hxxps://cdn[.]discordapp[.]com/attachments/1534186222220742756/1534193456182988871/Astryx_Patcher[.]rar?ex=6a733c7f&is=6a71eaff&hm=57147883fda7ed6c9b1668101d4a4376d76f5e9a1558ca0fa6d02e6807c79842&

Analysis

user interaction
yes
max time kernel
139s
max time network
143s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
04/08/2026, 16:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1534186222220742756/1534193456182988871/Astryx_Patcher.rar?ex=6a733c7f&is=6a71eaff&hm=57147883fda7ed6c9b1668101d4a4376d76f5e9a1558ca0fa6d02e6807c79842&
Sample260804-vfpblsszhw

Score

7^/10

costura discovery packer persistence ransomware

Malware Config

Signatures

Executes dropped EXE 25 IoCs

pid	Process
376	Astryx Patcher.exe
2116	adb.exe
1216	adb.exe
1252	adb.exe
3092	adb.exe
4708	adb.exe
4940	adb.exe
5228	adb.exe
5300	adb.exe
5384	adb.exe
5440	adb.exe
5496	adb.exe
5556	adb.exe
5608	adb.exe
5724	adb.exe
5768	adb.exe
5824	adb.exe
5872	adb.exe
5928	adb.exe
5976	adb.exe
6028	adb.exe
6116	adb.exe
548	adb.exe
3104	adb.exe
5172	adb.exe

Loads dropped DLL 48 IoCs

pid	Process
2116	adb.exe
2116	adb.exe
1216	adb.exe
1216	adb.exe
1252	adb.exe
1252	adb.exe
3092	adb.exe
4708	adb.exe
3092	adb.exe
4708	adb.exe
4940	adb.exe
4940	adb.exe
5228	adb.exe
5228	adb.exe
5300	adb.exe
5300	adb.exe
5384	adb.exe
5384	adb.exe
5440	adb.exe
5440	adb.exe
5496	adb.exe
5496	adb.exe
5556	adb.exe
5556	adb.exe
5608	adb.exe
5608	adb.exe
5724	adb.exe
5724	adb.exe
5768	adb.exe
5768	adb.exe
5824	adb.exe
5824	adb.exe
5872	adb.exe
5872	adb.exe
5928	adb.exe
5928	adb.exe
5976	adb.exe
5976	adb.exe
6028	adb.exe
6028	adb.exe
6116	adb.exe
6116	adb.exe
548	adb.exe
548	adb.exe
3104	adb.exe
3104	adb.exe
5172	adb.exe
5172	adb.exe

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\exe\adb.pdb	adb.exe
File opened for modification	C:\Windows\SysWOW64\symbols\exe\adb.pdb	adb.exe
File opened for modification	C:\Windows\SysWOW64\adb.pdb	adb.exe
File opened for modification	C:\Windows\SysWOW64\exe\adb.pdb	adb.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\wntdll.pdb	adb.exe
File opened for modification	C:\Windows\SysWOW64\symbols\DLL\wkernel32.pdb	adb.exe
File opened for modification	C:\Windows\SysWOW64\dll\wntdll.pdb	adb.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\wntdll.pdb	adb.exe
File opened for modification	C:\Windows\SysWOW64\wntdll.pdb	adb.exe
File opened for modification	C:\Windows\SysWOW64\wkernel32.pdb	adb.exe
File opened for modification	C:\Windows\SysWOW64\DLL\wkernel32.pdb	adb.exe
File opened for modification	C:\Windows\SysWOW64\symbols\DLL\wkernel32.pdb	adb.exe
File opened for modification	C:\Windows\SysWOW64\wntdll.pdb	adb.exe
File opened for modification	C:\Windows\SysWOW64\symbols\exe\adb.pdb	adb.exe
File opened for modification	C:\Windows\SysWOW64\dll\wntdll.pdb	adb.exe
File opened for modification	C:\Windows\SysWOW64\wkernel32.pdb	adb.exe
File opened for modification	C:\Windows\SysWOW64\DLL\wkernel32.pdb	adb.exe
File opened for modification	C:\Windows\SysWOW64\adb.pdb	adb.exe

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral1/files/0x0004000000026045-391.dat	costura

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5188	4708	WerFault.exe	131

System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Astryx Patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1188	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Astryx Patcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Astryx Patcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Astryx Patcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303361840232614"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3054922120-1500138384-519748408-1000\{AA015AC6-5F63-497C-8D1A-72B2282B8085}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe
376	Astryx Patcher.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	1304	7zG.exe
Token: 35	1304	7zG.exe
Token: SeSecurityPrivilege	1304	7zG.exe
Token: SeSecurityPrivilege	1304	7zG.exe
Token: SeDebugPrivilege	376	Astryx Patcher.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
1304	7zG.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 1704	3592	msedge.exe	83
PID 3592 wrote to memory of 1188	3592	msedge.exe	84
PID 3592 wrote to memory of 640	3592	msedge.exe	85
PID 3592 wrote to memory of 5088	3592	msedge.exe	86
PID 3592 wrote to memory of 640	3592	msedge.exe	85
PID 3592 wrote to memory of 640	3592	msedge.exe	85
PID 3592 wrote to memory of 5088	3592	msedge.exe	86
PID 3592 wrote to memory of 1472	3592	msedge.exe	88
PID 3592 wrote to memory of 1472	3592	msedge.exe	88
PID 3592 wrote to memory of 3256	3592	msedge.exe	89
PID 3592 wrote to memory of 1472	3592	msedge.exe	88
PID 3592 wrote to memory of 3256	3592	msedge.exe	89
PID 3592 wrote to memory of 3256	3592	msedge.exe	89
PID 3592 wrote to memory of 4384	3592	msedge.exe	90
PID 3592 wrote to memory of 4384	3592	msedge.exe	90
PID 3592 wrote to memory of 4384	3592	msedge.exe	90
PID 3592 wrote to memory of 1420	3592	msedge.exe	91
PID 3592 wrote to memory of 1420	3592	msedge.exe	91
PID 3592 wrote to memory of 1420	3592	msedge.exe	91
PID 3592 wrote to memory of 3284	3592	msedge.exe	94
PID 3592 wrote to memory of 4820	3592	msedge.exe	95
PID 3592 wrote to memory of 3284	3592	msedge.exe	94
PID 3592 wrote to memory of 4820	3592	msedge.exe	95
PID 3592 wrote to memory of 3192	3592	msedge.exe	96
PID 3592 wrote to memory of 3192	3592	msedge.exe	96
PID 3592 wrote to memory of 2068	3592	msedge.exe	97
PID 3592 wrote to memory of 2068	3592	msedge.exe	97
PID 3592 wrote to memory of 2068	3592	msedge.exe	97
PID 3592 wrote to memory of 2616	3592	msedge.exe	99
PID 3592 wrote to memory of 2000	3592	msedge.exe	103
PID 3592 wrote to memory of 4248	3592	msedge.exe	112
PID 3592 wrote to memory of 4544	3592	msedge.exe	113
PID 3592 wrote to memory of 3632	3592	msedge.exe	114
PID 3592 wrote to memory of 3692	3592	msedge.exe	115
PID 3592 wrote to memory of 3692	3592	msedge.exe	115
PID 376 wrote to memory of 2116	376	Astryx Patcher.exe	124
PID 376 wrote to memory of 1216	376	Astryx Patcher.exe	126
PID 376 wrote to memory of 1252	376	Astryx Patcher.exe	128
PID 2116 wrote to memory of 3092	2116	adb.exe	130
PID 1216 wrote to memory of 4708	1216	adb.exe	131
PID 376 wrote to memory of 4940	376	Astryx Patcher.exe	132
PID 376 wrote to memory of 5228	376	Astryx Patcher.exe	137
PID 376 wrote to memory of 5300	376	Astryx Patcher.exe	139
PID 376 wrote to memory of 5384	376	Astryx Patcher.exe	141
PID 376 wrote to memory of 5440	376	Astryx Patcher.exe	143
PID 376 wrote to memory of 5496	376	Astryx Patcher.exe	145
PID 376 wrote to memory of 5556	376	Astryx Patcher.exe	147
PID 376 wrote to memory of 5608	376	Astryx Patcher.exe	149
PID 3592 wrote to memory of 5640	3592	msedge.exe	151
PID 376 wrote to memory of 5724	376	Astryx Patcher.exe	152
PID 376 wrote to memory of 5768	376	Astryx Patcher.exe	154
PID 376 wrote to memory of 5824	376	Astryx Patcher.exe	156
PID 376 wrote to memory of 5872	376	Astryx Patcher.exe	158
PID 376 wrote to memory of 5928	376	Astryx Patcher.exe	160
PID 376 wrote to memory of 5976	376	Astryx Patcher.exe	162
PID 376 wrote to memory of 6028	376	Astryx Patcher.exe	164
PID 376 wrote to memory of 6116	376	Astryx Patcher.exe	166
PID 376 wrote to memory of 548	376	Astryx Patcher.exe	168
PID 376 wrote to memory of 3104	376	Astryx Patcher.exe	170
PID 376 wrote to memory of 5172	376	Astryx Patcher.exe	172

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1534186222220742756/1534193456182988871/Astryx_Patcher.rar?ex=6a733c7f&is=6a71eaff&hm=57147883fda7ed6c9b1668101d4a4376d76f5e9a1558ca0fa6d02e6807c79842&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ffd4e49c188,0x7ffd4e49c194,0x7ffd4e49c1a0
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,7718257074145376964,8123397528086451858,524288 --field-trial-handle=2412,i,15696349936803949086,12242549542074030464,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,2365454934578364024,11425079138942295212,262144 --field-trial-handle=2412,i,15696349936803949086,12242549542074030464,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:2
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,5085234782828461937,14724039982208236925,524288 --field-trial-handle=2412,i,15696349936803949086,12242549542074030464,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,9235955309029825063,15617056935401288683,2097152 --field-trial-handle=2412,i,15696349936803949086,12242549542074030464,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,18196665941174446376,3634426367640335500,2097152 --field-trial-handle=2412,i,15696349936803949086,12242549542074030464,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,1710387394613040776,11409518400142614056,2097152 --field-trial-handle=2412,i,15696349936803949086,12242549542074030464,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,17006723876516426073,7633209959555994552,2097152 --field-trial-handle=2412,i,15696349936803949086,12242549542074030464,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,71166035161057812,11682379758106801390,524288 --field-trial-handle=2412,i,15696349936803949086,12242549542074030464,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,7353579177207485534,16197438888380452916,524288 --field-trial-handle=2412,i,15696349936803949086,12242549542074030464,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,5554442541816807313,6328245567026219257,524288 --field-trial-handle=2412,i,15696349936803949086,12242549542074030464,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5816,i,8247722560255264627,12613491152737695561,2097152 --field-trial-handle=2412,i,15696349936803949086,12242549542074030464,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,960376168626946047,12152085560950970142,524288 --field-trial-handle=2412,i,15696349936803949086,12242549542074030464,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,10044841536176173185,14988579201887177144,524288 --field-trial-handle=2412,i,15696349936803949086,12242549542074030464,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,10044841536176173185,14988579201887177144,524288 --field-trial-handle=2412,i,15696349936803949086,12242549542074030464,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,14637891604960185534,3342166747336553315,524288 --field-trial-handle=2412,i,15696349936803949086,12242549542074030464,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,11665029678774827305,15241069967147135700,524288 --field-trial-handle=2412,i,15696349936803949086,12242549542074030464,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,11393904607288523675,10178434530833576746,524288 --field-trial-handle=2412,i,15696349936803949086,12242549542074030464,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:8
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,13447864247721743162,16319079316631137533,524288 --field-trial-handle=2412,i,15696349936803949086,12242549542074030464,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5536,i,13422167035754829892,9593760573819620952,262144 --field-trial-handle=2412,i,15696349936803949086,12242549542074030464,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:8
  2⤵
  PID:5640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3888

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2880

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Astryx Patcher\" -spe -an -ai#7zMap1162:90:7zEvent21097
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1304

C:\Users\Admin\Downloads\Astryx Patcher\Astryx Patcher.exe
"C:\Users\Admin\Downloads\Astryx Patcher\Astryx Patcher.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:376
- C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe
  "C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe" devices -l
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe
    adb -L tcp:5037 fork-server server --reply-fd 712
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:3092
- C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe
  "C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe" devices -l
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe
    adb -L tcp:5037 fork-server server --reply-fd 712
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:4708
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 944
      4⤵
      Program crash
      PID:5188
- C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe
  "C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe" devices -l
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1252
- C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe
  "C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe" devices -l
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4940
- C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe
  "C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe" devices -l
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5228
- C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe
  "C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe" devices -l
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5300
- C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe
  "C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe" devices -l
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5384
- C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe
  "C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe" devices -l
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5440
- C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe
  "C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe" devices -l
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5496
- C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe
  "C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe" devices -l
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5556
- C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe
  "C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe" devices -l
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5608
- C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe
  "C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe" devices -l
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5724
- C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe
  "C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe" devices -l
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5768
- C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe
  "C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe" devices -l
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5824
- C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe
  "C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe" devices -l
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5872
- C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe
  "C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe" devices -l
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5928
- C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe
  "C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe" devices -l
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5976
- C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe
  "C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe" devices -l
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:6028
- C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe
  "C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe" devices -l
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:6116
- C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe
  "C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe" devices -l
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:548
- C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe
  "C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe" devices -l
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3104
- C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe
  "C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe" devices -l
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4708 -ip 4708
1⤵
PID:5164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fb2adc73b0e2921e667c28899e7c4f830fbb29c7f563ca0b3319ac4cd7007983
MD5 5a6df42dd698122d665520fb12140c37
SHA1 9d09f6fa2f10e669a83386ff53aae5fba73effeb
SHA512 52513e0bbf5b162ddc3643441c215f197264c32736ed560286ad3dcfba5831b89dd961ff3c2ddda1a50ae1bbaf4589e17ef43817fe8c3294ca18c88dec2e21b4
TLSH
T15DD012317B5BF001C6C120B2D8348B79923F889A74D7C652B024C88EFDF625DA3D6067
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c2c9a9ffe645bb4483011279363f1d6b7efe3d1311c969002595db89e2e28e26
MD5 fd1a71c5f52353ab70a63caeadd8a35f
SHA1 1c2efede69f9484a6b25dfb9879b2e134c0c04fe
SHA512 53bb310c44087d0ad54291ea32ae8e6708d9e6675875d074264aa49b27317393b3c1f0758bd53b04795df767f42392d93ad325da28f085258329151e4a47a03d
TLSH
T12ED09B213756A001C5811071D4244765512E44557497C6527014844DEDB61595395057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e44667ca06376fe5fe760f4c78b8ea97a0e1f6d918523e76d27d374335e56c85
MD5 19406e93dc4408286be472ca6befe41c
SHA1 5ff2ef44a96f9c5177d9311201859fd9bdcb9161
SHA512 b8f2ac5421944e4b1a5dc1ec0e08224055ca014c37729f3e210cc33502cfad93a16cd683c8a4f2da1ebd596cc98486e949fef621801e62e22edbeb6561b14c44
TLSH
T1C16172B9C22281F1F7A3D07263C3423039F99A77B957DE82A198D4797D32F327014218
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a4b7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a4b7.TMP
Size 3KB
SHA256 140c05b54026136288d81dd30a1b8d04474a3331aa8cce40c74654edae540b0a
MD5 eef3032d833843d5433fa665ac3f039a
SHA1 29abc9d00726109098686e4d6979e53628ff8c38
SHA512 52c817565733bbf7c39338775c4ffe60f193c65ccc42d2c08ecebc1ca2b2dfc52fddf2c1c3898b2f471addddfb2b2d9ddbc8bcbbe47e585210f7bba59fa04818
TLSH
T1DD6172B5C22281F1E7A3D07263C7423439F99A77F817DE82A198D4797D32F327454218
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 943B
SHA256 0c07027db34a2734b2d87618408133755c17e597b1c6d4cc1ae7c0a6f98d097e
MD5 52c984109df93e7ff855d410605c5ed4
SHA1 6992eed1a8baad80809b2b9b2832776c467d1ee5
SHA512 cc2f3d426dd3a7d29a2f4fe5760f711859b6c88c79214bf379450a7684b657f3bdc430ed9580c30bb403ea1395c9a8ce6b07ce1cdfe3dea1433b2a404831fbd4
TLSH
T1F31157B387D58A6E890602F46A186E1BCE6D095442A83C2B89D4EF6BD7E3076E10194B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 72264c8e134eeb7773965607cd16f05e61a64da9ea478353bd3b34307d7be297
MD5 ae9a2d5e4784f19c088d5511d2b9c341
SHA1 0af523596b6aa08484c24f1bd7313aae92384e32
SHA512 e22ce4fe788b07143c653db4f7085a28472fdb083a3896ae60ed83470adfbe40d32dcee0fb91cadacbd3d8771171f343c373ef603e028f55097b79bec21639b3
SSDEEP 192:sxZNM/yM/jK1Ml8UQc9uW/f1sU9VWPIdpLHW6+WNGYnNPq8RIg5yOJ:sxZy5q6uW/f1sU9VWgLHbGPM5
TLSH
T1CF52F911AA34597BCCCBD20DFA957F93D6F5547392900E48AAFCDA1C04E6AEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 cdfe796f698fe7d23b2724d93379858aa897e996bfd9460ce951a11ead40276f
MD5 cedc985b2eb1b0ea521b0bf5b468c8e7
SHA1 3e48093bf5c8ccd20e71ede21eafa96df2e21742
SHA512 aec10fa6f6a7fa98a190ba0005061f1242315cd4abdfcca9db955eaec6c1e3d74bfdf55ba656ef5e623bafbb1d06d18c20dd9378f21d215e5c73a2fb4b700d52
SSDEEP 192:sxZNM/yM/jK1Ml8M9uW/f1sz95WPIdpJHW6+WNGYns3q8RIgrJ:sxZy51uW/f1sz95WgJHbGsM9
TLSH
T1BB42E811AA34657BCCCBD209FA957F53D6F5547392900E48AAFCDA1C04E6AEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 f7b04f99e3052efee31affbbd629990e051d64ac0462724da30a69899c1cd0e3
MD5 278e510f15341b52d287565bd42be661
SHA1 e12c118a844442f5ce613ee6dffb5c10bde1fb87
SHA512 cd954987083a1ab8e7a42393c0518924b92c7084ca4e847df8c498cb5da2063c20f8a543f0fb499a27059eae1e8f0b8895492466d70a7556dd2e3b5010cc59df
SSDEEP 768:KdQRMvUWv0sTg8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFTLlTBshVro/6xDB:KdQRMvUWv0sTgu1jakTLROhu/6x1
TLSH
T169D21C3B684CC77E4F841E6CEC2AAF976DD801CB67988D5447FA884C03C77EA511A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 bfb60426ea6b064d99c4bc476de6cdbcdc7e0e2d4f38315474180d89a5af515c
MD5 30bc6ce95ae6a80b72944822472482c3
SHA1 a31859213edeb98820c7a0b98c1f259caea5f715
SHA512 dd18565cf35af96e732c72222c72cd961be51210ffeac64ab71b466b3abba505f3ee3f07a024a034ce84e17fdf1d2148ce35a16863eb7a42189ab6cee9d30157
SSDEEP 384:+1ZcIpDsN5Ab+ezRCX54attKE+wulkb3Yl:WtGAAxzKE75Il
TLSH
T18F825D329C746C3B5EE7A541F48736139EB99127D3C4AF9896DCAB0D00DF19C130B526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 253f36c2451ea97a935e8138f1dc7ba48561749c3a82a9c36496498493eedc85
MD5 c2a3e4e8a935ae81369a8d006248c596
SHA1 99b58729e6d3d78d6fc2e60f5b8d1f3f814ced01
SHA512 85b7918deddeccff42a6c48a0cabb42f121173ea57ae163a54bf2dcf2ffde05a061d328f89a85aada3b027b9f6000a2d50bb0c11b9f43c311dffd944432676f8
SSDEEP 384:+qZcIpzsNskb+ezRCX54attKE+wulkh3Yl:pJpAAxzKE7nIl
TLSH
T17E825D329C746C3B5EE7A541F48736135EB99127D3C4AF9896DCAB0D04EF1AC030B52A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 01b9b98d97c3918519ef5d6854db384816f56fcd7eed2d46a7143bc3c989045f
MD5 c9160ee408c1c58a6177d0fbcd08fbc1
SHA1 07fe281bbf8e3a6474222d3ab1a1230a31a97a85
SHA512 78d2c55116eaddc7c61d0721ac6ba56821e9dcfd95cdb8a3773b2701c114a42ea85db5c7365a550f6d85e445f5a0281b8843f7ed93c0b730b40044b8099c5426
SSDEEP 192:uVLsNskHQGc8t+bevNQmiU1u4N4X54aP1tK9y+wulDnIY8Z4+qry16BKi:GsNskH+ezRCX54attKE+wulk03Ye
TLSH
T1EA422A369C786C3B4EE3A541F04B3A13AEB8916797C4AFA8D6DC6B0C00DF29C130B516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 75ab7bbb6968dd52ba3eca8940eaf5e092ee7d1913a50d69d91ab2c16d710e25
MD5 a6841556809c99ef18272303ad8c87da
SHA1 72de34ef05db1ef3aa562659a3bfd14a66073367
SHA512 a65970d9dfb9249e14b8172fb1a38fb113c67f80d8053951900255e0b4e8eda1099d9a1bf23ba22f089d33beccacdd609a48308e6b60292a058783ddce286cd7
SSDEEP 192:CONw6G+bgQmiUyj/DE54aP1tK9y+i8Oy0RU6:CONw6HgsDE54attKE+pcU6
TLSH
T1BD02D735A8782C7B9EF39D46B5872B176F95112BE6C06B94DAEC1B0C41DB24C1307537
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a6d61e68bbde19e7980c312cc698c30ace69cef84325b65bbf60bc5b0c02044c
MD5 8c32f093cde04c3330ba8db28e60cdf2
SHA1 36f02f7bc9608ca9b5c36d008873ecb566344c04
SHA512 61b5b471f3d0a46f31b82d6023207bf9510b146650597d89b5450fc0cce91f49fe0ec9b228b95f82f47d860d5cefe77e1c3e990e0ff8fadb300d2a3c7048d171
SSDEEP 192:u1LsNskbQGc8t+bevNQmiU1u4N4X54aP1tK9y+wulDnIY8Z4+qry16BKi:WsNskb+ezRCX54attKE+wulk03Ye
TLSH
T16F522A369C786C3B4EE3A541F04B3A13AEB9916797C4AFA8D6DC6B0C04DF29C130B516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 0a4cdd7d5457c868cf1f5fb5281cd23a23b6c1568c847a31e66fa4fdf1bf36a9
MD5 1a7d04fab95ffba5f71dfb95eea331ff
SHA1 9543c5c096082507e59cba32f7ec42b1ecdd1c95
SHA512 f606014ff7e7814fdc5da0a18aca96a61839cfd76e2ad3df679c1b67df7526c1023e92f19dfff411be9dc02e02858df360ee6ea6bdf4619db7fe74c4c2afddf3
SSDEEP 192:u1m+xasuheOwQxMGsNskbQGc8t+bevNQmiU1u4N4X54aP1tK9y+wulDnIY8Z4+qQ:jZcIhsNskb+ezRCX54attKE+wulk03Yl
TLSH
T1B4726D329C746C3A5EE7A441F4872A135EB99127E3C4AF9896ECAB1D04EF1AC130F516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d4df1ea5dd33d3527bccba9f140904fbc22b45e6ff8c501df3b3809f9ce9f4a1
MD5 90b189d5310f98e5d97c6d56b8a322d4
SHA1 b31a93ad8675c6864116c44584d1d41e43933468
SHA512 f652e195515f9d4f96c7bd6d186e8f505a96a09cb9b04dab06ee4309a9646779d70bcaae90c40fb3a20a5ad3c108df52e90ec4a8a742b576b4375eee944c2647
SSDEEP 192:iON96G+b9QmiUyP/eE54aP1tK9y+wulDnIz8Sh+qry1U6:iON96H7GeE54attKE+wulkR3YU6
TLSH
T122120932EC787C6B4EE3A881B4873A136E955227D785BF94D6EC2A1C01EF25C130F526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f9b9452a-68c7-4b24-beb8-41590a609946.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f9b9452a-68c7-4b24-beb8-41590a609946.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

adb.log

Path C:\Users\Admin\AppData\Local\Temp\adb.log
Size 938B
SHA256 babf9923ec21006a8547f4beea16d02e0e5928ba3e7863eab70870294f064566
MD5 c543b8f319b78b12b846a07f5643fb03
SHA1 40a0da17737916db47996c32a53b0b76e701d615
SHA512 5c1a076ae44b40fc6ebc82678e6cc9ab5c59b3a8775e1b846602480be784de1335ad4e6e6cd2978738a8cb882f8c291a1fe2b02dee24729612acea97bfa1f56b
TLSH
T195113A8486A68CDD4608483B28975E62C70662049FF53D3FE1BCD843DF45571B777819
MD5 SHA1 SHA512 TLSH

Submit Download

Astryx Patcher.rar.crdownload

Path C:\Users\Admin\Downloads\Astryx Patcher.rar.crdownload
Size 7.2MB
SHA256 39b2318c5e2ff55e6ee4039388d1a810e86c4778c5e3afd9ba7036cd570005c4
MD5 92f7c42fbab9f72936d6779a8aa7c15f
SHA1 b7abab4a5dabdcf7c75a65d6240923665d5a61c0
SHA512 d222d2ccf9ce36eb040840631ce36acfdf168f8733b765eddf08615738d70dd34fe976547ae69e4f50956657c06bac158de869fcbc31e0736c2504e93374a73c
SSDEEP 196608:2wMUg3Y20CroXZF3wXnN36ockmsxDqmDTTGnQ7ewWN:L2330DpFwXNVckmsxDBTynSew+
TLSH
T1627633D1A023BD5BCE7DC30909419B879235315F4B0492B44D20F668EB6DD26DAEBB2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Astryx Patcher.exe

Path C:\Users\Admin\Downloads\Astryx Patcher\Astryx Patcher.exe
Size 5.5MB
SHA256 e18b10a90a8d9dab16db9757716a4f5c1e91dfe4e5b533d1f9a57e1bdf25519b
MD5 34805b116257b3b45d0e362b39ba17fc
SHA1 bf2c7c3209f58fc2751923ce42200221fc82ddd3
SHA512 d5c8701521f220802b59ad705ea56ff1e0d6e88c159c51fdcd7c004bf48b7104f0119058f6d0d0030189bdb99520003da2d54e2feb1db53ee390291539417179
SSDEEP 98304:sc4elw7hnslij4Ty6YB/IoUZvAbgmkSqvwPiSmn2WIkexWEBZHsniEFTIBkKiKzY:1msE2qE1X33T2ZnxWCsXCI6Tv0RQnlTO
TLSH
T17146F904F3B8A56CD06C1EB250CB6F0402EBC9E9DBF7AB6D55CCE05411B67962E0793A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdbWinApi.dll

Path C:\Users\Admin\Downloads\Astryx Patcher\adb\AdbWinApi.dll
Size 105KB
SHA256 120bef587119c6cb926b86b9be90fdfbce38937588eae28cd91a94ce63c7b965
MD5 47a042211f076ac2ec64a8959f455d02
SHA1 ddaf6836e376c7a5d649e7c66fb0f7f193097ab1
SHA512 134a9484acd567957a6e35fc0a872ed6f8bd3ac6c1526cad2efe2ce392879c5bdf467dd994be4d2c7e78e9849f37710a91d506702a7df5e55e0d852f5734572b
SSDEEP 1536:Rwqdq+3pvspmLh8SCykrpTG7kfGHuNezq02XJqo+iFi1yCPj7+9o:RwqD3L8Tezq0et+ui1yYco
TLSH
T130B36A227891C072C8D361B91AECF76593BEF4B10B6589C7339803DADE643C25B7529B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdbWinUsbApi.dll

Path C:\Users\Admin\Downloads\Astryx Patcher\adb\AdbWinUsbApi.dll
Size 71KB
SHA256 6ca69a2ca0e31309c087d288f058977d421ad03500e4c3e1dbd981241a069c60
MD5 70d9408186450f9aae9b284428593017
SHA1 af00109a1596f5faa7aa0038d535c3ed54dfaa76
SHA512 157354d5a866378f854eb3c1e5cb4d3ad8a8dde93931c0f9ca0e786bfda3edf58178212a066c8cf19ca22225363b08eaf68f6d30c986dae52bca512b39804811
SSDEEP 1536:b72doFmOiHizFbPlspcsbj5ZsP+YeTs1pT7+w2:bSSfN9+YeTs1pT4
TLSH
T1F4636C237990C472CC9651B819ECE621A67FBA501BB184C7779C03DB9E203D1ABB9397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adb.exe

Path C:\Users\Admin\Downloads\Astryx Patcher\adb\adb.exe
Size 8.1MB
SHA256 957e46b8615f7af5b7292a2ddabe98d2e61940c3fb2b0545756507f080613e71
MD5 f62bbae3edbffbf33f913a536c37f5c5
SHA1 c8cb0d5720e2d34d359a89f4250e0971ba4f2da1
SHA512 f2b79507c0b83006c304c5e3e0fce19c9685465f9e487fc0992e8447a6f43f47a18aa39cfe0d21b2e4a29f134c16b17285d5463547ca82347eed9f72d36a5577
SSDEEP 196608:hQbvGuN6MGAaC1spB/fZEf7t/tg/78gPPvSQpZjXvDD+cNGwFZN:hQbvGuNtGAaC10Xi71tjgPnS0BfyMZN
TLSH
T1C6869D06E153A179C90310F1212EB37D6F244A148B258EFBDBD4EDB86B659E0353FB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/376-394-0x00000000063D0000-0x0000000006976000-memory.dmp

Download

memory/376-397-0x0000000005A80000-0x0000000005A8A000-memory.dmp

Download

memory/376-396-0x0000000005D80000-0x0000000005F9C000-memory.dmp

Download

memory/376-395-0x0000000005A90000-0x0000000005B22000-memory.dmp

Download

memory/376-393-0x0000000000600000-0x0000000000B80000-memory.dmp

Download