quasar | hxxps://github[.]com/cfedss/Synapse-X-Revamped/releases/download/SynapseXRevamp1[.]2/SynapseX[.]revamaped[.]V1[.]2[.]rar

Analysis

max time kernel
1796s
max time network
1800s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
16-05-2024 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/cfedss/Synapse-X-Revamped/releases/download/SynapseXRevamp1.2/SynapseX.revamaped.V1.2.rar

Score

10^/10

quasar windows update spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Windows Update

skbidiooiilet-31205.portmap.host:31205

Mutex

7357b58d-e5d4-42be-8b74-db6eee6cde6d

Attributes

encryption_key
6F721445F7E0B1CF58980D84A9D49F4458D4EFD9
install_name
Update.exe
log_directory
Logs
reconnect_delay
3000
startup_key
WindowsUpdate
subdirectory
Windows Update

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\SynapseX.revamaped.V1.2\SynapseX revamaped V1.2\Synapse X Launcher.exe	family_quasar
behavioral1/memory/2136-304-0x0000000000350000-0x0000000000674000-memory.dmp	family_quasar

Executes dropped EXE 2 IoCs

Processes:

Synapse X Launcher.exeUpdate.exe

pid process

2136 Synapse X Launcher.exe
2052 Update.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

3760 schtasks.exe
2256 schtasks.exe

pid	process
2136	Synapse X Launcher.exe
2052	Update.exe

pid	process
3760	schtasks.exe
2256	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

OpenWith.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings OpenWith.exe
NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\SynapseX.revamaped.V1.2.rar:Zone.Identifier msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings	OpenWith.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\SynapseX.revamaped.V1.2.rar:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
1380	msedge.exe
1380	msedge.exe
2432	msedge.exe
2432	msedge.exe
4264	identity_helper.exe
4264	identity_helper.exe
3552	msedge.exe
3552	msedge.exe
852	msedge.exe
852	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

2432 msedge.exe
2432 msedge.exe
2432 msedge.exe
2432 msedge.exe
2432 msedge.exe
2432 msedge.exe
2432 msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

7zG.exeSynapse X Launcher.exeUpdate.exe

description	pid	process
Token: SeRestorePrivilege	2164	7zG.exe
Token: 35	2164	7zG.exe
Token: SeSecurityPrivilege	2164	7zG.exe
Token: SeSecurityPrivilege	2164	7zG.exe
Token: SeDebugPrivilege	2136	Synapse X Launcher.exe
Token: SeDebugPrivilege	2052	Update.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	process
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

OpenWith.exe

pid process

1084 OpenWith.exe
1084 OpenWith.exe
1084 OpenWith.exe

pid	process
1084	OpenWith.exe
1084	OpenWith.exe
1084	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2432 wrote to memory of 1448	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 1448	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 4224	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 1380	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 1380	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 2376	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 2376	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 2376	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 2376	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 2376	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 2376	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 2376	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 2376	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 2376	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 2376	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 2376	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 2376	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 2376	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 2376	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 2376	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 2376	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 2376	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 2376	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 2376	2432	msedge.exe	msedge.exe
PID 2432 wrote to memory of 2376	2432	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/cfedss/Synapse-X-Revamped/releases/download/SynapseXRevamp1.2/SynapseX.revamaped.V1.2.rar
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff80ea33cb8,0x7ff80ea33cc8,0x7ff80ea33cd8
2⤵
PID:1448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,9494201040727012305,13887819583505177992,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
2⤵
PID:4224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,9494201040727012305,13887819583505177992,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,9494201040727012305,13887819583505177992,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
2⤵
PID:2376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,9494201040727012305,13887819583505177992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
2⤵
PID:3140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,9494201040727012305,13887819583505177992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
2⤵
PID:4916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,9494201040727012305,13887819583505177992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
2⤵
PID:1856

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,9494201040727012305,13887819583505177992,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5936 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,9494201040727012305,13887819583505177992,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5928 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,9494201040727012305,13887819583505177992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
2⤵
PID:1168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,9494201040727012305,13887819583505177992,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
2⤵
PID:1924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,9494201040727012305,13887819583505177992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
2⤵
PID:784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,9494201040727012305,13887819583505177992,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
2⤵
PID:2028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,9494201040727012305,13887819583505177992,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3068 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1216

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4652

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1084

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\SynapseX.revamaped.V1.2\" -an -ai#7zMap27983:156:7zEvent18791
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2164

C:\Users\Admin\Downloads\SynapseX.revamaped.V1.2\SynapseX revamaped V1.2\Synapse X Launcher.exe
"C:\Users\Admin\Downloads\SynapseX.revamaped.V1.2\SynapseX revamaped V1.2\Synapse X Launcher.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2136

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "WindowsUpdate" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows Update\Update.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:3760

C:\Users\Admin\AppData\Roaming\Windows Update\Update.exe
"C:\Users\Admin\AppData\Roaming\Windows Update\Update.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2052

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "WindowsUpdate" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows Update\Update.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e4bf11ed97b6b312e938ca216cf30e

SHA1
ff6b0b475e552dc08a2c81c9eb9230821d3c8290

SHA256
296db8c9361efb62e23be1935fd172cfe9fbcd89a424f34f347ec3cc5ca5afad

SHA512
ce1a05df2619af419ed3058dcbd7254c7159d333356d9f1d5e2591c19e17ab0ac9b6d3e625e36246ad187256bee75b7011370220ef127c4f1171879014d0dd76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
23da8c216a7633c78c347cc80603cd99

SHA1
a378873c9d3484e0c57c1cb6c6895f34fee0ea61

SHA256
03dbdb03799f9e37c38f6d9d498ad09f7f0f9901430ff69d95aa26cae87504d3

SHA512
d34ae684e8462e3f2aba2260f2649dee01b4e2138b50283513c8c19c47faf039701854e1a9cbf21d7a20c28a6306f953b58ffb9144ead067f5f73650a759ff17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
265B

MD5
f5cd008cf465804d0e6f39a8d81f9a2d

SHA1
6b2907356472ed4a719e5675cc08969f30adc855

SHA256
fcea95cc39dc6c2a925f5aed739dbedaa405ee4ce127f535fcf1c751b2b8fb5d

SHA512
dc97034546a4c94bdaa6f644b5cfd1e477209de9a03a5b02a360c254a406c1d647d6f90860f385e27387b35631c41f0886cb543ede9116436941b9af6cd3285d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0655fc4bf1b08fea026e4d13b8792e3a

SHA1
381c5d4e94fac66f89de43b48040b57d38f15704

SHA256
4faef1298ef3de4bbc2200a9db612ce04516fd5e7aa3b76dc595433d8ae3c49c

SHA512
80b755d0d3d498514d60ccd121637a95b84908b507f9f6427a38b3e2dc3d053f795b939b5b80605bc0280b9145e4a5523d61a54f15108d1ce19e33a474a27487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
da03aaeabefd080555e0d02d88c0260b

SHA1
9684eb9654b453e34d5697c10c40aa3bbe8b1174

SHA256
c2789cf8b72f545d5eb9f9ab4af7faabec5c9287eea585e2294bb2399f16fd68

SHA512
56325546fbb9f555bff40ed8ada63a0665631fc619ebd2e88027203a8f64649802fb2e64635792cab125cb0cc15845f883405cfbfe2d90afdef9b42952ef21b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7e71992d33a25078ab144a0c4ca1775d

SHA1
230a52030fe0987ffcb5b86c0538293159d52475

SHA256
c674a2c72e7dd8730487c32672f625cc90c57e560bb5f03742d325f5c341b5c8

SHA512
18ea41770e51920a50e451f28790254b28fd34932a8aaf48422b31778fe8ad990a595eaf2fc578c06ab5f26ec4cb39fdc632eed4353f7bcf033d9ebd86841786

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
58d6867518483d990457612768a67d24

SHA1
b76c444d3b1bd5bba6751d1002a323d9f2a58f97

SHA256
403aa81b501f0d4f25e0733680cf2caa582acc813440232aa60a92af18df07cc

SHA512
8c65c34945a8ee83b77c7c1078ec60380f2a5dda2e4ee26136cd047c58d34dbefb6c5d77928fe447e1640e7a8ab7e45f018a5df68a40e95093e7bfe2157a54dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3b33a7c0378009df08a018c96daa3cce

SHA1
efd9193c63a78e3c6a71990a143ef0a27db73464

SHA256
a12e3976dca1a7214fd49ca2ea02e8389baef8fcd4f547b7232c5a042a2bcc7a

SHA512
a8dd6addeff4c5f2312cad78c5b84950fa796309a269fe2c6c8266c17468d4ad1b528c5eaa8482aa678c065c9dda9a2149a963ee3adcd5703042d2a0c6f7a747

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
b24197df31b1170aa5bd4704f607a526

SHA1
343f52675898a434be0f8451dbb0030de45f7c6e

SHA256
1d77208bf1c6158f59ed2996a491e9ce2c5cd250adff725346dbb6f5bded9486

SHA512
ef729eb207dfbabfc8174a6d03fb8d61827d90a44cd640d783a45cbd21e73452292499f5b1c97df2942276b3b99351215410f713f0e6b88c467183bcd2f32598

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
6275e3ac5d421adb19c8377c58bd4948

SHA1
1c1e38d3015e5df261f389d51758ec3785e7996e

SHA256
a19412ca85ba1dada9212eb3f419fff154565306c46b88e48b0d55ecf6b99476

SHA512
07160d6160ecdac0b6a3fcd1ccad368a8c07b942c7e17fd08b7cc27cca5d12a412b17c7b0778e0eeed12f07909533af87c121cd546d362d11867ab330e1efdd7

Download Submit
C:\Users\Admin\Downloads\SynapseX.revamaped.V1.2.rar:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\SynapseX.revamaped.V1.2\SynapseX revamaped V1.2\Synapse X Launcher.exe

Filesize
3.1MB

MD5
1a1fda92143e414b4d4153ab05dd1ce8

SHA1
33ac2b2d228a1ec93b0ea70ffadb436933b9a1e5

SHA256
f0160a1f7a39862e14063ac468957559656405f51d97ad56dc7cff9ad34da9f1

SHA512
70a9a6948f98f3bdc2c7b461634098347bdf683dec36fa92bd1ac652f72daf7fa01f842cbb8331f26c9c5f76907604f75f7c45b746bcfe8f395b3864f998f391

Download Submit
\??\pipe\LOCAL\crashpad_2432_KUUYCQZTDWRYZMCV

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2052-311-0x0000000002700000-0x0000000002750000-memory.dmp

Filesize
320KB

Download
memory/2052-312-0x000000001B950000-0x000000001BA02000-memory.dmp

Filesize
712KB

Download
memory/2136-304-0x0000000000350000-0x0000000000674000-memory.dmp

Filesize
3.1MB

Download