discordrat | hxxps://github[.]com/TheBloxflipPredictor/Synapse-X-Cracked/archive/refs/heads/main[.]zip

Analysis

max time kernel
110s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-09-2024 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/TheBloxflipPredictor/Synapse-X-Cracked/archive/refs/heads/main.zip

Score

10^/10

discordrat discovery persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTEyOTI2NjIyNzkxOTk5MDgyNA.GInBmi.k0vV9HhM26FUzP8r3lgj8t304PciR2dvNYNKDQ
server_id
1129494586109206538

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
4644	msedge.exe
4644	msedge.exe
1404	msedge.exe
1404	msedge.exe
3988	identity_helper.exe
3988	identity_helper.exe
3276	msedge.exe
3276	msedge.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2364	SynapseXCRACKED.exe
Token: SeDebugPrivilege	5532	taskmgr.exe
Token: SeSystemProfilePrivilege	5532	taskmgr.exe
Token: SeCreateGlobalPrivilege	5532	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe
5532	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 4288	1404	msedge.exe	84
PID 1404 wrote to memory of 4288	1404	msedge.exe	84
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 1356	1404	msedge.exe	85
PID 1404 wrote to memory of 4644	1404	msedge.exe	86
PID 1404 wrote to memory of 4644	1404	msedge.exe	86
PID 1404 wrote to memory of 540	1404	msedge.exe	87
PID 1404 wrote to memory of 540	1404	msedge.exe	87
PID 1404 wrote to memory of 540	1404	msedge.exe	87
PID 1404 wrote to memory of 540	1404	msedge.exe	87
PID 1404 wrote to memory of 540	1404	msedge.exe	87
PID 1404 wrote to memory of 540	1404	msedge.exe	87
PID 1404 wrote to memory of 540	1404	msedge.exe	87
PID 1404 wrote to memory of 540	1404	msedge.exe	87
PID 1404 wrote to memory of 540	1404	msedge.exe	87
PID 1404 wrote to memory of 540	1404	msedge.exe	87
PID 1404 wrote to memory of 540	1404	msedge.exe	87
PID 1404 wrote to memory of 540	1404	msedge.exe	87
PID 1404 wrote to memory of 540	1404	msedge.exe	87
PID 1404 wrote to memory of 540	1404	msedge.exe	87
PID 1404 wrote to memory of 540	1404	msedge.exe	87
PID 1404 wrote to memory of 540	1404	msedge.exe	87
PID 1404 wrote to memory of 540	1404	msedge.exe	87
PID 1404 wrote to memory of 540	1404	msedge.exe	87
PID 1404 wrote to memory of 540	1404	msedge.exe	87
PID 1404 wrote to memory of 540	1404	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/TheBloxflipPredictor/Synapse-X-Cracked/archive/refs/heads/main.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa33e46f8,0x7ffaa33e4708,0x7ffaa33e4718
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,17179954070376421410,8621126303387190369,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,17179954070376421410,8621126303387190369,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,17179954070376421410,8621126303387190369,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17179954070376421410,8621126303387190369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17179954070376421410,8621126303387190369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,17179954070376421410,8621126303387190369,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,17179954070376421410,8621126303387190369,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17179954070376421410,8621126303387190369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17179954070376421410,8621126303387190369,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2152,17179954070376421410,8621126303387190369,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17179954070376421410,8621126303387190369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,17179954070376421410,8621126303387190369,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17179954070376421410,8621126303387190369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17179954070376421410,8621126303387190369,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
  2⤵
  PID:4596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4220

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:216

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_Synapse-X-Cracked-main.zip\Synapse-X-Cracked-main\Synapse X CRACKED\Synapse X CRACKED\Read-For-Help.txt
1⤵
PID:5072

C:\Users\Admin\Downloads\Synapse-X-Cracked-main\Synapse-X-Cracked-main\Synapse X CRACKED\Synapse X CRACKED\SynapseXCRACKED.exe
"C:\Users\Admin\Downloads\Synapse-X-Cracked-main\Synapse-X-Cracked-main\Synapse X CRACKED\Synapse X CRACKED\SynapseXCRACKED.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2364

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Synapse-X-Cracked-main\Synapse-X-Cracked-main\Synapse X CRACKED\Synapse X CRACKED\executed-scripts\Log-scripts.txt
1⤵
PID:2912

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
255B

MD5
d11edf9e08a127c768843acea41d0bc5

SHA1
ff1af9b39de4a3f547407fd9864ffdd2bb6c7354

SHA256
217e4d9d1412e45abf7a653f72a5ab8b53bc8fc6f377f52a042668a41abc7478

SHA512
92c3f0def567b0e2f2523ed25eb9d4abff06070b8be744fea4a6678f25f292439d7bc0c8015eaa6281b7f43149eebb3d3821cd6d6436598481113694b11ddea3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e378b5435176ce4221b93fb8ae94ddbc

SHA1
e532c4f55afc36a92ac824fd2bf852c01fb08b58

SHA256
823edcddb4d94dd852b467b003bd1d3bbde1d47213f9b9ab37b523a5797fd25c

SHA512
9880395831ff9a7ed9d85fc1dbabc8c7be547de4b5b093f40fd3cef160cb0437c5a4bf225d49116fc82c3f47018c1819d410c342b14f9b8d03e8fe7d7c858b76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d3e7943c-e6ce-4a61-8c92-4ac02d6921d3.tmp

Filesize
6KB

MD5
62fe0957434001c8be50af0847cfad97

SHA1
c651ecb4e332e0235c474df7767712c2998026cc

SHA256
1bb8fea7a5be08edf17ff0faaea74181a0a255ec8bca474e82f07ef71c682db7

SHA512
256846036405fd6f2ab1a70261eeb8dcc24c9fc7ad321f70d08f6a5d0cceafe5da15f473e497248b630bb6c2942e218a6e13d4d4444482b5da24f3134d127611

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b9b35c8e2969cdbec4c2604b272d5638

SHA1
e47995ce10c27823ac1bd3a19439e47b6bc4c342

SHA256
71072e05a1be295ac2f2249a064ef967e080a899b5497d05b92755b318a79cb5

SHA512
634e457ce3ef24f8fba268656c3f8c53f89439a5c9dad5faa2e48a0319b7c0db8902ee582d9b72564c79fab20b7ab5fd960cfc36efecd5b91bb0675091be58b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9c4b9011025e117fea2332941744e1aa

SHA1
c346b27e27b10f9a12857c6a434bdb7930f9311d

SHA256
6a8205104ffee50f2ec419ca9f312bc8810b668aa0c179221e226e68f2470077

SHA512
ac2548a09bb844f2587a9ae1addf6b44e00993096d6cd16b25af1819dba2b9374336ebdc2dc47187b8e51609b98ac021b85da5dd1f8b695b373c11e8a8cb13c5

Download Submit
C:\Users\Admin\Downloads\Synapse-X-Cracked-main.zip

Filesize
29KB

MD5
2adb248e7929c293a0b3af27dea0d512

SHA1
0bd64b466b8b1889cc07f64628b9f0fc43572409

SHA256
c4465a48e8662e9e1d4e26389fbfde2edb58cdad2dabe711b8e744732703ea6c

SHA512
ef66e4b08f8161bc0928e67df667f0e5e4e38ca1a69b222fcfab21d3dbd5611277518b0142f4d0715a29f9282b9e56c6de2f5c6cd8c8b3d54369999515391bb7

Download Submit
memory/2364-89-0x000001EAF7F20000-0x000001EAF80E2000-memory.dmp

Filesize
1.8MB

Download
memory/2364-90-0x000001EAF8720000-0x000001EAF8C48000-memory.dmp

Filesize
5.2MB

Download
memory/2364-88-0x000001EAF5880000-0x000001EAF5898000-memory.dmp

Filesize
96KB

Download
memory/5532-129-0x000002994B5C0000-0x000002994B5C1000-memory.dmp

Filesize
4KB

Download
memory/5532-130-0x000002994B5C0000-0x000002994B5C1000-memory.dmp

Filesize
4KB

Download
memory/5532-131-0x000002994B5C0000-0x000002994B5C1000-memory.dmp

Filesize
4KB

Download
memory/5532-135-0x000002994B5C0000-0x000002994B5C1000-memory.dmp

Filesize
4KB

Download
memory/5532-141-0x000002994B5C0000-0x000002994B5C1000-memory.dmp

Filesize
4KB

Download
memory/5532-140-0x000002994B5C0000-0x000002994B5C1000-memory.dmp

Filesize
4KB

Download
memory/5532-139-0x000002994B5C0000-0x000002994B5C1000-memory.dmp

Filesize
4KB

Download
memory/5532-138-0x000002994B5C0000-0x000002994B5C1000-memory.dmp

Filesize
4KB

Download
memory/5532-137-0x000002994B5C0000-0x000002994B5C1000-memory.dmp

Filesize
4KB

Download
memory/5532-136-0x000002994B5C0000-0x000002994B5C1000-memory.dmp

Filesize
4KB

Download