Analysis

  • max time kernel
    899s
  • max time network
    902s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    13/11/2026, 04:34

General

  • Target
    AstraScreenShare-Instalador-2.7.32.exe
  • Size 93.0MB
  • Sample261113-e64k8azx5l
  • SHA256 17fd236ec621b5fc63dd1e1edb4436525589ab9c00211169b48dd9a9f59e8c75
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 19 IoCs
  • Reads ssh keys stored on the system 2 TTPs

    Tries to access SSH used by SSH programs.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Discovers running processes 1 TTPs 1 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AstraScreenShare-Instalador-2.7.32.exe
    "C:\Users\Admin\AppData\Local\Temp\AstraScreenShare-Instalador-2.7.32.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4956
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq AstraScreenShare.exe" /FO csv | "C:\Windows\system32\find.exe" "AstraScreenShare.exe"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2364
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq AstraScreenShare.exe" /FO csv
        3⤵
        • Discovers running processes
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1944
      • C:\Windows\SysWOW64\find.exe
        "C:\Windows\system32\find.exe" "AstraScreenShare.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2328
  • C:\Users\Admin\AppData\Local\Programs\astra-screenshare\AstraScreenShare.exe
    "C:\Users\Admin\AppData\Local\Programs\astra-screenshare\AstraScreenShare.exe"
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3192
    • C:\Users\Admin\AppData\Local\Programs\astra-screenshare\AstraScreenShare.exe
      "C:\Users\Admin\AppData\Local\Programs\astra-screenshare\AstraScreenShare.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\AstraScreenShare" --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1760,i,11754902626247644526,7430477600620414988,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=AllowWgcScreenCapturer,AutofillServerCommunication,MediaRouter,OptimizationHints,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,Translate,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1756 /prefetch:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2636
    • C:\Users\Admin\AppData\Local\Programs\astra-screenshare\AstraScreenShare.exe
      "C:\Users\Admin\AppData\Local\Programs\astra-screenshare\AstraScreenShare.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\AstraScreenShare" --field-trial-handle=1760,i,11754902626247644526,7430477600620414988,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=AllowWgcScreenCapturer,AutofillServerCommunication,MediaRouter,OptimizationHints,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,Translate,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      PID:3952
    • C:\Users\Admin\AppData\Local\Programs\astra-screenshare\AstraScreenShare.exe
      "C:\Users\Admin\AppData\Local\Programs\astra-screenshare\AstraScreenShare.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\AstraScreenShare" --app-user-model-id=com.astra.screenshare --app-path="C:\Users\Admin\AppData\Local\Programs\astra-screenshare\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1760,i,11754902626247644526,7430477600620414988,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=AllowWgcScreenCapturer,AutofillServerCommunication,MediaRouter,OptimizationHints,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,Translate,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:1
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2784
    • C:\Users\Admin\AppData\Local\Programs\astra-screenshare\AstraScreenShare.exe
      "C:\Users\Admin\AppData\Local\Programs\astra-screenshare\AstraScreenShare.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\AstraScreenShare" --field-trial-handle=1760,i,11754902626247644526,7430477600620414988,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=AllowWgcScreenCapturer,AutofillServerCommunication,MediaRouter,OptimizationHints,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,Translate,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:8
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      PID:3660
    • C:\Users\Admin\AppData\Local\Programs\astra-screenshare\AstraScreenShare.exe
      "C:\Users\Admin\AppData\Local\Programs\astra-screenshare\AstraScreenShare.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\AstraScreenShare" --field-trial-handle=1760,i,11754902626247644526,7430477600620414988,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=AllowWgcScreenCapturer,AutofillServerCommunication,MediaRouter,OptimizationHints,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,Translate,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:8
      2⤵
      • Executes dropped EXE
      PID:2084
    • C:\Users\Admin\AppData\Local\Programs\astra-screenshare\AstraScreenShare.exe
      "C:\Users\Admin\AppData\Local\Programs\astra-screenshare\AstraScreenShare.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\AstraScreenShare" --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1760,i,11754902626247644526,7430477600620414988,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=AllowWgcScreenCapturer,AutofillServerCommunication,MediaRouter,OptimizationHints,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,Translate,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:8
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:396

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        LICENSE.electron.txt

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\LICENSE.electron.txt
        • Size 1KB
        • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
        • MD5 SHA1 SHA512 TLSH

        LICENSES.chromium.html

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\LICENSES.chromium.html
        • Size 14.5MB
        • SHA256 a683de33a700d9b4989416e1cd394169154574e83773e009a71daf9dd8e1ab96
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_100_percent.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\chrome_100_percent.pak
        • Size 163KB
        • SHA256 0d27d5591c72721ce399133e104114aa802caf3070814570ad205987a51a8ff7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_200_percent.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\chrome_200_percent.pak
        • Size 252KB
        • SHA256 fa1fce57396b3e21776659e50fb1c12fd4c010c9f56f161be6f4437207d21241
        • MD5 SHA1 SHA512 SSDEEP TLSH

        d3dcompiler_47.dll

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\d3dcompiler_47.dll
        • Size 4.7MB
        • SHA256 289767b49dc8525bce262ea06fee4ef9fced2e131a55b25654ce871c1f0498b2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dxcompiler.dll

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\dxcompiler.dll
        • Size 24.7MB
        • SHA256 d8a6ff71c310c934cc859e3e9b1a2c34b0f38253bdc258c1476cbd9ccb633e37
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dxil.dll

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\dxil.dll
        • Size 1.4MB
        • SHA256 473f5e853120a5b6ca583ac51f453664abae15c0db1d307f29c8bf7a7b89f96c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ffmpeg.dll

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\ffmpeg.dll
        • Size 2.9MB
        • SHA256 5c8c4804c266b3c0bd1517c42f9dd310c3733fc14c363fc151306166295af238
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icudtl.dat

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\icudtl.dat
        • Size 10.0MB
        • SHA256 5070de99fbd8a48378543511fb7a072f85bf36f94b4f4e1d420d54be1435d6f1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libEGL.dll

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\libEGL.dll
        • Size 492KB
        • SHA256 09dc89e7a401f272d29ef445f1825f4ef4422c6844892a6d8a56108b47a69504
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libGLESv2.dll

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\libGLESv2.dll
        • Size 7.7MB
        • SHA256 e5d96fb54dfbbf676b0b37c7915bcd907ff28f2ba63b49a72736a43ba3939a4e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        af.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\af.pak
        • Size 562KB
        • SHA256 92aee8e4924742bdd18340dace4d6b20c8b0240e0b884848f83f3de35315efc6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        am.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\am.pak
        • Size 911KB
        • SHA256 7b27275b82628536c73bea71007303dd433508bae4f9961f6894ae53727f41dd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ar.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\ar.pak
        • Size 1004KB
        • SHA256 b9650f157136de5f9c2b3d76d31e1c9df95649b8ad97126ff790c64cc3062b77
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bg.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\bg.pak
        • Size 1.0MB
        • SHA256 b6bb97bd3d4ad76e78031222334236bb5a8e9f6c06f7c4a2b41eb5c4c6172d46
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bn.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\bn.pak
        • Size 1.3MB
        • SHA256 1d80f9bb725dd6ba0cf1ceb8a6f2a6f6cd59b40a41067dab664cbc53ed454f83
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ca.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\ca.pak
        • Size 633KB
        • SHA256 01790fcddb7dc1a570ef117db5cb77747256430093e3b113d7bdf901f481ddeb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cs.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\cs.pak
        • Size 654KB
        • SHA256 185151025bf72a123adcf2b2e3acede08ac596e2632d5a2c5fd331e241de2fc0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        da.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\da.pak
        • Size 591KB
        • SHA256 9b68edca19dc9ee7e72d8f7eeff05bf25106426432e2ea3bc095cea2442ade89
        • MD5 SHA1 SHA512 SSDEEP TLSH

        de.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\de.pak
        • Size 633KB
        • SHA256 adb4867bcb54bc67ba386e1efd2186d70152a3c422ebf16ed47306787e4e5fe1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        el.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\el.pak
        • Size 1.1MB
        • SHA256 a36d5c5ae0a11052fc8a464879abead927a0898e0ed3500f55855c8b3121c4b8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en-GB.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\en-GB.pak
        • Size 512KB
        • SHA256 4b453983009fbb5166cdd82561db4d7b5445eee16678ffe697513e79fc799d7c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en-US.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\en-US.pak
        • Size 518KB
        • SHA256 185fdd6a77aa2d6a9aeb63dc0cdabefdae38bfffb759c3d0401947cc8fcde6d1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        es-419.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\es-419.pak
        • Size 624KB
        • SHA256 6fa4188f7ab85e923bf90df361534b0a87825b989c85e8d41649f643d7fc022e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        es.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\es.pak
        • Size 622KB
        • SHA256 6f60b7e158097ad33e5c799d816dbdd8aae59989d6ef711ae9dfa29f5652bfe6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        et.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\et.pak
        • Size 567KB
        • SHA256 8fa218930eb1e2191880de6ce4f6ba453fe8156819ed30454119e1fd017f5460
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fa.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\fa.pak
        • Size 933KB
        • SHA256 80549816f4f987147f4e121d8a8dac37138148fe09bacc10435941c2044bf57e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fi.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\fi.pak
        • Size 578KB
        • SHA256 93e49c488e2e5b17150dda2f58bae778628eb9a0bb8bcdda7be81269fef428a8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fil.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\fil.pak
        • Size 655KB
        • SHA256 a6b5dd63bc28882fae77d2b0eec1381192069b80d66dbb449d0f5d6619d567de
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fr.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\fr.pak
        • Size 674KB
        • SHA256 c97f530552e0053058826f9bdae820fbae2ad0d0203e17ffbb3dc40b446bde23
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gu.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\gu.pak
        • Size 1.3MB
        • SHA256 3caf2945f233d578af7c93a95c807a5169fa50801fc9ed6b8b6fcdd2a2f08c6e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        he.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\he.pak
        • Size 818KB
        • SHA256 e0bb2086bf4c51653d3bf94b809a2674c4b0b66dfa2be34cf7eaefd66bcb804d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hi.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\hi.pak
        • Size 1.4MB
        • SHA256 3a493b80f4390c68eb039f36f9882ff71349b4947e3c2894a484d58ccf9df42d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hr.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\hr.pak
        • Size 631KB
        • SHA256 3fb7e29e4d35ccca2948c862ac5b3e1177a5f4f9fd4d670159de3ea519d076fc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hu.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\hu.pak
        • Size 677KB
        • SHA256 ead4f6ca8342c394f1538b9ff2e894f6f8269d749b7c976668738b526c0c099a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        id.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\id.pak
        • Size 559KB
        • SHA256 291a27d81105680c04ec453570e8a3161b0beef4e05bb433e4b8912140d7b663
        • MD5 SHA1 SHA512 SSDEEP TLSH

        it.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\it.pak
        • Size 613KB
        • SHA256 c0613eac80790d838815ae870f483d4713e03ed730efa38511f18932fe9eb74a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ja.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\ja.pak
        • Size 746KB
        • SHA256 875aaf699bae58275cb054db7f96782a0f36e6fce15178ad2dc68251ab8707b3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kn.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\kn.pak
        • Size 1.5MB
        • SHA256 4e642d8c65daff6957ab8ac91b9b903180102243ffe2dfc52ebc92c6fe7232cc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ko.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\ko.pak
        • Size 633KB
        • SHA256 5351c797808ce357f86308721b0840d56db6b5a76fd06858db34e912aaaa0169
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lt.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\lt.pak
        • Size 684KB
        • SHA256 a9c89dc09206734232f9d6d472df1903aec1f6349c3cf0042af1ce82f8e3b32c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lv.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\lv.pak
        • Size 682KB
        • SHA256 6034eb70afa90f68d1b8a55581dad81736d843180a2ddeb27e52cdb11adeed7e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ml.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\ml.pak
        • Size 1.5MB
        • SHA256 a4985c323539d245d84518c77a68dc15d010270e5226a8a4d248cb6e597a9dea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mr.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\mr.pak
        • Size 1.3MB
        • SHA256 07229490b866850aada40565b2cb9dbd2f5621ca66d4b7422a9a8a8f40892218
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ms.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\ms.pak
        • Size 588KB
        • SHA256 d3a830abbf8eab0a8722c9de2d5795dd2a3e8c0c0c3df54b682a58402f858b5d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nb.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\nb.pak
        • Size 567KB
        • SHA256 8b6156c8055fe401146a1b6ca412d272579cb26326c73b7034b5736b5fd18ce9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nl.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\nl.pak
        • Size 588KB
        • SHA256 280eb00b177816b8c7f48ed8ee7c8a5ea1a1773e8ea1bd1dcf690472e49e5942
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pl.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\pl.pak
        • Size 655KB
        • SHA256 774292edf5b77028e3f68eded218dc8a24129a0871ef14db060c83710f90e24c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pt-BR.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\pt-BR.pak
        • Size 615KB
        • SHA256 d747b8bf709e8e114cdad0287e4a7ac242460cdede9b7f5b7ec2234fc87e7861
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pt-PT.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\pt-PT.pak
        • Size 619KB
        • SHA256 cc548db7e5021d36cea5d10851cae6d6df1563508d2d08edf8e043fd3cd180a7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ro.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\ro.pak
        • Size 641KB
        • SHA256 03794b26bb4d8d78f0fb0feb7ff4ae226431017c40ebc50815c1e4c05cbb0ff1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ru.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\ru.pak
        • Size 1.0MB
        • SHA256 9cacb06a5fe811b62b06eed747a31a29a207563d4c7c9b7116c069f7de8efc33
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sk.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\sk.pak
        • Size 665KB
        • SHA256 4e6942f0ff4898c61c22a1377bb5d105a63c27a1dc1f3c357aea133cd777a58f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sl.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\sl.pak
        • Size 638KB
        • SHA256 967490b89e93001015f8160e2300adbe51af40c9d5dd29a7710237f204c3c35b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sr.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\sr.pak
        • Size 981KB
        • SHA256 80b5900434dd4ff73f72cb473ba43cb1622e3a68911da4b91e8620585f0c21d2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sv.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\sv.pak
        • Size 571KB
        • SHA256 6599aba4dfbdd72477c1bea9f872913121547c35e520b011c73988378e590b21
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sw.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\sw.pak
        • Size 604KB
        • SHA256 6a11dea8ec8e08c06fc3c2fdae7a9f174ce3c5692feecd0de3dad793557cd855
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ta.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\ta.pak
        • Size 1.5MB
        • SHA256 c53532e5ed353d9a7ef7d066295396165c714c0e71f25acdb670c6d1581e78fb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        te.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\te.pak
        • Size 1.4MB
        • SHA256 85163dbfe6e7ecc2e34ecfb970567cce82a311cb288b1553dfcbdcb512bb64f6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        th.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\th.pak
        • Size 1.2MB
        • SHA256 dfed350facf62a6bd193ffc4fb93070d14d81934636ad3616fb50da6569118f4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tr.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\tr.pak
        • Size 614KB
        • SHA256 479f3b31720fdeba8e327e666fc45deaa305b0c7078ac88ba47b8643d7e65b7c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uk.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\uk.pak
        • Size 1.0MB
        • SHA256 4621c59516861268fc432a56449b552a7d84750a1a68ebd765a4d8442dde77e5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ur.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\ur.pak
        • Size 923KB
        • SHA256 7c974818fe7a9bb445241a20626b81379e7d485b0f4a1a266d9d39814223c994
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vi.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\vi.pak
        • Size 729KB
        • SHA256 79822a3fdfc790d06616f04a63c76a80c4a80fc7b4598cd18b980cc73ac0d76d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh-CN.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\zh-CN.pak
        • Size 523KB
        • SHA256 adc3776b0194593ab042b19a259df0c86d410017a52fcd709e8875cfd614ed31
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh-TW.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\locales\zh-TW.pak
        • Size 517KB
        • SHA256 9fa276205e96996800c593b81062c765888d0dd9f63f97994eae1742a5baeca2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        resources.pak

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\resources.pak
        • Size 5.9MB
        • SHA256 3adae16e84962d24f6e0d35bc5db0f65cb07a397cb12cf37dfb3bded57df6cb4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app.asar

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\resources\app.asar
        • Size 2.0MB
        • SHA256 64a081c2e491d8f253aae51fb93fa83e8d343c357a42e5a67abc27be11014d7f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        astra-audio.exe

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\resources\astra-audio.exe
        • Size 735KB
        • SHA256 8c5b761bf052a47539e640f0157069745cbad8098fce6a80496dc9e188c86880
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevate.exe

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\resources\elevate.exe
        • Size 105KB
        • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
        • MD5 SHA1 SHA512 SSDEEP TLSH

        snapshot_blob.bin

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\snapshot_blob.bin
        • Size 329KB
        • SHA256 314def6cccce2e8b6d9f4d4273c1e306a680f7f9e21d5551663c2c2d13ec155d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        v8_context_snapshot.bin

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\v8_context_snapshot.bin
        • Size 695KB
        • SHA256 36476717691fdbdac6440b96c48e94e8938a97b775340b4734622fdbd731dfad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vk_swiftshader.dll

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\vk_swiftshader.dll
        • Size 5.3MB
        • SHA256 22a2305e52d6cded30c0606c7cb44e25c1374dbbec08f5da183f91de0b1390a4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vk_swiftshader_icd.json

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\vk_swiftshader_icd.json
        • Size 106B
        • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
        • MD5 SHA1 SHA512 TLSH

        vulkan-1.dll

        • Path C:\Users\Admin\AppData\Local\Programs\astra-screenshare\vulkan-1.dll
        • Size 917KB
        • SHA256 457ac4472ea01cdc7bf483629eed2118814611c79e39ea69304adb2509fe28ec
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SpiderBanner.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsc972B.tmp\SpiderBanner.dll
        • Size 9KB
        • SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StdUtils.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsc972B.tmp\StdUtils.dll
        • Size 100KB
        • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsc972B.tmp\System.dll
        • Size 12KB
        • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WinShell.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsc972B.tmp\WinShell.dll
        • Size 3KB
        • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
        • MD5 SHA1 SHA512 TLSH

        nsExec.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsc972B.tmp\nsExec.dll
        • Size 6KB
        • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nsis7z.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsc972B.tmp\nsis7z.dll
        • Size 424KB
        • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
        • MD5 SHA1 SHA512 SSDEEP TLSH

        temp-index

        • Path C:\Users\Admin\AppData\Roaming\AstraScreenShare\Code Cache\js\index-dir\temp-index
        • Size 48B
        • SHA256 ff09cb92a9af4bf96fea73630a03c4627c74315c24ab0b016cb8ee2a4cd796df
        • MD5 SHA1 SHA512

        index

        • Path C:\Users\Admin\AppData\Roaming\AstraScreenShare\DawnWebGPUCache\index
        • Size 256KB
        • SHA256 b46596553fa0eb15dfdf334dfe673f0948a7dee0a46c89c23464672d96eed31e
        • MD5 SHA1 SHA512 SSDEEP

        data_0

        • Path C:\Users\Admin\AppData\Roaming\AstraScreenShare\GPUCache\data_0
        • Size 8KB
        • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
        • MD5 SHA1 SHA512 SSDEEP

        data_1

        • Path C:\Users\Admin\AppData\Roaming\AstraScreenShare\GPUCache\data_1
        • Size 264KB
        • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
        • MD5 SHA1 SHA512 SSDEEP

        data_2

        • Path C:\Users\Admin\AppData\Roaming\AstraScreenShare\GPUCache\data_2
        • Size 8KB
        • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
        • MD5 SHA1 SHA512 SSDEEP

        data_3

        • Path C:\Users\Admin\AppData\Roaming\AstraScreenShare\GPUCache\data_3
        • Size 8KB
        • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
        • MD5 SHA1 SHA512 SSDEEP

        CURRENT

        • Path C:\Users\Admin\AppData\Roaming\AstraScreenShare\Local Storage\leveldb\CURRENT
        • Size 16B
        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
        • MD5 SHA1 SHA512

        Network Persistent State

        • Path C:\Users\Admin\AppData\Roaming\AstraScreenShare\Network\Network Persistent State
        • Size 59B
        • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
        • MD5 SHA1 SHA512 TLSH

        a49f1ff5-2e43-4139-a693-8e25e2d7ea5c.tmp

        • Path C:\Users\Admin\AppData\Roaming\AstraScreenShare\Network\a49f1ff5-2e43-4139-a693-8e25e2d7ea5c.tmp
        • Size 443B
        • SHA256 b84a50a024c2714861c5fffbf2edb934a86da4b79bda8556f20e5fc0e17482f2
        • MD5 SHA1 SHA512 TLSH

        c2373e38-a46c-43e1-b4d7-2c4b269ce5e5.tmp

        • Path C:\Users\Admin\AppData\Roaming\AstraScreenShare\Network\c2373e38-a46c-43e1-b4d7-2c4b269ce5e5.tmp
        • Size 310B
        • SHA256 1a80c73f782b9d1cf84806eff00b4b349cce897bca04191856f037bc0a4ecbd8
        • MD5 SHA1 SHA512 TLSH

        f9cf9357-f06f-4d86-858c-72ec0e692835.tmp

        • Path C:\Users\Admin\AppData\Roaming\AstraScreenShare\Network\f9cf9357-f06f-4d86-858c-72ec0e692835.tmp
        • Size 471B
        • SHA256 aaf9d5a3223d764f77e6afcd6cf8da19356f5e36e257f95a2884be85564fa56e
        • MD5 SHA1 SHA512 TLSH

        default.dic

        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
        • Size 2B
        • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
        • MD5 SHA1 SHA512

        memory/396-840-0x000002CE55580000-0x000002CE55581000-memory.dmp

        memory/396-829-0x000002CE55580000-0x000002CE55581000-memory.dmp

        memory/396-831-0x000002CE55580000-0x000002CE55581000-memory.dmp

        memory/396-842-0x000002CE55580000-0x000002CE55581000-memory.dmp

        memory/396-841-0x000002CE55580000-0x000002CE55581000-memory.dmp

        memory/396-830-0x000002CE55580000-0x000002CE55581000-memory.dmp

        memory/396-839-0x000002CE55580000-0x000002CE55581000-memory.dmp

        memory/396-838-0x000002CE55580000-0x000002CE55581000-memory.dmp

        memory/396-837-0x000002CE55580000-0x000002CE55581000-memory.dmp

        memory/396-836-0x000002CE55580000-0x000002CE55581000-memory.dmp

        memory/396-843-0x000002CE57A80000-0x000002CE5934A000-memory.dmp

        memory/2636-807-0x000001754EDB0000-0x000001755067A000-memory.dmp

        memory/2636-869-0x000001754EDB0000-0x000001755067A000-memory.dmp

        memory/2636-715-0x000001754EDB0000-0x000001755067A000-memory.dmp