Analysis
- max time kernel
68s - max time network
68s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
03/09/2024, 17:47
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/JohnWilliams8327/SynapseX-cracked/archive/refs/heads/main.zip
Resource
win10v2004-20240802-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target https://github.com/JohnWilliams8327/SynapseX-cracked/archive/refs/heads/main.zip
- Sample240903-wcy73stdja
Score
10/10
Malware Config
Signatures
- StormKitty
StormKitty is an open source info stealer written in C#.
- StormKitty payload 1 IoCs
resource yara_rule behavioral1/memory/1508-68-0x0000000000390000-0x000000000059A000-memory.dmp family_stormkitty - Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
flow ioc 40 discord.com 41 discord.com 44 discord.com 47 discord.com - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings msedge.exe - Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 1040 msedge.exe 1040 msedge.exe 3000 msedge.exe 3000 msedge.exe 1428 identity_helper.exe 1428 identity_helper.exe 4156 msedge.exe 4156 msedge.exe 1508 SynapseX.exe 1508 SynapseX.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1508 SynapseX.exe Token: SeDebugPrivilege 5780 taskmgr.exe Token: SeSystemProfilePrivilege 5780 taskmgr.exe Token: SeCreateGlobalPrivilege 5780 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe 5780 taskmgr.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3000 wrote to memory of 2344 3000 msedge.exe 83 PID 3000 wrote to memory of 2344 3000 msedge.exe 83 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 4024 3000 msedge.exe 84 PID 3000 wrote to memory of 1040 3000 msedge.exe 85 PID 3000 wrote to memory of 1040 3000 msedge.exe 85 PID 3000 wrote to memory of 4240 3000 msedge.exe 86 PID 3000 wrote to memory of 4240 3000 msedge.exe 86 PID 3000 wrote to memory of 4240 3000 msedge.exe 86 PID 3000 wrote to memory of 4240 3000 msedge.exe 86 PID 3000 wrote to memory of 4240 3000 msedge.exe 86 PID 3000 wrote to memory of 4240 3000 msedge.exe 86 PID 3000 wrote to memory of 4240 3000 msedge.exe 86 PID 3000 wrote to memory of 4240 3000 msedge.exe 86 PID 3000 wrote to memory of 4240 3000 msedge.exe 86 PID 3000 wrote to memory of 4240 3000 msedge.exe 86 PID 3000 wrote to memory of 4240 3000 msedge.exe 86 PID 3000 wrote to memory of 4240 3000 msedge.exe 86 PID 3000 wrote to memory of 4240 3000 msedge.exe 86 PID 3000 wrote to memory of 4240 3000 msedge.exe 86 PID 3000 wrote to memory of 4240 3000 msedge.exe 86 PID 3000 wrote to memory of 4240 3000 msedge.exe 86 PID 3000 wrote to memory of 4240 3000 msedge.exe 86 PID 3000 wrote to memory of 4240 3000 msedge.exe 86 PID 3000 wrote to memory of 4240 3000 msedge.exe 86 PID 3000 wrote to memory of 4240 3000 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/JohnWilliams8327/SynapseX-cracked/archive/refs/heads/main.zip1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1fdd46f8,0x7ffa1fdd4708,0x7ffa1fdd47182⤵PID:2344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,1145258103230376364,17291295492408665932,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:22⤵PID:4024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,1145258103230376364,17291295492408665932,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,1145258103230376364,17291295492408665932,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:82⤵PID:4240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1145258103230376364,17291295492408665932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:12⤵PID:2936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1145258103230376364,17291295492408665932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:12⤵PID:2660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1145258103230376364,17291295492408665932,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:82⤵PID:3124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1145258103230376364,17291295492408665932,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1145258103230376364,17291295492408665932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:12⤵PID:2308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1145258103230376364,17291295492408665932,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:12⤵PID:3776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2088,1145258103230376364,17291295492408665932,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3512 /prefetch:82⤵PID:2852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1145258103230376364,17291295492408665932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:12⤵PID:4108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,1145258103230376364,17291295492408665932,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3400 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1145258103230376364,17291295492408665932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:12⤵PID:3856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1145258103230376364,17291295492408665932,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:12⤵PID:4532
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4612
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4468
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3580
-
C:\Users\Admin\Downloads\SynapseX-cracked-main\SynapseX-cracked-main\SynapseX.exe"C:\Users\Admin\Downloads\SynapseX-cracked-main\SynapseX-cracked-main\SynapseX.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1508
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5780
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e
- MD5 d7114a6cd851f9bf56cf771c37d664a2
- SHA1 769c5d04fd83e583f15ab1ef659de8f883ecab8a
- SHA512 33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808
- MD5 719923124ee00fb57378e0ebcbe894f7
- SHA1 cc356a7d27b8b27dc33f21bd4990f286ee13a9f9
- SHA512 a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 ef8b2b65a3d405783699c7183bb626c3bc668c07faffdd4cb831a8e855f24539
- MD5 1a592ecd97f6c68b73672b27c696b114
- SHA1 0d9ff77ff12a342b8e8911bb94fd0ee16b6c5f06
- SHA512 a2a0afd3c2f71b64d17683506770049ce56f024d459b0e189130aa8637a1700950f6bdb423f3b522780438e15fae34809125c823f24813a10b327d4889ffc365
- SSDEEP 96:n2k/a61H8LSFhPwpvWMoiVmdeH/bF2UWQyV+VDCziEwb:n2k/VtVFhPGWMXx2ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 b269e48f99f1632197327bc3f2730932b5edb39e7509183e82b6e5cdeb5c0ef3
- MD5 b8957e469462126c90ca81a17f993c07
- SHA1 333bec685761694fdb42a8f25e51327ed51bf4ec
- SHA512 fa8d443e0c90050371e21bf4aa4e4ba5c0f0a45a26304ac3181630781f3f65d1ea05302feca7df3ef552305eb58ea7cb3527e29ebe2fd0dd7c9d15a878902e30
- SSDEEP 96:n2k8sQFE61H8LSFhPwpvWMoiVmdeH/bdi2UWQyV+VD7AiEwb:n2ksHtVFhPGWMX02rg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 62710eb157479a312666c41f6be51bff542c43cd78ddb57edddb9bf3bb43a973
- MD5 385eca57f2a0aae5bc15107c097be7ec
- SHA1 6f692a4d122e04c9123329eede67baa911883d37
- SHA512 505e838d18fa73cb23eca74bcf1201c060cd05a0b94e9d13fb23c9e2fec0c146107b33e1fed1a88ccc8f633231345bd24187a71da291156cf1b7a0e760097bb6
- SSDEEP 192:loCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupgnYpe2RUvxN5Rw5Ytj9Zk8:p9iIxuERzA83h09RZxYp9oSkLs6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Downloads\SynapseX-cracked-main.zip
- Size 2.0MB
- SHA256 7d1f27b4190525ca571328ad21c0adf62a07aafe3664bd9bc42b93fdbb212807
- MD5 2e90d7830b5d9fb47837dd8420f7d070
- SHA1 b835237ca65d0141c4595d3235e33aa7a5d0f2de
- SHA512 3ae9dd2de3fe06d28acd4c2fbe8622694a9c3b46a8675eaeeb664733b78b610db5cd471f1e86a8168c351d7912f28ebb68d295ec35d708014b8164c12404cbc9
- SSDEEP 49152:2iIsrix5/O3G5fjw7LM7h3glbESoEzTSKVhWRlbGH9Eal++:liZO3GVjmsheE7LuHn++
- MD5 SHA1 SHA512 SSDEEP