Analysis Overview
Threat Level: Likely benign
The file http://github.com was found to be: Likely benign.
Malicious Activity Summary
Browser Information Discovery
Modifies registry class
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of SetWindowsHookEx
Enumerates system info in registry
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-08-03 15:23
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-08-03 15:23
Reported
2024-08-03 15:25
Platform
win10v2004-20240802-en
Max time kernel
112s
Max time network
95s
Command Line
Signatures
Browser Information Discovery
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ | C:\Windows\system32\notepad.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ | C:\Windows\system32\notepad.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 | C:\Windows\system32\notepad.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings | C:\Windows\system32\notepad.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots | C:\Windows\system32\notepad.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 | C:\Windows\system32\notepad.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff | C:\Windows\system32\notepad.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell | C:\Windows\system32\notepad.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" | C:\Windows\system32\notepad.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell | C:\Windows\system32\notepad.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" | C:\Windows\system32\notepad.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff | C:\Windows\system32\notepad.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} | C:\Windows\system32\notepad.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 | C:\Windows\system32\notepad.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags | C:\Windows\system32\notepad.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" | C:\Windows\system32\notepad.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff | C:\Windows\system32\notepad.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000 | C:\Windows\system32\notepad.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff | C:\Windows\system32\notepad.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" | C:\Windows\system32\notepad.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" | C:\Windows\system32\notepad.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 | C:\Windows\system32\notepad.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 | C:\Windows\system32\notepad.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 | C:\Windows\system32\notepad.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" | C:\Windows\system32\notepad.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" | C:\Windows\system32\notepad.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" | C:\Windows\system32\notepad.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" | C:\Windows\system32\notepad.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" | C:\Windows\system32\notepad.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU | C:\Windows\system32\notepad.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 | C:\Windows\system32\notepad.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg | C:\Windows\system32\notepad.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" | C:\Windows\system32\notepad.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\notepad.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://github.com
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe65f046f8,0x7ffe65f04708,0x7ffe65f04718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,16766396175789323112,10948370513731524056,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,16766396175789323112,10948370513731524056,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,16766396175789323112,10948370513731524056,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16766396175789323112,10948370513731524056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16766396175789323112,10948370513731524056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16766396175789323112,10948370513731524056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2136,16766396175789323112,10948370513731524056,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5076 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,16766396175789323112,10948370513731524056,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,16766396175789323112,10948370513731524056,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16766396175789323112,10948370513731524056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16766396175789323112,10948370513731524056,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16766396175789323112,10948370513731524056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16766396175789323112,10948370513731524056,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Documents\b.bat" "
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
cmd.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | github.com | udp |
| GB | 20.26.156.215:80 | github.com | tcp |
| GB | 20.26.156.215:80 | github.com | tcp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 8.8.8.8:53 | github.githubassets.com | udp |
| US | 8.8.8.8:53 | avatars.githubusercontent.com | udp |
| US | 185.199.111.154:443 | github.githubassets.com | tcp |
| US | 185.199.110.133:443 | avatars.githubusercontent.com | tcp |
| US | 185.199.111.154:443 | github.githubassets.com | tcp |
| US | 8.8.8.8:53 | user-images.githubusercontent.com | udp |
| US | 8.8.8.8:53 | github-cloud.s3.amazonaws.com | udp |
| US | 185.199.111.154:443 | github.githubassets.com | tcp |
| US | 185.199.111.154:443 | github.githubassets.com | tcp |
| US | 185.199.111.154:443 | github.githubassets.com | tcp |
| US | 185.199.111.154:443 | github.githubassets.com | tcp |
| US | 185.199.111.154:443 | github.githubassets.com | tcp |
| US | 8.8.8.8:53 | 215.156.26.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 64.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.111.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.110.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | collector.github.com | udp |
| US | 140.82.113.21:443 | collector.github.com | tcp |
| US | 8.8.8.8:53 | api.github.com | udp |
| GB | 20.26.156.210:443 | api.github.com | tcp |
| US | 8.8.8.8:53 | 21.113.82.140.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 210.156.26.20.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 39.58.20.217.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.236.111.52.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 983cbc1f706a155d63496ebc4d66515e |
| SHA1 | 223d0071718b80cad9239e58c5e8e64df6e2a2fe |
| SHA256 | cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c |
| SHA512 | d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd |
\??\pipe\LOCAL\crashpad_4896_CGYIZPLAIOUDJYZN
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 111c361619c017b5d09a13a56938bd54 |
| SHA1 | e02b363a8ceb95751623f25025a9299a2c931e07 |
| SHA256 | d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc |
| SHA512 | fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 2baad9613014e959dbc3068638ffbbda |
| SHA1 | 853f4697e584b4454a1c78ab0bfc8713e3df4e51 |
| SHA256 | 12334716a59739e0682fb2675293408b4ab8441d76b97f55975af3d81524ac1e |
| SHA512 | ed4b3db33d6e175678678cd585f8270a86313f14d42def1093cfc16fa4205a9a5d6606e5a9eb3d82de43ef41d973d651dd66f9d45e08fbef90f61b78e5dc4794 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | da1d1dea74c1dcedae9e4488c7aefeb6 |
| SHA1 | e1def87c78f598f405ab744d8c54999c77ad31ca |
| SHA256 | 0c98a09d97cdeca7b4af4cf0c8f84cdc336c43be53a7d2c54144c4e2c5dc01b2 |
| SHA512 | f1be65d331448982cdf982e631e0edede1b4fd2c4b8da39b15e2ce63a2e1cc3eae6ae8a83d711efb56b5fa0fcf513603fd1d62112cfabd49930435ffebefe891 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 2012753f0b0ea0c11ac6ee920221f112 |
| SHA1 | f02c352a490712a8b5eaa47f5c4b8b96ec14b2c0 |
| SHA256 | 78cd75c3e6e038da665092bb95b481242e3a5f0c7995711044294fad9a8219df |
| SHA512 | 7d8bfdb487a3b7f7d3329215c7cb14d2f332592dda46f29cdb0a146655e7aaa8032d5051b48386956ded5796e8e8fba25e72dac5bfd3c27c3c348ad30bd55fc3 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 807419ca9a4734feaf8d8563a003b048 |
| SHA1 | a723c7d60a65886ffa068711f1e900ccc85922a6 |
| SHA256 | aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631 |
| SHA512 | f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 06d15e834ea0b8429a347464336e60d6 |
| SHA1 | cd9b9d9b06483e22c3ba12dc6bdb2b9861baf303 |
| SHA256 | 4334b627c612f9788212c883a7b4efb82dff23a4faccc91ff0cb6ffd63f3cb48 |
| SHA512 | 9abe1bda35847a51e30af66636b8e9803b79c49c35af70b555a38267bd54d3a619c8d1940017c8ab2cbab60b95602b207241993f1ee5d0fd61a24969a86bd9da |
C:\Users\Admin\Documents\b.bat
| MD5 | b6a5a883c973e801a69c996567a5d16f |
| SHA1 | e1c7c3f8dd0a7b809ff6383dada6b251e1b28fe7 |
| SHA256 | 905c769da4ede7b11141ec8fec58ee83a4259dce2f0621f2eb1571f112212ed9 |
| SHA512 | 407dc5394ea982e171963815f028ff8b29b37c9366c06b9c36f3c3d50087cc91f16f2e115871046935e92579b56dc308ccb6aacb4ff27b6e3ddf259ddaebc167 |
memory/5144-209-0x00007FF7505F0000-0x00007FF750657000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 6e287ac179bf8bb706f1e0608a4687f9 |
| SHA1 | b04bac26aa1ae478cd1a6a4f9b0c88f812069bec |
| SHA256 | 71d1c04be2bafcfb05a979c598011c53aded92669381c7736324a35bb7d5dd49 |
| SHA512 | 037753fed9087ffd2fef9e293372935c2785b7c2a89c8dca01d672e2065a40c053cbdcfa6162f00e0e41b188ff98e8dc56669dba8a2a2250043b20c75e872523 |