File name:

AstralRinth.App_0.9.204_x64-setup.exe

Full analysis: https://app.any.run/tasks/a6d316d7-344d-4e08-b994-49f6fb78b029
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 02, 2025, 15:56:52
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

8AE5962E0EEDC3D3E5FB5D240CEB78C7

SHA1:

11EA6BF85D7352AF384314A1DF48FEB15F17C7D4

SHA256:

0BD0B3E1283BD6EC8C5103903F47AD37B4AC5B084DA54A60108AE580A042F1B4

SSDEEP:

98304:TJ8Zac/XSbjzyr3DPXuB6NIaZK7EEsxCAny4uTVb7/U+MIhG40iNrtPbuKj7Jt8A:To8IvRdxpxo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • AstralRinth.App_0.9.204_x64-setup.exe (PID: 6300)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7056)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • AstralRinth.App_0.9.204_x64-setup.exe (PID: 6300)

    • Searches for installed software

      • AstralRinth.App_0.9.204_x64-setup.exe (PID: 6300)

    • The process creates files with name similar to system file names

      • AstralRinth.App_0.9.204_x64-setup.exe (PID: 6300)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeWebview2Setup.exe (PID: 7056)
      • MicrosoftEdgeUpdate.exe (PID: 7108)

    • Process drops legitimate windows executable

      • AstralRinth.App_0.9.204_x64-setup.exe (PID: 6300)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7056)
      • MicrosoftEdgeUpdate.exe (PID: 7108)

    • Process requests binary or script from the Internet

      • AstralRinth.App_0.9.204_x64-setup.exe (PID: 6300)

    • Disables SEHOP

      • MicrosoftEdgeUpdate.exe (PID: 7108)

    • Reads security settings of Internet Explorer

      • MicrosoftEdgeUpdate.exe (PID: 7108)

    • There is functionality for taking screenshot (YARA)

      • AstralRinth.App_0.9.204_x64-setup.exe (PID: 6300)

  • INFO

    • The sample compiled with english language support

      • AstralRinth.App_0.9.204_x64-setup.exe (PID: 6300)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7056)
      • MicrosoftEdgeUpdate.exe (PID: 7108)

    • Create files in a temporary directory

      • AstralRinth.App_0.9.204_x64-setup.exe (PID: 6300)

    • Reads the computer name

      • AstralRinth.App_0.9.204_x64-setup.exe (PID: 6300)
      • MicrosoftEdgeUpdate.exe (PID: 7108)

    • Checks supported languages

      • AstralRinth.App_0.9.204_x64-setup.exe (PID: 6300)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7056)
      • MicrosoftEdgeUpdate.exe (PID: 7108)

    • Checks proxy server information

      • AstralRinth.App_0.9.204_x64-setup.exe (PID: 6300)
      • MicrosoftEdgeUpdate.exe (PID: 7108)
      • wermgr.exe (PID: 2160)

    • Creates files in the program directory

      • MicrosoftEdgeWebview2Setup.exe (PID: 7056)

    • Reads the software policy settings

      • MicrosoftEdgeUpdate.exe (PID: 7108)
      • wermgr.exe (PID: 2160)

    • Process checks computer location settings

      • MicrosoftEdgeUpdate.exe (PID: 7108)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 7108)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:09:25 21:56:47+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x3640
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.9.204.0
ProductVersionNumber: 0.9.204.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: AstralRinth App
FileVersion: 0.9.204
LegalCopyright: -
ProductName: AstralRinth App
ProductVersion: 0.9.204
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
5
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start astralrinth.app_0.9.204_x64-setup.exe microsoftedgewebview2setup.exe microsoftedgeupdate.exe wermgr.exe astralrinth.app_0.9.204_x64-setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2160"C:\WINDOWS\system32\wermgr.exe" "-outproc" "0" "7108" "2064" "2028" "2068" "0" "0" "0" "0" "0" "0" "0" "0" C:\Windows\SysWOW64\wermgr.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wermgr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6176"C:\Users\admin\AppData\Local\Temp\AstralRinth.App_0.9.204_x64-setup.exe" C:\Users\admin\AppData\Local\Temp\AstralRinth.App_0.9.204_x64-setup.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
AstralRinth App
Exit code:
3221226540
Version:
0.9.204
Modules
Images
c:\users\admin\appdata\local\temp\astralrinth.app_0.9.204_x64-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6300"C:\Users\admin\AppData\Local\Temp\AstralRinth.App_0.9.204_x64-setup.exe" C:\Users\admin\AppData\Local\Temp\AstralRinth.App_0.9.204_x64-setup.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
AstralRinth App
Version:
0.9.204
Modules
Images
c:\users\admin\appdata\local\temp\astralrinth.app_0.9.204_x64-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7056C:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe /silent /installC:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
AstralRinth.App_0.9.204_x64-setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update Setup
Exit code:
2147747592
Version:
1.3.195.43
Modules
Images
c:\users\admin\appdata\local\temp\microsoftedgewebview2setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7108"C:\Program Files (x86)\Microsoft\Temp\EUB2D8.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"C:\Program Files (x86)\Microsoft\Temp\EUB2D8.tmp\MicrosoftEdgeUpdate.exe
MicrosoftEdgeWebview2Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update
Exit code:
2147747592
Version:
1.3.195.43
Modules
Images
c:\program files (x86)\microsoft\temp\eub2d8.tmp\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
Total events
4 260
Read events
4 226
Write events
32
Delete events
2

Modification events

(PID) Process:(7108) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\proxy
Operation:writeName:source
Value:
auto
(PID) Process:(7108) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe
Operation:writeName:DisableExceptionChainValidation
Value:
0
(PID) Process:(7108) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\PersistedPings\{FAAA7C24-0119-470F-A2E0-5963D745C067}
Operation:writeName:PersistedPingString
Value:
<?xml version="1.0" encoding="UTF-8"?><request protocol="3.0" updater="Omaha" updaterversion="1.3.195.43" shell_version="1.3.147.37" ismachine="1" sessionid="{1055C7D8-85B7-4EBC-A57B-1D71C87245DE}" userid="{FD984739-A122-4DB0-BE5B-46E3E09D84E4}" installsource="otherinstallcmd" requestid="{FAAA7C24-0119-470F-A2E0-5963D745C067}" dedup="cr" domainjoined="0"><hw logical_cpus="4" physmemory="4" disk_type="2" sse="1" sse2="1" sse3="1" ssse3="1" sse41="1" sse42="1" avx="1"/><os platform="win" version="10.0.19045.4046" sp="" arch="x64" product_type="48" is_wip="0" is_in_lockdown_mode="0"/><oem product_manufacturer="DELL" product_name="DELL"/><exp etag="&quot;r452t1+k2Tgq/HXzjvFNBRhopBWR9sbjXxqeUDH9uX0=&quot;"/><app appid="{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" version="1.3.185.17" nextversion="1.3.195.43" lang="" brand="" client=""><event eventtype="2" eventresult="1" errorcode="0" extracode1="0" system_uptime_ticks="12929386131" install_time_ms="344"/></app></request>
(PID) Process:(7108) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\PersistedPings\{FAAA7C24-0119-470F-A2E0-5963D745C067}
Operation:writeName:PersistedPingTime
Value:
133829854450616074
(PID) Process:(7108) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\PersistedPings\{FAAA7C24-0119-470F-A2E0-5963D745C067}
Operation:delete keyName:(default)
Value:
(PID) Process:(7108) MicrosoftEdgeUpdate.exeKey:\REGISTRY\A\{9c134b6a-edfd-b3fc-f8b7-bfdf523d8163}\Root\InventoryApplicationFile
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(7108) MicrosoftEdgeUpdate.exeKey:\REGISTRY\A\{9c134b6a-edfd-b3fc-f8b7-bfdf523d8163}\Root\InventoryApplicationFile\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
(PID) Process:(2160) wermgr.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
Operation:writeName:ClockTimeSeconds
Value:
E6959F6700000000
(PID) Process:(2160) wermgr.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
Operation:writeName:TickCount
Value:
27C0130000000000
(PID) Process:(7108) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Timings
Operation:writeName:setup_lock_acquire_ms
Value:
0300000000000000000000000000000000000000000000000000000000000000
Executable files
204
Suspicious files
9
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
6300AstralRinth.App_0.9.204_x64-setup.exeC:\Users\admin\AppData\Local\Temp\nsj60C3.tmp\System.dllexecutable
MD5:CFF85C549D536F651D4FB8387F1976F2
SHA256:8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
6300AstralRinth.App_0.9.204_x64-setup.exeC:\Users\admin\AppData\Local\Temp\nsj60C3.tmp\modern-wizard.bmpimage
MD5:CBE40FD2B1EC96DAEDC65DA172D90022
SHA256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
7056MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EUB2D8.tmp\psmachine.dllexecutable
MD5:6708BC8A0A25C258EC65FCA66D7B64CE
SHA256:810796F10921B714F9AE42F97B3E601DCCB1F9B27E0C5CF59C7BA46C2FAACF19
6300AstralRinth.App_0.9.204_x64-setup.exeC:\Users\admin\AppData\Local\Temp\nsj60C3.tmp\nsDialogs.dllexecutable
MD5:6C3F8C94D0727894D706940A8A980543
SHA256:56B96ADD1978B1ABBA286F7F8982B0EFBE007D4A48B3DED6A4D408E01D753FE2
7056MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EUB2D8.tmp\NOTICE.TXTtext
MD5:6DD5BF0743F2366A0BDD37E302783BCD
SHA256:91D3FC490565DED7621FF5198960E501B6DB857D5DD45AF2FE7C3ECD141145F5
7056MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EUB2D8.tmp\MicrosoftEdgeUpdateCore.exeexecutable
MD5:C8B26176E536E1BCE918AE8B1AF951A2
SHA256:BE6AB7DD506E44A0A9EB0DD531929BD8AA0796D85A0353E6944BC6BF1630B717
7056MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EUB2D8.tmp\MicrosoftEdgeUpdateComRegisterShell64.exeexecutable
MD5:714C34FE6098B45A3303C611C4323EAE
SHA256:FBF495968C4A385FF0790E6B65D26610EF917A2B36A5387EFF7AE79D7A980AC5
7056MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EUB2D8.tmp\MicrosoftEdgeComRegisterShellARM64.exeexecutable
MD5:8F7C44E937ECC243D05EAB5BB218440B
SHA256:BC3CDD57A892CE1841787061E23E526AD46575460CD66C1DC6DCF0F811563D59
7056MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EUB2D8.tmp\psuser_64.dllexecutable
MD5:83948D9F4EFEAFF99EBBFF72E50B5FD6
SHA256:422817534059F23CC43950CA02B93575B9D9F96A1CED03F1AC3D8126C6F5C53B
7056MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EUB2D8.tmp\psuser.dllexecutable
MD5:4D098B6708E7541822F5D86850123184
SHA256:268A400839417FB510D79DD0B6ED665AFD27493963F9DD36A306D14180BEA872
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
39
DNS requests
24
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6176
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
DE
binary
408 b
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
973 b
whitelisted
6300
AstralRinth.App_0.9.204_x64-setup.exe
GET
301
23.213.166.81:80
http://go.microsoft.com/fwlink/p/?LinkId=2124703
DE
—
—
whitelisted
2160
wermgr.exe
GET
200
95.101.78.32:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
1.01 Kb
whitelisted
6176
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
DE
binary
419 b
whitelisted
2160
wermgr.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
973 b
whitelisted
6300
AstralRinth.App_0.9.204_x64-setup.exe
GET
200
2.16.10.156:80
http://msedge.sf.dl.delivery.mp.microsoft.com/filestreamingservice/files/c1336fd6-a2eb-4669-9b03-949fc70ace0e/MicrosoftEdgeWebview2Setup.exe
AT
executable
1.58 Mb
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
DE
binary
471 b
whitelisted
1572
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
DE
binary
471 b
whitelisted
—
—
GET
200
95.101.78.32:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
1.01 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3508
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
95.101.78.32:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
104.126.37.129:443
www.bing.com
Akamai International B.V.
DE
whitelisted
1076
svchost.exe
23.213.166.81:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
1176
svchost.exe
20.190.160.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.238
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 95.101.78.32
  • 95.101.78.42
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
www.bing.com
  • 104.126.37.129
  • 104.126.37.123
  • 104.126.37.185
  • 104.126.37.178
  • 104.126.37.184
  • 104.126.37.128
  • 104.126.37.186
  • 104.126.37.177
  • 104.126.37.179
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
login.live.com
  • 20.190.160.4
  • 20.190.160.132
  • 20.190.160.67
  • 40.126.32.76
  • 40.126.32.68
  • 20.190.160.2
  • 40.126.32.74
  • 20.190.160.17
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
msedge.sf.dl.delivery.mp.microsoft.com
  • 2.16.10.156
  • 2.16.10.149
whitelisted
config.edge.skype.com
  • 52.123.243.219
  • 52.123.243.203
  • 52.123.243.64
whitelisted

Threats

PID
Process
Class
Message
6300
AstralRinth.App_0.9.204_x64-setup.exe
Misc activity
ET INFO Packed Executable Download
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AstralRinth.App_0.9.204_x64-setup.exe