:8787/
  2⤵
  PID:1884

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Astroplay.exe

Path C:\Program Files\Astroplay\Astroplay.exe
Size 7.5MB
SHA256 c28742ea377049cd2be23f4269603d5b9b1da93627c44aec29c64aba0cf30c11
MD5 ee9d36f73c1698348b66cb1704c68406
SHA1 d1a2cbdea0adb4c3a2c90a6f4b2764664448f1a1
SHA512 053abc159772e74ff8d76e26bc9199c5f4a9016d6ca69738082102813af02960a97f3eef9f167d71b144c1b6451091487062b54a2be1a1fef064f5e6752fafb7
SSDEEP 49152:bywq7e7cujy4HhkI+RpajNRxDB8xvMR11/a0hwDlmktHInzPj4qnmkd6O0Y6IyBm:bbXLFeA1dqlmuMkc6/z38aoEw
TLSH
T155868C03FCA555E9C0AAD23585629253BA317C485B3523E77FA0F3392F76BC06AB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.ico

Path C:\Program Files\Astroplay\logo.ico
Size 72KB
SHA256 47c5cbd39460be3b3bfa12d0788545d8a7b3300350dc939afbaccdd31f4279c0
MD5 01507787af96c6c757fa04a753f8acca
SHA1 ccdaaca60b5771be3ba4c261b0ca89b0041f4e79
SHA512 cf6b597c25c9f6e522d864a3dcdca736f0293235956403c7bca1a6566c2a5ddd2d7d0fe87db2f56c472f7b3c5d6c348780ed0bd66275ac2b1fb0a3358cc423df
SSDEEP 1536:L76rcYW1UwAYjgdeEi1Go6xEtNcADaC4gUZMUpzcM+A06UCI14S8XhW4aoMcXn:P6rcYqRlkKNcAG/gAzX+njySaWdoMC
TLSH
T1317302CD5F07A924ED03BDF5C30798E84BE624E81E22ED774276461E268A1958AF1373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prietto.log

Path C:\Users\Admin\AppData\Local\Astroplay\data\prietto.log
Size 273B
SHA256 256319f302ef3dc40dc11edc00ce94ade71776ad1c53a13ad4187d7d169595ed
MD5 fc0d53625cbed4ed7069cfc5ef75fd47
SHA1 467623334fa8406f79db291d5ea4e11f9548a80b
SHA512 b1b8c48ceb8c98805cd5212f6a020a74286e91019fb62a2e79994bc9cfab72fbf30abb8c1f753fe7e3dc23ee08a9aa37803f4bcfad70425ceb28bd6c0e48216f
TLSH
T181D0EB0354E102B800400243CCA7B380D3BD01D5BE0A2A1C820CE8C4528383CB9E60C0
MD5 SHA1 SHA512 TLSH

Submit Download

0e268ac4-3534-4f6a-9755-115fff1a43df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0e268ac4-3534-4f6a-9755-115fff1a43df.tmp
Size 34KB
SHA256 21590259fb235a2e2f716653d10a0a8da9e46763470183ba310c7b7a3db6777c
MD5 0abc0cd331e669dd83a2b1b434a45986
SHA1 9590c4692e106a99ed78b2f4b56ecba7535effdf
SHA512 38c46eb31f184734ba73b3b5d7fd1ecf0fa871906f268e8d51042b710ec7016f74fe17735f8d5b94b29b82c1761d0a9512ff7a6cb410754c363e85cd73a5a02c
SSDEEP 768:8r3x5HBO29JVp/9OA9at01j0iq00+IaizE75E1XfLV:8r3x+CHq00NackyXfB
TLSH
T118F2AF71ECA69E739CE2B254B30A33D6AFE45557C9CD4B50C9EA160D00476AE2B0BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

14d5af9b-4ae8-4ab1-9bfd-378ca77b806f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\14d5af9b-4ae8-4ab1-9bfd-378ca77b806f.tmp
Size 39KB
SHA256 e27b77b0f960a83f9625e93e02864c987ed59b023ca16ce40b4df8a71bf186ea
MD5 7bbb405447ac4c09c6a2894eef181c76
SHA1 9f399a09bc288ab46d5667de33a9d7ce6ad6265d
SHA512 d1d057f4596b58c130a5bc5449a8d8e8873d143f84ca3d7dcd9947ca5ec5b66db25d7b4f0627d88bbe96f16f91623dad394032fb90d3143ca6cdd9a80b25d735
SSDEEP 768:N/UxvxjgC+H3gFHBO29JV6/9OA9at01j0iq00+IaizqL:wZj3+H3g7CHq00NacqL
TLSH
T1E703C071ACA69D23ACF2F258730A23D7DFF41563C5C99E9489FA1A0D04476AE170BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

48a40c7e-ea68-4440-8388-65470e9c3bbb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\48a40c7e-ea68-4440-8388-65470e9c3bbb.tmp
Size 37KB
SHA256 5da3b0070d585277579d78189bb1a67f1eca86000954007f2f033f8736e5658b
MD5 c97618e742d4dcb4f9f096ac06255e4c
SHA1 6aaf68d6428c03187651954e9ef30ca5dd2ef514
SHA512 36fbe5f8863b6e368f4a3a6921078ad799ae72aad4d880dfece9c7ffad4bd592bd107560685366092bc810d939c637b88ac4dd5a63e45edf2e0594f298669908
SSDEEP 768:X/UxvxjgC+H35DGO2p/9OA9at01j0iq00+Ia2lSHxRz:KZj3+H35ZCHq00NaCSTz
TLSH
T1D403C031ECA15D739CF7B384730A6397DFF44663C6C96AA04AED2A0D01876AD1307867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f96c998-4523-4286-98c3-55443f2e15a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5f96c998-4523-4286-98c3-55443f2e15a4.tmp
Size 38KB
SHA256 1e1edc0c6fa75c159bd5139e7fc3038680fc08731fa25c2856687843f13adbab
MD5 2e77983eb7861cfb0d34dd01cc2fad27
SHA1 4ae28c16580c36887f49de7f25c0bfa50a589dd5
SHA512 82fa504db143ef4fe14919a0b77e655bdafb641286e70823e54f03c6b27f065ad7fdaa6f8d33734a74b228be52c27e83b78071f04461cae5877639278fb70aae
SSDEEP 768:m/UxvxjgC+H3+O/O29JVF/9OA9at01j0iq00+IaXzSHxRz:bZj3+H3+ZCHq00NaDSTz
TLSH
T1D903C031ECA69D639CF6B244730A63C7DFF41663C9C59AA489F92A0D04476AD270B863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fc0a38b9bd67def6f8a6da7a4a5956bc201e5aac4ba6f906946e52f5b14e13c2
MD5 1f96c275206494cbaa7386b7e675b940
SHA1 e11ab12226c05e6b54c67a266c2f75cfeb24b04a
SHA512 a117c9e9ceb3447431daa46611f5c54ed75796456b4251af5e1ed3f62b5c6cbe9ebccf949569237178ca2ca7feba8c9acb69940a8457c36a9156ef8fd98eb09c
TLSH
T188D02B3671684D13E0805278007111613882F405DF0601C01322982609902483010180
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0d0352bb5f4b47f3d1ca8042212dfbae37957031d48d7789bd6cd7b4b6cbbe31
MD5 32b3e4b238ee2f76e0152ca1b1ff9944
SHA1 78d56bdababf57c069ac4ad713ad9cdc3e3f04a0
SHA512 3e7b72969f35c769b07f0760fb1a06022e37e68e88be1bff45e02463b5358a671e4f84f6bad11b043a01370573d062084b864866961ee86cb12eceb980874f69
TLSH
T178D02B3A71584E13E0805274007011613892F405EF0601C01322581609902483011184
MD5 SHA1 SHA512 TLSH

Submit Download

145c27dd-e104-4217-b65e-ba9f1dad0d2f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\145c27dd-e104-4217-b65e-ba9f1dad0d2f.tmp
Size 29KB
SHA256 51ca003aa792ddd883e398298a890ef76dd9052c39805dca1cbc36a15b656dce
MD5 9abca03a0a36f15a17e80434bed134bc
SHA1 b5526660e62b48b000f8b7c5d049446536e75a39
SHA512 08fd6b8c5f4a32d757930a429105494e9e16511a701b3ea420f9440db47584609d7cbcbf455fe901554c8b0e92176bd05992964657e3bede760834b428713dda
SSDEEP 768:p/wWZS7pLuLjgnWg/Xf1p8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMMXH3Iorop7j+:p/wWZqEjgnWg/Xf1pu1jaTMXXITp7j+
TLSH
T1B5D2DA3B740CCA7F4F804ADDDC197E9F6DA802CB9698CD8047FA985C02C67EA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2157a532-f5b9-4e4f-8acc-9fef8717f2e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2157a532-f5b9-4e4f-8acc-9fef8717f2e3.tmp
Size 11KB
SHA256 3108756e9e91eb8a6339daccd43d20b619528d71a3c1a97f5ecfe478571355a5
MD5 b3bf48aaba12b62a8f4ddd1727378d7a
SHA1 2ea35f11a7c3e4ba9375a0fe8719337e4b17ad31
SHA512 4b00fee6806f3b7e704fdd812859b24a678a148a60228cb466062e81e134426860f041852fc11952c8e172917d8a29f031cda56e869cc48b4d6f834232ffc3f2
SSDEEP 192:sxR8RXCV/fasr4ZkKLizoA8pOG/g6+WNF6GefYo9Mr2+GcTQIgDEBVHJ:sxR8gV/fasrGRv5/5qf5iTsQ/p
TLSH
T14C42D916AE25A93B5CCBD21DBB567F57D6F9503260D51F48A6FC8A1C04E6ACD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

69154d3d-a4cc-4ec1-a497-5fd29fca9672.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\69154d3d-a4cc-4ec1-a497-5fd29fca9672.tmp
Size 11KB
SHA256 ad80200df4e8e253c643ccb8e1dc065d704c6e51d1dc71b4cd0656f485856fbb
MD5 3341887101341fc868166a02330aa691
SHA1 6590356c302cd7c32036485d068ed948eb6a990d
SHA512 bfe686a08e64d621ce583b520c9715e7db02be73bedba6440c1c50c17296433c1ead44f8d03ffb041d7a81f51e0dcbab2d1d46544b82e9273f0b66fb4e348056
SSDEEP 192:sxRXRXCV/fasT4ZkKLizoA8pOG/g6+WNF6GefYo9Mr2+GcTQIgmBVHJ:sxRXgV/fasTGRv5/5qf5iTsm/p
TLSH
T15142DA16AE25A93B5CCBD21DBB667F57D6F9503260D51F08A6FC8A1C04E6ADD120380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006a
Size 349KB
SHA256 3411692820cb8d47543f69496aa25fd603a358f4498046f41c508a5a3342210e
MD5 be92f985b6e9aa4c37648c5eea72a759
SHA1 583df3e9565c63fc6dca4c8d75f01c48534851ae
SHA512 a304b6ff97428a209931a5313203d126d8ba8799610ac6667e878444ce734a3438109c993b059b98e3f5d3e9a1d0560b6c85a65b5bb4085160570b370f96a018
SSDEEP 3072:K4Zr8BFW9+0HJBnj1CmOp3S7PMKstZ4hvdQpPO4L+ZZ2jDojUTrsuwHXQNhTkC+D:QeMS7LCT/siJkC+bss
TLSH
T1C27496AFCFC9265F496AE3881A4BB0111FED63BE370A8C12758ED137E155816DCB3621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
Size 328KB
SHA256 d7cc8f69dd70bdcf3ac00c9ae572bf2acb9f4132ba379c72df842e4db918652d
MD5 bc4aee4e60193999c1917a1e14715007
SHA1 9e41ea8b1293ff426f786b99dfb476791410ed05
SHA512 6452cadd21ea25d15f3da063272a1da6dace83d9d0662d79fbd3653e26202748c936aab2ce096ab1e1a0ee2716fdceea5733a1c48c3f5b8573f20f19dc4c90b3
SSDEEP 6144:hwGpN8bzNmbO5fJUghtVWkem0RYNu92gsLTOVCY8bzNEiLdrV4FKDqVpo+JBrbV:CGoJPhtVWkem0RYQ8gsLTOVMdre
TLSH
T12364E9A033E260F797DA16CA04A15051F66D65A9380E147CFFACADC76819CC392FAF35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
Size 231KB
SHA256 0d6879534514d7939c83714c92dd1b90692e067c42b5e80e4645a67208ab7f0f
MD5 1ec8bf285ec5aa6f8bb2b07c2f9d4a22
SHA1 ca734b61ae1f953b13946e6562c1fe03b0634f9a
SHA512 e969a61912ec69b6283203090b19e48a2dc760f11b5aa9055251dd0e4c98ce411a5f44cc3b6ba5bac53fe2a7ef3fe851d5a78a2d885352f9d0c3fcfd8764022f
SSDEEP 6144:T+4oPrci/S430dsJaWxRwNTR4sUT6Y3fjlVagq0:T+D06JBQWa70
TLSH
T1AC347C21F5B685B67C33227D639EA61C3B29A057CC0DCEAEBBC461218F853F99DD1604
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
Size 531KB
SHA256 b23036627cb375d3eabbbb73ef5f81006da832c027843ab1346a21bf6e9bcff8
MD5 dd5b186f0dfe01d0176e55f699ee7c0e
SHA1 e994ca25d7f6040c398ea785539f1cf3ec52f3d8
SHA512 5fa84da48d9592d86f1c62f95caa9eeba77b69b2d9144c55ebc5e934bec82c4cbce0ea2ce113ccf967bd9820e23ebf31d0ff72b7a057ad49727a99fb4e90d061
SSDEEP 6144:TSUq29dLFsUT8le5PzvoNODU6DNVYGE65SoYZjgpe9DmvvMIJzLcAY:TU2KazvoQ66ULkVvMIJzoz
TLSH
T145C45B94E179BFEDF97605E0446F800D722E5B99C90E8874B478FC251A5C484BAABFCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 a045742e90a4098d6807f72da781d569a1cd3f3e79f250b1c60e078a2dfcb24e
MD5 f586d9a7167bbb9a1ff1e1d0d9e0a0f4
SHA1 7c12d9e4e18db582e37ce32ed15823507bec437a
SHA512 f756541e815b5604bb427edcc71b4892cb8baa1a22457c18927fe7ce24ed64698e5e9986b8464eb4fc4cf85f925c65fb3ba584e43496c3513a7072553ac2cee5
TLSH
T1216194A058658A5DFB7860BC8ACC5CABF6345682CEF72F620097F474E5867372C53298
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4a25034a6d8cd60b4804c9edce8be779bac71a109fb4c3e744b24a49d7829813
MD5 d4a8415488aca0ae584c9d07ab9f14fb
SHA1 048a26d0ce1ee54672196050976170cb87b0fd69
SHA512 17be354807c7b525551264a1671c3e1ed28be8713da389c628133efc61dfb251e0ab4316344afc817683aaba81d6e67c4c692953890f95f7bc2898df9f345102
TLSH
T1F561C7705460465DFB7820B88BCC5CABF2345682CEF71F620047F474D1467376C93298
MD5 SHA1 SHA512 TLSH

Submit Download

e0e31e84-ae89-4c05-8152-4b81ec10a50f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\e0e31e84-ae89-4c05-8152-4b81ec10a50f.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

0933ed99-85eb-4c61-944e-b64c14826757.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0933ed99-85eb-4c61-944e-b64c14826757.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

75edfefd-48c7-4765-bbd4-55a71959ba0e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\75edfefd-48c7-4765-bbd4-55a71959ba0e.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

b90fcd63-ccd4-41ca-bfed-eb39e48b6909.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b90fcd63-ccd4-41ca-bfed-eb39e48b6909.tmp
Size 2KB
SHA256 f10851b792a00efb4c90da8bb98f17a4493a67b0e8363c6717669d5086778268
MD5 bc0b6254302a99d423c2227f0285ceae
SHA1 e23a8b79b744472c58974d65aa7367d13e55d698
SHA512 e765878c42039fea7ddab286b9c0e644fe9c639f092bc8c0311e52636a33c3035cf184b4103ba6f11d7830401892e2ff69dbaa45b8863cdcce8abbe714046140
TLSH
T16151CDF383F8C52E890156F0AA146E1BCE1D0A65432C3D5A89E4AF5BA3E3471E18199F
MD5 SHA1 SHA512 TLSH

Submit Download

cccb13a0-8282-4594-9674-151410bac8b0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cccb13a0-8282-4594-9674-151410bac8b0.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d920a0d0-3673-4066-b618-d6897a415004.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d920a0d0-3673-4066-b618-d6897a415004.tmp
Size 12KB
SHA256 239dfd9e19d25fac23197495a7b6d959e9d67504ac80e7335650837dec29e4ee
MD5 e181f6245b890fe9d78eeb6bab62a7d9
SHA1 193cbea08f0115f75ce9d41db21165fba17cc458
SHA512 c3338cc5cecb063563368460cf5741250a47979e899e2debadb16430457199e7a60f13e3bf7cfcbb36d924b4755a48aaf2bed33177b60aae506bb89b82f9bb64
SSDEEP 192:sxR8RXCV/fasw4ZkKLizoA8pOG/g6+WNF6GefYo9fV2+GcTQIgDyBVHJ:sxR8gV/faswGRv5/5qfmiTse/p
TLSH
T15342D916AE25A93B5CCBE21DBB567F57D6F9503260D51F48A7FC8A1C04E6ACD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7def5a60-3592-411b-af0a-18cb67a166e9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7def5a60-3592-411b-af0a-18cb67a166e9.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a8f6d5c0bf5b19ece6f4ad30e53df4034bb3de0ac2803ae1fa22e511913cadc7
MD5 817bf3d3c3114d32687d5860949391fd
SHA1 998eeba10fcfed0dde220bc27bb3008c7fac411c
SHA512 f031d8b0ef8660f7ca1d7104fb34cb675761f3cca826677d87e337092b202a6f08bc4a7780035d6db12a8d80a4d6f904646b762f1002b0e87a9e7db0fa28940f
SSDEEP 768:R/UxvxjgC+H3SyRO29JV4/9OA9at01j0iq00+IaizqL:kZj3+H3SOCHq00NacqL
TLSH
T17903C071ECA69D239CF2F258730A23C7DFF41563C5C99E9489EA1A0D04436AD170BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a129a8c8-d5c6-451b-a917-44cae5cebc31.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a129a8c8-d5c6-451b-a917-44cae5cebc31.tmp
Size 34KB
SHA256 02b767c5caa1effdc94688f612ea486a5b88549c619501a10574c37a7d86b2ca
MD5 151d824c3319cd99c6ca4929f873689f
SHA1 5271ad78c8caf3dcdc9f0a27e1c064842b4c05de
SHA512 fd762616033b8d7500c5ffa963be8843188069e0a311edb4cece03efd400fc22be63c1945b80c3783c2fd107648fdd4cb26c2c4e57245136d29851b863dcad5f
SSDEEP 768:ar3g5HBO29JVp/9OA9at01j0iq00+IaizE75E1XfLV:ar3g+CHq00NackyXfB
TLSH
T1ABF2AF71ECA69E739CE2B254B30A33D6AFE45557C9CD4B50C9EA160D00476AE2B0BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b68a2140-a962-444b-8a95-277384a81bb5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b68a2140-a962-444b-8a95-277384a81bb5.tmp
Size 42KB
SHA256 601110392010f1e8df0ccc86790b11519664694d751a8319ecd88f1bb757d3c2
MD5 06fca0102f782a791bf2ae6ad264fa5c
SHA1 3bbde9b40cee3c2f3acfc2c5ba438326e392ed0d
SHA512 5d0ff600692195ee5d3170a96628667e1a08fb4642670639c12a75006d5f5a4ea0208d914e5b01944ed4c939cd44f88796fa016d5813f4364d62df0c75a176ed
SSDEEP 768:kFdQ3twg/SHaIO29JVJ/9OA9at01j0iq00+IaizE75E1XfLV:IQ3r1CHq00NackyXfB
TLSH
T1F31318F198D38A37E8AE5787633D2E869EBCD153B5889990B7D91D0CCC421BFD706812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

12590408-bcab-4e64-85b4-adb10835131c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\12590408-bcab-4e64-85b4-adb10835131c.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

31531053-a829-4c88-959b-8599436c0d4c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\31531053-a829-4c88-959b-8599436c0d4c.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

b7a93003-b6ad-478a-b7b5-e4a0174035aa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\b7a93003-b6ad-478a-b7b5-e4a0174035aa.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

d053b7bb-14cd-4ecc-909d-adf5fe67478f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\d053b7bb-14cd-4ecc-909d-adf5fe67478f.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c01feffb-67b1-496a-ab68-14b7447ea17d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c01feffb-67b1-496a-ab68-14b7447ea17d.tmp
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

c3a3c58b-5829-4538-be85-d8dbbec49d69.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c3a3c58b-5829-4538-be85-d8dbbec49d69.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 118b8eafd19b6f3fd179f584d48b98807747e61afd85ef360085052bc11bbd94
MD5 8ecdbfbe6e200e4869244c777b0d2460
SHA1 9a365b23f19bffab3265cc97b219f1e8d6844d29
SHA512 8811fb424730e0759f4f66b88fdfe74c7271203a2a7c3824e2cc304c789afd87bd914bcbc7c475751401195a23406266ed405c177aa065b2afd0949feba7866e
TLSH
T114218937B3DC8620C88A413A10CEAC1436B5C7DB809ECFABBB84D544B42F699CE60260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0c0236308733cd437634732f61af1affd87d2d91e3c6a64130109a95b7ddb1b1
MD5 02cc65f25d52eedc3ee2f4a9e1d0a67e
SHA1 e048c6dccd164d383b45ab3545598093a6ea5999
SHA512 20a8ae1113ed3895904f2db07bc6489d2c1d5cf361edbdbc57657a2d9139db7d4b738690a40dad986368633a6096c8525bf1e89010e16a8ba67362b668d6099a
TLSH
T186215C37B3DC8614DC9A413A50CDAC1036B5C7D7419ECF6B7B84D544B42F699DE61150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ed01f15ee28c57778f8f205ebba5ccc705c0eaebc68bdf47159c3886ca4ae25c
MD5 b4eece86abd7e11b043347c6f32e13d4
SHA1 c0f3b5b51011d67650ca490eace074bddfbeec9a
SHA512 c2abf94583cd2679afc7acd975ff842cce98e8e4154c0417848ff060b4b75d7e1597647da48ec4216e86163ac10abf62ef9209f9ef8338246c0e9df39e279161
TLSH
T115115733B3CC8624CC9A403650CEAC1136B587DB509EDF6BBB84D149B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

05a69c73-10b0-44df-8b26-b7b40da11680.tmp

Path C:\Users\Admin\AppData\Local\Temp\05a69c73-10b0-44df-8b26-b7b40da11680.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_y1m5vdzv.dlb.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y1m5vdzv.dlb.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

b120a76c-4c49-4c33-a442-36a6a5e90a5d.tmp

Path C:\Users\Admin\AppData\Local\Temp\b120a76c-4c49-4c33-a442-36a6a5e90a5d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6032_1478295850\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6032_158559039\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Astro Administración.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Astro Administración\Astro Administración.lnk
Size 1KB
SHA256 549584f1005ae257000bc78c733f4a135aa19166d96178d069556b1b04ab5258
MD5 a4a34c77c731e173fa40c6c377fe41c2
SHA1 6a36b59733de55e9786c7afef3c482f7ffe7c3f8
SHA512 658fec4fa938d4c2a3a46a0bb384bbc8140cca7e441d3b0a3cb474e8dd951383227053271d4edc6bc43cfaf06a33ae26795ab234d178142bca2ea2ee9d5f535d
TLSH
T1A441671653A51B25F3B787369EA34E22473BF802EA288F5A87C943891478105B528F6F
MD5 SHA1 SHA512 TLSH

Submit Download

Conectar celulares.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Astro Administración\Conectar celulares.lnk
Size 2KB
SHA256 0d6bee989cfa0b7d2faefa4b483c4a263b134c009bf07169f85373be23d36d0b
MD5 b54c451190ae39b1ff269ca46c796d45
SHA1 aec193ac9fed72d0c04af7a436c5fb804ed285bb
SHA512 956c2ffbeeb777b51e095e15cf0221ddadc0dd309fc978cd388bc3a00e22337c135a81e879875a8f9f595de65e73e5cb5617a397e6c2539bff49fe6b88fc6809
TLSH
T188416A1553A51B26F3B38736ADB30E25473BF802EA288F5A87C943891478505B928F6B
MD5 SHA1 SHA512 TLSH

Submit Download

Desinstalar.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Astro Administración\Desinstalar.lnk
Size 1KB
SHA256 0aac08e31ab8af7362c93596ef3c7f22ed39b11cf1175576d388c257f744822c
MD5 ccf626b24572a1e8814f29461c415885
SHA1 8c8631b55400a99d01c2149218ecd36c5524ee8d
SHA512 c1642beccc7e1c26f9e6c69e8dda11ba62df4ca1865cd18212b3782d9b0d4e183454457ba823e982f2980ce61959cf2bfd3f6c10d79371abe585178d2531e19f
TLSH
T1B4419A1553A91B25F3B38736AEA30E21463BFC02EE289F1A83C843891478101B574F6B
MD5 SHA1 SHA512 TLSH

Submit Download

Mis datos y planillas.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Astro Administración\Mis datos y planillas.lnk
Size 1KB
SHA256 8d12eb940515e352ea8fc6550099f41b4263a795898fd142d9053f1e698d54f4
MD5 09dfd5dd53126101a613e6bea6b6656c
SHA1 865bef7e13d4dddc98dec580a82a2d22563fee0b
SHA512 85a82fa0de56e752af401fff6b15ef8cf72f02e1200d8fb8117943ae5cebd3047aee14a3c679d5c97549a0d4796bdd71b6208fdaf06241e7832e937537dc45db
TLSH
T19B117B068F921B11EAB6CF7099EB6A22DA362C46FF945F16404480883478E00F9B4F37
MD5 SHA1 SHA512 TLSH

Submit Download

Astroplay servidor.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Astroplay servidor.lnk
Size 1KB
SHA256 afee14e489a35c31bdc9d983ec880aa4bdab989daf07e3363fa8bfdce5df117c
MD5 6f2733299f2fc4a576f92740c8df2714
SHA1 11b40d5207537b53234bbf8398b646807c52f9c7
SHA512 1111cb03c3556433d6086c74719fc4ec0e9b18d1bffd575931ca09343863c4ecbf344411dad1c55166ec403aa39704c561863802166b0af651801e043ecf09c1
TLSH
T152419A1613B51B25F3B387359EA34D22063BF802EA284F5A83C943891878201B578F6B
MD5 SHA1 SHA512 TLSH

Submit Download

Astro Administración.lnk

Path C:\Users\Admin\Desktop\Astro Administración.lnk
Size 2KB
SHA256 7576dac08934ff568e2be22b2bd6bc6ba7256c26107125a012c9ff13738d97a3
MD5 59fa1ed3e23c9bd64bdba784aa7ab5db
SHA1 580f7dfd821a2da3b353f666f8fd6ba967fff712
SHA512 6c2d648da9de261af3653eb6b8c512d5614d0e4cd20c2d99aa6a66ac91b6cfa04bb0019e41a058ec4c2f470b5609b71429a5930e68ea8326cc599b20a16c9912
TLSH
T1B241781253B50626F2B383369EA30E21473BF803EA284F5A83D943491978211B578F6F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_1752998812\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_1777593740\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_1954107400\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_48820475\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

memory/3432-15-0x00007FFC8FBC0000-0x00007FFC90564000-memory.dmp

Download

memory/3432-8-0x0000021BB4B60000-0x0000021BB4B82000-memory.dmp

Download

memory/3432-9-0x00007FFC8FBC0000-0x00007FFC90564000-memory.dmp

Download

memory/3432-10-0x00007FFC8FBC0000-0x00007FFC90564000-memory.dmp

Download

memory/3432-11-0x00007FFC8FBC0000-0x00007FFC90564000-memory.dmp

Download

memory/3432-5-0x00007FFC8FD4F000-0x00007FFC8FD50000-memory.dmp

Download

memory/3432-12-0x00007FFC8FBC0000-0x00007FFC90564000-memory.dmp

Download

memory/3432-13-0x00007FFC8FBC0000-0x00007FFC90564000-memory.dmp

Download

memory/3432-16-0x00007FFC8FBC0000-0x00007FFC90564000-memory.dmp

Download

memory/3432-24-0x00007FFC8FBC0000-0x00007FFC90564000-memory.dmp

Download