hxxps://cdn[.]discordapp[.]com/attachments/1231260381981180058/1231260573967319140/Synapse_X[.]exe?ex=66364fc4&is=6623dac4&hm=03ac8c5b670c0b04df4aeb4c668e234687e7c9785a7f4f9a07a21a9c2d674d9a&

Analysis

max time kernel
338s
max time network
324s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 15:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1231260381981180058/1231260573967319140/Synapse_X.exe?ex=66364fc4&is=6623dac4&hm=03ac8c5b670c0b04df4aeb4c668e234687e7c9785a7f4f9a07a21a9c2d674d9a&

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
2604	Synapse_X.exe
4452	Synapse_X.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
58	raw.githubusercontent.com
59	raw.githubusercontent.com
497	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133580996844150105"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3368	chrome.exe
3368	chrome.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5016	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3368	chrome.exe
3368	chrome.exe
3420	chrome.exe
3420	chrome.exe
3420	chrome.exe
2500	msedge.exe
2500	msedge.exe

Suspicious use of AdjustPrivilegeToken 55 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeShutdownPrivilege	3368	chrome.exe
Token: SeCreatePagefilePrivilege	3368	chrome.exe
Token: SeDebugPrivilege	2604	Synapse_X.exe
Token: SeDebugPrivilege	5016	taskmgr.exe
Token: SeSystemProfilePrivilege	5016	taskmgr.exe
Token: SeCreateGlobalPrivilege	5016	taskmgr.exe
Token: 33	4888	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4888	AUDIODG.EXE
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeShutdownPrivilege	3420	chrome.exe
Token: SeCreatePagefilePrivilege	3420	chrome.exe
Token: SeDebugPrivilege	4452	Synapse_X.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
3368	chrome.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 1936	3368	chrome.exe	85
PID 3368 wrote to memory of 1936	3368	chrome.exe	85
PID 3368 wrote to memory of 1232	3368	chrome.exe	86
PID 3368 wrote to memory of 1232	3368	chrome.exe	86
PID 3368 wrote to memory of 1232	3368	chrome.exe	86
PID 3368 wrote to memory of 1232	3368	chrome.exe	86
PID 3368 wrote to memory of 1232	3368	chrome.exe	86
PID 3368 wrote to memory of 1232	3368	chrome.exe	86
PID 3368 wrote to memory of 1232	3368	chrome.exe	86
PID 3368 wrote to memory of 1232	3368	chrome.exe	86
PID 3368 wrote to memory of 1232	3368	chrome.exe	86
PID 3368 wrote to memory of 1232	3368	chrome.exe	86
PID 3368 wrote to memory of 1232	3368	chrome.exe	86
PID 3368 wrote to memory of 1232	3368	chrome.exe	86
PID 3368 wrote to memory of 1232	3368	chrome.exe	86
PID 3368 wrote to memory of 1232	3368	chrome.exe	86
PID 3368 wrote to memory of 1232	3368	chrome.exe	86
PID 3368 wrote to memory of 1232	3368	chrome.exe	86
PID 3368 wrote to memory of 1232	3368	chrome.exe	86
PID 3368 wrote to memory of 1232	3368	chrome.exe	86
PID 3368 wrote to memory of 1232	3368	chrome.exe	86
PID 3368 wrote to memory of 1232	3368	chrome.exe	86
PID 3368 wrote to memory of 1232	3368	chrome.exe	86
PID 3368 wrote to memory of 1232	3368	chrome.exe	86
PID 3368 wrote to memory of 1232	3368	chrome.exe	86
PID 3368 wrote to memory of 1232	3368	chrome.exe	86
PID 3368 wrote to memory of 1232	3368	chrome.exe	86
PID 3368 wrote to memory of 1232	3368	chrome.exe	86
PID 3368 wrote to memory of 1232	3368	chrome.exe	86
PID 3368 wrote to memory of 1232	3368	chrome.exe	86
PID 3368 wrote to memory of 1232	3368	chrome.exe	86
PID 3368 wrote to memory of 1232	3368	chrome.exe	86
PID 3368 wrote to memory of 1232	3368	chrome.exe	86
PID 3368 wrote to memory of 1448	3368	chrome.exe	87
PID 3368 wrote to memory of 1448	3368	chrome.exe	87
PID 3368 wrote to memory of 2868	3368	chrome.exe	88
PID 3368 wrote to memory of 2868	3368	chrome.exe	88
PID 3368 wrote to memory of 2868	3368	chrome.exe	88
PID 3368 wrote to memory of 2868	3368	chrome.exe	88
PID 3368 wrote to memory of 2868	3368	chrome.exe	88
PID 3368 wrote to memory of 2868	3368	chrome.exe	88
PID 3368 wrote to memory of 2868	3368	chrome.exe	88
PID 3368 wrote to memory of 2868	3368	chrome.exe	88
PID 3368 wrote to memory of 2868	3368	chrome.exe	88
PID 3368 wrote to memory of 2868	3368	chrome.exe	88
PID 3368 wrote to memory of 2868	3368	chrome.exe	88
PID 3368 wrote to memory of 2868	3368	chrome.exe	88
PID 3368 wrote to memory of 2868	3368	chrome.exe	88
PID 3368 wrote to memory of 2868	3368	chrome.exe	88
PID 3368 wrote to memory of 2868	3368	chrome.exe	88
PID 3368 wrote to memory of 2868	3368	chrome.exe	88
PID 3368 wrote to memory of 2868	3368	chrome.exe	88
PID 3368 wrote to memory of 2868	3368	chrome.exe	88
PID 3368 wrote to memory of 2868	3368	chrome.exe	88
PID 3368 wrote to memory of 2868	3368	chrome.exe	88
PID 3368 wrote to memory of 2868	3368	chrome.exe	88
PID 3368 wrote to memory of 2868	3368	chrome.exe	88
PID 3368 wrote to memory of 2868	3368	chrome.exe	88
PID 3368 wrote to memory of 2868	3368	chrome.exe	88
PID 3368 wrote to memory of 2868	3368	chrome.exe	88
PID 3368 wrote to memory of 2868	3368	chrome.exe	88
PID 3368 wrote to memory of 2868	3368	chrome.exe	88
PID 3368 wrote to memory of 2868	3368	chrome.exe	88
PID 3368 wrote to memory of 2868	3368	chrome.exe	88

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1231260381981180058/1231260573967319140/Synapse_X.exe?ex=66364fc4&is=6623dac4&hm=03ac8c5b670c0b04df4aeb4c668e234687e7c9785a7f4f9a07a21a9c2d674d9a&
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff95f86ab58,0x7ff95f86ab68,0x7ff95f86ab78
  2⤵
  PID:1936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1648 --field-trial-handle=1736,i,18422719681666461265,6530578724784409186,131072 /prefetch:2
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1736,i,18422719681666461265,6530578724784409186,131072 /prefetch:8
  2⤵
  PID:1448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2172 --field-trial-handle=1736,i,18422719681666461265,6530578724784409186,131072 /prefetch:8
  2⤵
  PID:2868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3000 --field-trial-handle=1736,i,18422719681666461265,6530578724784409186,131072 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3020 --field-trial-handle=1736,i,18422719681666461265,6530578724784409186,131072 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4520 --field-trial-handle=1736,i,18422719681666461265,6530578724784409186,131072 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4560 --field-trial-handle=1736,i,18422719681666461265,6530578724784409186,131072 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4568 --field-trial-handle=1736,i,18422719681666461265,6530578724784409186,131072 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4528 --field-trial-handle=1736,i,18422719681666461265,6530578724784409186,131072 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4628 --field-trial-handle=1736,i,18422719681666461265,6530578724784409186,131072 /prefetch:8
  2⤵
  PID:2460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4608 --field-trial-handle=1736,i,18422719681666461265,6530578724784409186,131072 /prefetch:8
  2⤵
  PID:2928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4632 --field-trial-handle=1736,i,18422719681666461265,6530578724784409186,131072 /prefetch:8
  2⤵
  PID:312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4504 --field-trial-handle=1736,i,18422719681666461265,6530578724784409186,131072 /prefetch:8
  2⤵
  PID:1808
- C:\Users\Admin\Downloads\Synapse_X.exe
  "C:\Users\Admin\Downloads\Synapse_X.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2604

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4716

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5016

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f4 0x2fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff95f86ab58,0x7ff95f86ab68,0x7ff95f86ab78
  2⤵
  PID:1140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1676 --field-trial-handle=1896,i,5623768765777589590,7935078671543676928,131072 /prefetch:2
  2⤵
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1896,i,5623768765777589590,7935078671543676928,131072 /prefetch:8
  2⤵
  PID:884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2256 --field-trial-handle=1896,i,5623768765777589590,7935078671543676928,131072 /prefetch:8
  2⤵
  PID:3152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3088 --field-trial-handle=1896,i,5623768765777589590,7935078671543676928,131072 /prefetch:1
  2⤵
  PID:512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3120 --field-trial-handle=1896,i,5623768765777589590,7935078671543676928,131072 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4348 --field-trial-handle=1896,i,5623768765777589590,7935078671543676928,131072 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4356 --field-trial-handle=1896,i,5623768765777589590,7935078671543676928,131072 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4624 --field-trial-handle=1896,i,5623768765777589590,7935078671543676928,131072 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4772 --field-trial-handle=1896,i,5623768765777589590,7935078671543676928,131072 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4920 --field-trial-handle=1896,i,5623768765777589590,7935078671543676928,131072 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4748 --field-trial-handle=1896,i,5623768765777589590,7935078671543676928,131072 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4540 --field-trial-handle=1896,i,5623768765777589590,7935078671543676928,131072 /prefetch:8
  2⤵
  PID:2720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4620 --field-trial-handle=1896,i,5623768765777589590,7935078671543676928,131072 /prefetch:8
  2⤵
  PID:4224

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2076

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:448

C:\Users\Admin\Downloads\Synapse_X.exe
"C:\Users\Admin\Downloads\Synapse_X.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://femhub.net/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:2500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9508d46f8,0x7ff9508d4708,0x7ff9508d4718
    3⤵
    PID:1048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,4732988230277261228,14171136422149414882,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
    3⤵
    PID:632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,4732988230277261228,14171136422149414882,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,4732988230277261228,14171136422149414882,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
    3⤵
    PID:3064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4732988230277261228,14171136422149414882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
    3⤵
    PID:4248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4732988230277261228,14171136422149414882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
    3⤵
    PID:2296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2084,4732988230277261228,14171136422149414882,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4700 /prefetch:8
    3⤵
    PID:556
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,4732988230277261228,14171136422149414882,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 /prefetch:8
    3⤵
    PID:3984
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,4732988230277261228,14171136422149414882,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 /prefetch:8
    3⤵
    PID:4252
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:5844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color B
    3⤵
    PID:5968
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:5892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color B
    3⤵
    PID:6008
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:5948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color B
    3⤵
    PID:6136
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:6020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color B
    3⤵
    PID:5172
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:3840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color B
    3⤵
    PID:5328
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:5232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color B
    3⤵
    PID:5364
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:5292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color B
    3⤵
    PID:1120
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:1596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color B
    3⤵
    PID:3660
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:5380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color B
    3⤵
    PID:2232
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:5400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color B
    3⤵
    PID:3236
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:1404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color B
    3⤵
    PID:4720
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:1660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color B
    3⤵
    PID:3584
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:2372
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:1008
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:1980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color B
    3⤵
    PID:4244
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:4184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color B
    3⤵
    PID:1836
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:1228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color B
    3⤵
    PID:5648
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:4408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color B
    3⤵
    PID:5300
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:5496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color B
    3⤵
    PID:2860
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:5616
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:5788
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:5864
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color B
    3⤵
    PID:3236
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:5980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color B
    3⤵
    PID:5372
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:4980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color B
    3⤵
    PID:5728
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:5748
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:5444
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:4336
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:6084
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:5908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color B
    3⤵
    PID:6976
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:6184
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:6404
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:6500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color B
    3⤵
    PID:6308
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:6676
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:6764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color B
    3⤵
    PID:6892
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:1312
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:6392
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:6360
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:6888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color B
    3⤵
    PID:7692
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:6064
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:5196
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:6844
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:5348
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:7216
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:7312
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:7744
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:8072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color B
    3⤵
    PID:5508
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:5572
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:5692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color B
    3⤵
    PID:5484
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:2392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color B
    3⤵
    PID:6420
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:7608
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:5084
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:6352
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:7728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color B
    3⤵
    PID:2832
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:3620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color B
    3⤵
    PID:7996
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:5608
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:7440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color B
    3⤵
    PID:392
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:7304
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:6412
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:4936
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:5284
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:6456
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:6232
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:3648
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:6892
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:8512
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:9012
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:3588
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:8092
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:4808
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:8888
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:5640
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:7680
- C:\Synapsex\VXenrpQ.exe
  "C:\Synapsex\VXenrpQ.exe"
  2⤵
  PID:7756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3364

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c color B
1⤵
PID:4252

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c color B
1⤵
PID:6064

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c color B
1⤵
PID:6380

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c color B
1⤵
PID:7120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c color B
1⤵
PID:6076

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c color B
1⤵
PID:6552

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c color B
1⤵
PID:7440

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c color B
1⤵
PID:7652

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c color B
1⤵
PID:744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c color B
1⤵
PID:3492

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c color B
1⤵
PID:5440

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c color B
1⤵
PID:7004

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c color B
1⤵
PID:7932

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c color B
1⤵
PID:7428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c color B
1⤵
PID:6784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c color B
1⤵
PID:7316

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c color B
1⤵
PID:8244

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c color B
1⤵
PID:6876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528882
1⤵
PID:8200

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c color B
1⤵
PID:8864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c color B
1⤵
PID:8184

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c color B
1⤵
PID:5596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Synapsex\VXenrpQ.exe

Filesize
896KB

MD5
f4554c9b62afc9133aec442c2bdaa19c

SHA1
d99a1515e98fb0e726859f87260ed522e046226e

SHA256
456e8d7df11afae8d0803f1ca6e5f46d0a070f62c445f33b15566e736a27fdb4

SHA512
a1e887d071972d29aebdd0f1154b792f74814c43ffb5e1574bd568b436147d46b673e413e11302f097b5ce2658061a9813acd5385978d18d2b68be51bccbb9a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
58bb95b4094ea52340b0fa368840c9a5

SHA1
03e801a2f4735f3f47b6822d4660e55210e56567

SHA256
65d15a1557409d3cb361251a31e7a620874bd504e12187d1260d9b80fbf6b235

SHA512
6931e70506a094e390cbcb45ae3bbca25ea54ab1937d6b5b3443890c5f436f5ee04dd587605ff1d7055f4f810d3ac690e1a42b39020e242389dddbce5f7b3deb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
1eaf70bb37d95742ba618b38b579c8aa

SHA1
a26584c54cef198c1297e104bed1411b3a8df8a7

SHA256
1eca32abe32af0629e8501022e9697f1656d4eed09e74cd0a6b473fdb995ba1f

SHA512
f8e638c82f003de92f7f97cafeb0fa3f6d3c5d6d96db9d4fee3d23038de14648aa8784c078f99ecde29ec729b73c84609a35222b0c5fb8f566ed0d7291b9adef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
d622c941a0aac99e9a331497ffd674e8

SHA1
2d18e42800d757709ac068b20f2bae0eeca3c23a

SHA256
172c6f5335d289a567523200b33a114fefe6d1c2adaa075df7814b4910b2c80c

SHA512
83cfb97c64d735351e4731a37eb9db0cdcd05bbb17a24c554d122b5c442dd996b9bfabf20a2058e2d2799178a5a23efc3904eb2c045639df1980dc5d5749b3bc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3

Filesize
4.0MB

MD5
503cd3d4dea1d547b14dbd918accb6f4

SHA1
c4c0ffde09876208c943e889f7f7ddba9d4fea0a

SHA256
15ee216cd93e4b41be329d8ee4cc853d4c761e4b9afa484bb4ef4236cc989628

SHA512
5ae1807fa5fbf5f19d74f615168d8890a1f593ca1d0ffbf61162dac6360295bd21a058c7bd73548742944791cf90a448b07ebe40778ee6422a5000507df93973

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG

Filesize
320B

MD5
7fa1b01bda82723f51fb474210b78861

SHA1
6273320e35d689632474fb92a505a01bc1b717da

SHA256
8ade887eef1d8b18edb7bcd538d2861457cd7fcde6d94c22d2449b7a3a03d35d

SHA512
5c2766db342a25f0908b74e4a502d6c8bf06d32d2a4564d75bdbb2b26418b81f1e0126886a053bafe68041ba645513486a76643efca33c6d6f88cc39fc8c0d3b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\LOG

Filesize
330B

MD5
87f6b79c114456e44e41599ab92ebf98

SHA1
3af96d13394ef8a434b270267e47e5b99e603d9f

SHA256
64fece1592ff715c13349686c4617c59a9f39cea5508db3287348c3c96010277

SHA512
d08f0daa99bf55635848ddb3e05a5a113da714badd84f0066aadc4a905316449fd482cd79efee518a18676fecc4cbebfce0c140e30f50bac8e9510d8e7cadeaa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History

Filesize
152KB

MD5
3d322550b876c03282339461ae931a26

SHA1
29e0e3ec4902838b016769f691db70a25c363907

SHA256
4135bd94a9bafeccbd71ae4ff49c40a0f103571b867e51bf11981343dcc68ab4

SHA512
d5867278cc92fef69ec46c5fa69894fedf05cec23604cfb407969b89f47c206afcd69bc6b3cd708fb5b4eacb54317190e3236867d03ae1508105c642f8763a90

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG

Filesize
329B

MD5
b8614cda8fbc2aefa4d1d876cd698436

SHA1
24a19a03facd39c9271be05ff5a2af5e2221b0f9

SHA256
cca36fcddb1c1b28fb01fdd12e880e75ba86365f7c2baec381a38c4d4236b613

SHA512
51b2a201cee094875a1391a666f9403dd9df9451e8eed36fe4e49f02f69e5d74d4e8771d2d422c615d548c00e6292ab581d900a7ad506998ce678e45498ca48d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies

Filesize
20KB

MD5
8724ef9740492e31ce113f5f42f4122a

SHA1
922a01c082cc7cb098a90c409cf2d64b31ac055d

SHA256
6b46c4c2df525ee065ec2eaa1b83895a3fe32ecac5030e8c926f202a45127d50

SHA512
1025a480234c83dd1f487517cc98adfd3dd874bf4a95cc265d040491c44a8bdd7d598b2d7781e5444b3d10507243a6eee52e0a04dcd4adeaddfa13b4ff926678

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
ae7812c996026a99199a51e3e0aaf445

SHA1
bafb8839e5b062d6584d3e9bc55e21e410b4dfed

SHA256
976744540ae772b8d8f39b9d6063f93d0adb4ddc0f731720291d2e664f3ede29

SHA512
79aacdef4ba786892055b384887b0f41d85b73c8d0b816de32401919beead5f3f41e085692a8707d75a49d6b15964552bb440bc018454ebe59dae675c8f36173

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
2e38dd50e357c75a0564a8de7328324c

SHA1
cf822f358e291a84f3419498decfaddcaf123ea7

SHA256
13c24a1534de062027a0ce0236c3e0696bbfb48fc65a7c6fa4be80348c07fac2

SHA512
e19a55ab06068f760d659be35e763df82ac5e74c04cd6284744cdf415959b75a987522150c6bdf39ed8db0932648f59ce1c245254032603dd1841adfbf32e6b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL

Filesize
36KB

MD5
90513cb188129c7ad188ee3d31471d3a

SHA1
fb2ffec2b269d56d952ac2f0b283815871ce8376

SHA256
253662937708968d3f58ac313268a4962cb11faa24a9841bfd8975d4f173bc8b

SHA512
33d822d300318086d71321eef179d0e85fe3439135edf47725672cd719cef1d8902098f9f0fbdb3858af74f43e99150de20423e7dba5cff95416735ffe21792a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
8a73038b4458401c711cfcc3be3f9210

SHA1
ee66ece0433fcfc56a03049d1c58e94691caeae2

SHA256
f1539a90d0ce4b06123f807fbd8d23505c2a6ce5f8d794591be741c075f747d5

SHA512
d80a88dd63388c3fa30b7c4cf542d749b0f7bbee0101af7094cebac7631877ce0207567c29b8e6c6ba07a14984afe90cca78c838dd7850bc183896608770ecff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
cabdcc9b70f8c7cab49cd838be1faa99

SHA1
1a5c3228d844279a4d7417c1cf54dc03ec0b9bb9

SHA256
e7277e0b098d4b0676d86d9dc8eee830bde08272504b6a1be3e3b63ce2469152

SHA512
e435966f0e26f19844746f0501b41885a3525b234e8042d955a13077cbfa578ee1b1691636bece936c2bf8a58f6e7f64694cd68a8f6a7b299be42f76278657bb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
2201755944335b78af5e9d6348e27c81

SHA1
f4ebf92ae2ccceb6a254e17bf91a32a1564da96d

SHA256
a8cf17474cd0e354d86bc0582f70b1156d8b65c9b1d57e11b72a3adb31d98ea1

SHA512
8062ba9526afb877257c96f85013dddb667d64eefa0eeb9199306295c5066c6a810b1f5addd4d6fd7d50a8936c4da95c8deca4583660633abe5ec12b9e4bbd78

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
b328baac94c319791bdabc63c06a2853

SHA1
dc1295c33263c615e1d99d51e111cd0e4d23df38

SHA256
247d348b89014d62a985f82a4e4dd19394f43ef2384681e72a5d70d3dac193fd

SHA512
ac8b31f1deac85cdf597efba33e6ba88f22cf19f9b5759d7dd0eb5e4923ca99f4fd83657ea6bd866f2f4058ddc1212d3b960d03421ed3067272b2a83974715fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
71db8f7f06efb4355bf56bdc94eeeba4

SHA1
6ef2e35a0df020fcbcb24ef9102bbb8df46856b9

SHA256
5fd374c4cab83e7338f4fefea820e00d96f44da440078ef205019dc2ba8a7c92

SHA512
549b3faca7d289f154f187654084a37370307f1de19ca89853541e5a0c1865175fb92af24e08d37c10dc8617630498cc984abf27583ba04901cf39844429b1fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log

Filesize
232B

MD5
8a30a1fdd0459d9ea8b1e78a8e636856

SHA1
9d7225e97f9cfcfb225cfbfd0b0bba21d4efdd20

SHA256
88fe1d31608930f2738d102d45c75dc77acdf01a1b69bfb7e7c0281575b75e33

SHA512
b529bce870cd8165bf82f3ebf94f07552467bd0993b9d35145182e54e26fb2ae8e7bb167d88267b632757e2146f27dfddf8867db0c66e5dcc306db12ec6b7bef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG

Filesize
317B

MD5
cc36dbab439e53a5ef691bee055d9abd

SHA1
af1ed7e27f3d413b44128478b8c8f63deaf0b8fc

SHA256
9a3a89336988b6809f74cddd0924bb61806ebbd9fa2156f01fac0d548c55fd6f

SHA512
7f16d7d1d04b481a8ef4ac714a28fa650c6da59735c451dccd879b865a88c5bf46dfd0b24faaa9dbf941e60270bf81efeea6a185b1ca522a5db645dc5291c4c1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13358099685540867

Filesize
420B

MD5
ef302aebd0bae6d5125d6bf1c7f71fe8

SHA1
9ae7d4977f31ad89b4e15698b2e1f2a07636d7c3

SHA256
ad40e6702e0dc17e57eb20906d332b4b51b7c0fa86e4c6710196e7e03cb4d29b

SHA512
1c7f6a40ce1f2bb4f93cf0e998995223b5ecd256858f97eadeac333fc2fae7933d2be1c2871457bc22609c4be6fcd9eb35883d877249b557f64c9cc3c6d85c07

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG

Filesize
348B

MD5
43fba508c0e9a88edeecce779c06fcda

SHA1
de46aed0990441a01a3eed14e477cd47b8637a36

SHA256
babe4dab468c8429c1427b486d60004991bf22d32bb33cf344dd2506823385f8

SHA512
eb7b0413afb4f3884551af3157317d6de4fdc284a758b7bd11c4b53c32882c0c3649294926f4f3ac116d3b08153e7cb9bd3749f31b1f08a57582a2ab9806480a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log

Filesize
15KB

MD5
2b7fe0582e800e4da32f03458493896b

SHA1
6914396efbb87d8b5554ea018113efe043664b00

SHA256
83d092f7868ece073ca43ac24cd02370b3220f853a797b89ad684811f2b993aa

SHA512
914384f9729d10c82939f544808e1c053dd992fb72c91b2fa90c1eaf6988d33659536dc4e439fdda0b4ab216dddb3b2b0cd415e4a07f65e4fc9d988c12ed7861

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG

Filesize
324B

MD5
ef8de38c904262171769cd0d335bb9e8

SHA1
d170f165782bca5b7faa44c57af7b5a21e1b2107

SHA256
1a0469809004995f40b59d36be3eff089c15fc985974c44b572df74f710bf742

SHA512
bed3bd119123fa9c945711d8fa782dcdeb3343a19d8444a7de9921b3ecdb4b47f420a0d518d9d5cffa25709b6de74f457f0eee43eb0a494011deabe32e357067

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log

Filesize
4KB

MD5
222ed2cc7fa0d4890a7ecffbdbd5e4ca

SHA1
73d3eaeaa3bc146d315cf0ced02ac659c46b7246

SHA256
de6599d8b9aeee6cd0adae916784f87100b7afe357e5613fcd908e1e06760c37

SHA512
99bd556d4e5b9b89223552d708da279ad46b7e121046f97d5f6f3f1382da0962ed75a6cc096b54b7e81519d13018e87a52dd000796d39e5de322c85daddade9a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG

Filesize
320B

MD5
9a74ba773a3d546121864ca1aef399b8

SHA1
3342f0358dbcb37228becf39683805c16bd6afd0

SHA256
9177c875b5ca46448a6c081ef93afa1bcdc2bb7162acf77881b1e05e2458feda

SHA512
88b68073243f4533f962943cb4dcd71f55233e2fa4d79d0eacceb523f48d4c8193f57af8dcbf9a67b3e1684b81fa1a5242531fdf69494e183ce5947b3c5d4641

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
889B

MD5
2e4e4e01f30a1af914fdea7aa6bb6f63

SHA1
6e9cf6a23e6d69a7ed7579433896b97003a9a4e7

SHA256
27a5dc5ed0ac56039f24af5ca7ec516708f933e308dcb9666156b77be056484f

SHA512
066fbff97c422f6e7d283cd39979015b0902c845f5591776264e15cd9dd65803b823bb09f5dbcbb7c31f06ca2e6a96a8484d15035128dbaca5efb24ca40301d8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG

Filesize
338B

MD5
93543be47a2fbfc5865217a5dd23b303

SHA1
064fd4c2f48e5498caee707b270f1a3439caed9f

SHA256
d888232d507942c38bcf3008f023a5a80e6c178dd077fe5767fa6729db4c1b1a

SHA512
bc94de6512f43b4c699103095ba398f585b8e270abfa66c90a044e981b0e32cb4a52adcc3d8f6f0b2f96df22c7fd57d4a34c0588aacfc30ab3e323298e9ad16c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0

Filesize
44KB

MD5
2674d583317d2042b95e5c404607d121

SHA1
ff733109225381ad4b3b2e84b670081c00e70e9f

SHA256
7e672d5dfcd714a84934d7b7fea367f221ae7727810b8eede2e35f262e187db2

SHA512
2617a7c775e69d35de8afd32ae05a269f1ecd8b49524a121437bca1cd550ecda1f095f80f91393bc67f849c2329a46fe975f703406da572b75b7893f664ef2b9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1

Filesize
264KB

MD5
f408466590d216bbbd1317797f4e944e

SHA1
85874266730af7cc6e964b21f8caebb5f280b316

SHA256
3d21da770ce80ac38eb74806b0964f152df53a2dbe26f214bd59c4e23c6fae19

SHA512
4b87305a0f2000e4ad3ec079a73e177344118c0f9aac0cdedc0bd9451d56f15284e733735b0ccd6ba68be76d4ac6b96ee7932f278b14b02e115169129d36785c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3

Filesize
4.0MB

MD5
a83decf216fd7fbf94caf7cb5ce29086

SHA1
d9f9e75cde19aa9625201cf3c1dc816c02e70fc1

SHA256
66149ec74eaa73504ef80e652d2f0f6db135da270cf39f3a366777eb77ff9b23

SHA512
4afd9dcbf782566bbd05c314fd32c628cf4937dfc62dc6226131b0acb9b1b696704d143c1cff6a6f46394994c33208b8a1619aa52c7c42f9a546492a95c06acd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser

Filesize
106B

MD5
de9ef0c5bcc012a3a1131988dee272d8

SHA1
fa9ccbdc969ac9e1474fce773234b28d50951cd8

SHA256
3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590

SHA512
cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
14B

MD5
009b9a2ee7afbf6dd0b9617fc8f8ecba

SHA1
c97ed0652e731fc412e3b7bdfca2994b7cc206a7

SHA256
de607a2c68f52e15a104ead9ecbaa3e6862fdb11eac080e408ba4d69f1f7a915

SHA512
6161dd952ae140a8fb8aa5e33f06bc65fdc15ce3fbfe4c576dc2668c86bce4a1d5c1112caee014e5efa3698547faad3bc80ec253eedb43148e36e1a02ce89910

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
252KB

MD5
6c23d8126cf4009cc7f71b66ebce1dc8

SHA1
1985f7351bce9b8189d64186d8d77f6570933b59

SHA256
9e9bafcb90dca8a0dcd95ced12cff8dd7f57dd403fac5d00e748ef7be0a4d666

SHA512
2ea11902e802e293d9313ce1456a04259769598e4efbbfb053816d9286f8da99e41e3b3a9be5f6c465cca78831102309849177fc1566852ebcdb8564f5a901dc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
252KB

MD5
f03cd833a5cfb10c5a0fff106cbca859

SHA1
82e20cc416d512d3928f0ec9b088a4d65150027c

SHA256
3d14f12cb853185a7d257b10847c8b6adc5ccd93b8d4d0e14e874a0561144c7a

SHA512
2b7a34675dd667cd81611c3c9f96e4dbdd69236b8bd2a434d4fbaaebcdd0ca2fb3b7ed2658ca9996fae05dd18396675ae72d969000ad7ea57a509c1981c62dde

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
250KB

MD5
9b4a8bda54653f93155df7921a739ad6

SHA1
e754234a5d620637bdf1208907b4ded7b43dde9c

SHA256
8add7dd8f42f9a6915f26b77dccb2c9892d2f492692a27ce66ac64da9e48a4e2

SHA512
3a9ab49ebd3814b8d29966854e75e653c61ec2eb710e97b2e6bf4964b9268e2639594b1fb1ff10e1c994919cf70e6a92f15c02ce9171aa9efc0881ab0189347c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
250KB

MD5
daaeeb81ec75bf5e9ad70c08bb0f8e14

SHA1
78831a2fdcd7754d1e99f4bdb059c527ae41e6c4

SHA256
70a1959212591daa39bff610ed01deb85d4eaec3d965afbdd1adcc6e3feff644

SHA512
802804d9f1168f67a5f56ffcd2beedf4b553ee1b540d19a54cfa00063d563ebbd08f0c45b2d98784a54c4487e6ffb3864245bbbd3d0ea4de54cc4e2696a8aa1b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt

Filesize
4B

MD5
5fcb95589838ca2a7496f33fa1eb6efe

SHA1
a29463902a96852af5ab9ef3ae04e08e2c9ebb73

SHA256
9b192f04155690439464bdd52e092e5b618e0ce7a1c5f41a3f0a70c7e9a3d0b5

SHA512
242ae60fc20b95b619de27ac0a9071f947c7fb670a2c6f9c476ca06f2022385c86b639bc1b7ddf781584743576778abe6ad860ae6729f2369f803e622db8b094

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cb138796dbfb37877fcae3430bb1e2a7

SHA1
82bb82178c07530e42eca6caf3178d66527558bc

SHA256
50c55ba7baeebe1fa4573118edbca59010d659ea42761148618fb3af8a1c9bdd

SHA512
287471cccbe33e08015d6fc35e0bcdca0ec79bebc3a58f6a340b7747b5b2257b33651574bc83ed529aef2ba94be6e68968e59d2a8ef5f733dce9df6404ad7cc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9519bc058003dbea34765176083739e

SHA1
ef49b8790219eaddbdacb7fc97d3d05433b8575c

SHA256
e034683bc434a09f5d0293cb786e6a3943b902614f9211d42bed47759164d38b

SHA512
a1b67ccf313173c560ead25671c64de65e3e2599251926e33ce8399fde682fce5cb20f36ee330fcd8bb8f7a9c00ef432da56c9b02dfd7d3f02865f390c342b53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
178B

MD5
d74a79853049f96b1b05810fa1aed375

SHA1
07173054e7c87b381191cba8eb44bd3557fa20a3

SHA256
b47d1bc9be50544cf7bcd813ab153c8097c306dbae4d330b07ef487f45d14d18

SHA512
9a269cd44bf915568f4b56b77867cac34c4482e8098176f61bd1b64ef7bddc8ccb88528a98ee8ddabd51a8d797a5e289007ced7cecbeefd97e3ac6e8809d1f68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6076f234f196945bbf9c956d0f06317b

SHA1
9d568cbf1a820d3f95637c275ec8d7b01679f19c

SHA256
4dde0fa843d00f9d251e7584aff73a78a592bd134bd5c0c857fa511f85fe12fe

SHA512
35824bbf3dc3f6645ce06bbec762bae00d8f83b604a8fd84d455d2ed7c8d72af6f57ee1148a917d1a9ed585f4ce72b1807fd2cfa50825740ec347f479410b820

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2cecafd3d8a140cab453e6245d217302

SHA1
d273efa48585f870429a04b24c064bbd4900b9ee

SHA256
bdea843df56a489afbb870f43057f414326327f18ef67a000906fc216d5cdc52

SHA512
5ab76514b0d0102f3fc82af98bdc2c1bdff48b140fc4e9c8aecef5500862a71c89578e34d5097885f18dd9003f0ca5f7dcc0246f7dfae6b0089fe5d66ab232b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c22e116c-47f8-40eb-9971-88fc03fd151d.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e7cbeb1818d0d087178dfc5154a376b3

SHA1
c73177e54d1af2092e3ff7a240ee35fa8b5d9547

SHA256
f0b3c22432f7da274d5fc385f1cefa01b832889718f5dcfbe41685f565b793ee

SHA512
14203fc4d3900b96fa8563bf7aac7198d9c86e07a175e315b54c615976fe6e3e86989efc2d130d2f789571e3c2960bc8ebd62a9690e27b95e0600237d4b7eef9

Download Submit
C:\Users\Admin\AppData\Local\Temp\frAQBc8Wsa1xVPfv

Filesize
13KB

MD5
6d4159694e1754f262e326b52a3b305a

SHA1
d5fd9fe10405c4f90235e583526164cd0902ed86

SHA256
b9a4e40a5d80fedd1037eaed958f9f9efed41eb01ada73d51b5dcd86e27e0cbf

SHA512
480d1dac3f9eddd38c97845cc173e77d17aa5ae69f06654edef07de6dc3c336741b691744da0a1477b48de3f42320f6dbae54669692d6b590ad971a272c4d1ab

Download Submit
C:\Users\Admin\Downloads\Synapse_X.exe

Filesize
66KB

MD5
c95f88d500cf9217120d13d4224f08c3

SHA1
7045bdc88bcde61c8e99a6301a8d14ec5ffef762

SHA256
b0de0b5475625fc438fec088e2214260a19b5b853eab70e2e9bf27593cdc059d

SHA512
d8803dcc69895d86d24ea365bb5ddafb95dfbb38b43609b993c03dda68fc0a26c127c2d29ee1943f071d5b95fe997ceab41b21d29677cc962387486013b0b51c

Download Submit
memory/2604-174-0x00000000049B0000-0x00000000049C0000-memory.dmp

Filesize
64KB

Download
memory/2604-70-0x00000000049B0000-0x00000000049C0000-memory.dmp

Filesize
64KB

Download
memory/2604-71-0x0000000004AE0000-0x0000000004AEA000-memory.dmp

Filesize
40KB

Download
memory/2604-173-0x00000000049B0000-0x00000000049C0000-memory.dmp

Filesize
64KB

Download
memory/2604-69-0x0000000004A20000-0x0000000004AB2000-memory.dmp

Filesize
584KB

Download
memory/2604-172-0x0000000074BD0000-0x0000000075380000-memory.dmp

Filesize
7.7MB

Download
memory/2604-68-0x0000000004FD0000-0x0000000005574000-memory.dmp

Filesize
5.6MB

Download
memory/2604-67-0x0000000074BD0000-0x0000000075380000-memory.dmp

Filesize
7.7MB

Download
memory/2604-66-0x0000000000010000-0x0000000000028000-memory.dmp

Filesize
96KB

Download
memory/2604-180-0x0000000074BD0000-0x0000000075380000-memory.dmp

Filesize
7.7MB

Download
memory/2604-158-0x00000000049B0000-0x00000000049C0000-memory.dmp

Filesize
64KB

Download
memory/4452-375-0x0000000004A40000-0x0000000004A50000-memory.dmp

Filesize
64KB

Download
memory/4452-371-0x0000000004A40000-0x0000000004A50000-memory.dmp

Filesize
64KB

Download
memory/4452-372-0x0000000004A40000-0x0000000004A50000-memory.dmp

Filesize
64KB

Download
memory/4452-373-0x0000000074BD0000-0x0000000075380000-memory.dmp

Filesize
7.7MB

Download
memory/4452-374-0x0000000004A40000-0x0000000004A50000-memory.dmp

Filesize
64KB

Download
memory/4452-370-0x0000000074BD0000-0x0000000075380000-memory.dmp

Filesize
7.7MB

Download
memory/5016-168-0x0000028C693F0000-0x0000028C693F1000-memory.dmp

Filesize
4KB

Download
memory/5016-170-0x0000028C693F0000-0x0000028C693F1000-memory.dmp

Filesize
4KB

Download
memory/5016-171-0x0000028C693F0000-0x0000028C693F1000-memory.dmp

Filesize
4KB

Download
memory/5016-165-0x0000028C693F0000-0x0000028C693F1000-memory.dmp

Filesize
4KB

Download
memory/5016-166-0x0000028C693F0000-0x0000028C693F1000-memory.dmp

Filesize
4KB

Download
memory/5016-167-0x0000028C693F0000-0x0000028C693F1000-memory.dmp

Filesize
4KB

Download
memory/5016-159-0x0000028C693F0000-0x0000028C693F1000-memory.dmp

Filesize
4KB

Download
memory/5016-160-0x0000028C693F0000-0x0000028C693F1000-memory.dmp

Filesize
4KB

Download
memory/5016-169-0x0000028C693F0000-0x0000028C693F1000-memory.dmp

Filesize
4KB

Download
memory/5016-161-0x0000028C693F0000-0x0000028C693F1000-memory.dmp

Filesize
4KB

Download