0b8fe4bbd5f8abbd4a21e70e9d6cca9aecba7d8833cc2385d95538709789eefd

Analysis

max time kernel
1801s
max time network
1723s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
31/08/2024, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GitHubDesktopSetup-x64.exe
Size 159.7MB
Sample240831-ajdn3athqd
SHA256 0b8fe4bbd5f8abbd4a21e70e9d6cca9aecba7d8833cc2385d95538709789eefd
MD5 fe89096a5931a7fb9af6da752a2adde6
SHA1 37afa4a1019157c931395074e575868eeb0b9140
SHA512 edae85e73e8160503f3c118402f7afb7d59b0abe5c484fed2ae9498c7e0c7b262ac389b038cd02822ef7c3a5ad1c84690963a69995f086909a9e780adc97db1c
SSDEEP 3145728:kqZrr8lXnOTp8kH0Gk23xeWn54sRZmhBbuhu3SVZkvRUcm8Q+f:kA23a8kHM8I05h+3xCkqD8Z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

google discovery motw phishing

Malware Config

Signatures

Detected google phishing page
phishing google

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	GitHubDesktop.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	GitHubDesktop.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	GitHubDesktop.exe

Executes dropped EXE 28 IoCs

pid	Process
2440	Update.exe
4828	Squirrel.exe
4316	GitHubDesktop.exe
2564	Update.exe
2244	GitHubDesktop.exe
8	GitHubDesktop.exe
3300	GitHubDesktop.exe
3224	GitHubDesktop.exe
3636	GitHubDesktop.exe
3656	GitHubDesktop.exe
2056	Update.exe
2108	git.exe
3248	git.exe
3256	git.exe
4276	git.exe
2844	git-lfs.exe
2388	git.exe
8	git.exe
3544	git.exe
2164	git.exe
3212	git.exe
848	git.exe
396	git.exe
2616	git.exe
4196	git.exe
1980	git.exe
1108	git.exe
5600	GitHubDesktop.exe

Loads dropped DLL 64 IoCs

pid	Process
4316	GitHubDesktop.exe
4316	GitHubDesktop.exe
4316	GitHubDesktop.exe
2244	GitHubDesktop.exe
8	GitHubDesktop.exe
2244	GitHubDesktop.exe
2244	GitHubDesktop.exe
2244	GitHubDesktop.exe
2244	GitHubDesktop.exe
3300	GitHubDesktop.exe
3300	GitHubDesktop.exe
3300	GitHubDesktop.exe
3224	GitHubDesktop.exe
3636	GitHubDesktop.exe
3224	GitHubDesktop.exe
3224	GitHubDesktop.exe
3224	GitHubDesktop.exe
3224	GitHubDesktop.exe
3656	GitHubDesktop.exe
3656	GitHubDesktop.exe
3656	GitHubDesktop.exe
3656	GitHubDesktop.exe
3656	GitHubDesktop.exe
3248	git.exe
3248	git.exe
3248	git.exe
3248	git.exe
3248	git.exe
4276	git.exe
4276	git.exe
4276	git.exe
4276	git.exe
4276	git.exe
2388	git.exe
2388	git.exe
2388	git.exe
2388	git.exe
2388	git.exe
8	git.exe
8	git.exe
8	git.exe
8	git.exe
8	git.exe
8	git.exe
3544	git.exe
3544	git.exe
3544	git.exe
3544	git.exe
3544	git.exe
2164	git.exe
2164	git.exe
2164	git.exe
2164	git.exe
2164	git.exe
3212	git.exe
3212	git.exe
3212	git.exe
3212	git.exe
3212	git.exe
848	git.exe
848	git.exe
848	git.exe
848	git.exe
848	git.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
97	whatismyipaddress.com
98	whatismyipaddress.com
99	whatismyipaddress.com

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc
559	https://storage.googleapis.com/script.aniview.com/ssync/62f53b2c7850d0786f227f64/ssync.html

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GitHubDesktopSetup-x64.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\github-windows\shell	GitHubDesktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\github-windows\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\GitHubDesktop\\app-3.4.3\\GitHubDesktop.exe\" \"--protocol-launcher\" \"%1\""	GitHubDesktop.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\x-github-desktop-auth\shell\open	GitHubDesktop.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\github-windows	GitHubDesktop.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\x-github-client\shell\open\command	GitHubDesktop.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\x-github-client\shell	GitHubDesktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\x-github-desktop-auth\URL Protocol	GitHubDesktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\x-github-desktop-auth\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\GitHubDesktop\\app-3.4.3\\GitHubDesktop.exe\" \"--protocol-launcher\" \"%1\""	GitHubDesktop.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\github-windows\shell\open\command	GitHubDesktop.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\x-github-client	GitHubDesktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\x-github-client\ = "URL:x-github-client"	GitHubDesktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\github-windows\ = "URL:github-windows"	GitHubDesktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\x-github-client\URL Protocol	GitHubDesktop.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\x-github-client\shell\open	GitHubDesktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\x-github-desktop-auth\ = "URL:x-github-desktop-auth"	GitHubDesktop.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\x-github-desktop-auth\shell\open\command	GitHubDesktop.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\x-github-desktop-auth\shell	GitHubDesktop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\github-windows\URL Protocol	GitHubDesktop.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\github-windows\shell\open	GitHubDesktop.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-786284298-625481688-3210388970-1000\{6AC582FD-A441-4116-8549-2DCA2F83D9B8}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\x-github-client\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\GitHubDesktop\\app-3.4.3\\GitHubDesktop.exe\" \"--protocol-launcher\" \"%1\""	GitHubDesktop.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\x-github-desktop-auth	GitHubDesktop.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2440	Update.exe
2440	Update.exe
3656	GitHubDesktop.exe
3656	GitHubDesktop.exe
3656	GitHubDesktop.exe
3656	GitHubDesktop.exe
2844	git-lfs.exe
2844	git-lfs.exe
2844	git-lfs.exe
2844	git-lfs.exe
4856	msedge.exe
4856	msedge.exe
3212	msedge.exe
3212	msedge.exe
6052	msedge.exe
6052	msedge.exe
6468	identity_helper.exe
6468	identity_helper.exe
5600	GitHubDesktop.exe
5600	GitHubDesktop.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 50 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4316	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	4316	GitHubDesktop.exe
Token: SeDebugPrivilege	2440	Update.exe
Token: SeShutdownPrivilege	3300	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3300	GitHubDesktop.exe
Token: SeShutdownPrivilege	3300	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3300	GitHubDesktop.exe
Token: SeDebugPrivilege	2056	Update.exe
Token: SeShutdownPrivilege	3300	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3300	GitHubDesktop.exe
Token: SeShutdownPrivilege	3300	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3300	GitHubDesktop.exe
Token: SeShutdownPrivilege	3300	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3300	GitHubDesktop.exe
Token: SeShutdownPrivilege	3300	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3300	GitHubDesktop.exe
Token: SeShutdownPrivilege	3300	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3300	GitHubDesktop.exe
Token: SeShutdownPrivilege	3300	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3300	GitHubDesktop.exe
Token: SeShutdownPrivilege	3300	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3300	GitHubDesktop.exe
Token: SeShutdownPrivilege	3300	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3300	GitHubDesktop.exe
Token: SeShutdownPrivilege	3300	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3300	GitHubDesktop.exe
Token: SeShutdownPrivilege	3300	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3300	GitHubDesktop.exe
Token: SeShutdownPrivilege	3300	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3300	GitHubDesktop.exe
Token: SeShutdownPrivilege	3300	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3300	GitHubDesktop.exe
Token: SeShutdownPrivilege	3300	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3300	GitHubDesktop.exe
Token: SeShutdownPrivilege	3300	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3300	GitHubDesktop.exe
Token: SeShutdownPrivilege	3300	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3300	GitHubDesktop.exe
Token: SeShutdownPrivilege	3300	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3300	GitHubDesktop.exe
Token: SeShutdownPrivilege	3300	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3300	GitHubDesktop.exe
Token: SeShutdownPrivilege	3300	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3300	GitHubDesktop.exe
Token: SeShutdownPrivilege	3300	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3300	GitHubDesktop.exe
Token: SeShutdownPrivilege	3300	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3300	GitHubDesktop.exe
Token: SeShutdownPrivilege	3300	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3300	GitHubDesktop.exe
Token: SeShutdownPrivilege	3300	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3300	GitHubDesktop.exe
Token: SeShutdownPrivilege	3300	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3300	GitHubDesktop.exe
Token: SeShutdownPrivilege	3300	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3300	GitHubDesktop.exe
Token: SeShutdownPrivilege	3300	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3300	GitHubDesktop.exe
Token: SeShutdownPrivilege	3300	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3300	GitHubDesktop.exe
Token: SeShutdownPrivilege	3300	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3300	GitHubDesktop.exe
Token: SeShutdownPrivilege	3300	GitHubDesktop.exe
Token: SeCreatePagefilePrivilege	3300	GitHubDesktop.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
2440	Update.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 2440	4080	GitHubDesktopSetup-x64.exe	87
PID 4080 wrote to memory of 2440	4080	GitHubDesktopSetup-x64.exe	87
PID 2440 wrote to memory of 4828	2440	Update.exe	93
PID 2440 wrote to memory of 4828	2440	Update.exe	93
PID 2440 wrote to memory of 4316	2440	Update.exe	94
PID 2440 wrote to memory of 4316	2440	Update.exe	94
PID 4316 wrote to memory of 2564	4316	GitHubDesktop.exe	96
PID 4316 wrote to memory of 2564	4316	GitHubDesktop.exe	96
PID 4316 wrote to memory of 2244	4316	GitHubDesktop.exe	98
PID 4316 wrote to memory of 2244	4316	GitHubDesktop.exe	98
PID 4316 wrote to memory of 2244	4316	GitHubDesktop.exe	98
PID 4316 wrote to memory of 2244	4316	GitHubDesktop.exe	98
PID 4316 wrote to memory of 2244	4316	GitHubDesktop.exe	98
PID 4316 wrote to memory of 2244	4316	GitHubDesktop.exe	98
PID 4316 wrote to memory of 2244	4316	GitHubDesktop.exe	98
PID 4316 wrote to memory of 2244	4316	GitHubDesktop.exe	98
PID 4316 wrote to memory of 2244	4316	GitHubDesktop.exe	98
PID 4316 wrote to memory of 2244	4316	GitHubDesktop.exe	98
PID 4316 wrote to memory of 2244	4316	GitHubDesktop.exe	98
PID 4316 wrote to memory of 2244	4316	GitHubDesktop.exe	98
PID 4316 wrote to memory of 2244	4316	GitHubDesktop.exe	98
PID 4316 wrote to memory of 2244	4316	GitHubDesktop.exe	98
PID 4316 wrote to memory of 2244	4316	GitHubDesktop.exe	98
PID 4316 wrote to memory of 2244	4316	GitHubDesktop.exe	98
PID 4316 wrote to memory of 2244	4316	GitHubDesktop.exe	98
PID 4316 wrote to memory of 2244	4316	GitHubDesktop.exe	98
PID 4316 wrote to memory of 2244	4316	GitHubDesktop.exe	98
PID 4316 wrote to memory of 2244	4316	GitHubDesktop.exe	98
PID 4316 wrote to memory of 2244	4316	GitHubDesktop.exe	98
PID 4316 wrote to memory of 2244	4316	GitHubDesktop.exe	98
PID 4316 wrote to memory of 2244	4316	GitHubDesktop.exe	98
PID 4316 wrote to memory of 2244	4316	GitHubDesktop.exe	98
PID 4316 wrote to memory of 2244	4316	GitHubDesktop.exe	98
PID 4316 wrote to memory of 2244	4316	GitHubDesktop.exe	98
PID 4316 wrote to memory of 2244	4316	GitHubDesktop.exe	98
PID 4316 wrote to memory of 2244	4316	GitHubDesktop.exe	98
PID 4316 wrote to memory of 2244	4316	GitHubDesktop.exe	98
PID 4316 wrote to memory of 2244	4316	GitHubDesktop.exe	98
PID 4316 wrote to memory of 8	4316	GitHubDesktop.exe	99
PID 4316 wrote to memory of 8	4316	GitHubDesktop.exe	99
PID 2440 wrote to memory of 3300	2440	Update.exe	101
PID 2440 wrote to memory of 3300	2440	Update.exe	101
PID 3300 wrote to memory of 3224	3300	GitHubDesktop.exe	102
PID 3300 wrote to memory of 3224	3300	GitHubDesktop.exe	102
PID 3300 wrote to memory of 3224	3300	GitHubDesktop.exe	102
PID 3300 wrote to memory of 3224	3300	GitHubDesktop.exe	102
PID 3300 wrote to memory of 3224	3300	GitHubDesktop.exe	102
PID 3300 wrote to memory of 3224	3300	GitHubDesktop.exe	102
PID 3300 wrote to memory of 3224	3300	GitHubDesktop.exe	102
PID 3300 wrote to memory of 3224	3300	GitHubDesktop.exe	102
PID 3300 wrote to memory of 3224	3300	GitHubDesktop.exe	102
PID 3300 wrote to memory of 3224	3300	GitHubDesktop.exe	102
PID 3300 wrote to memory of 3224	3300	GitHubDesktop.exe	102
PID 3300 wrote to memory of 3224	3300	GitHubDesktop.exe	102
PID 3300 wrote to memory of 3224	3300	GitHubDesktop.exe	102
PID 3300 wrote to memory of 3224	3300	GitHubDesktop.exe	102
PID 3300 wrote to memory of 3224	3300	GitHubDesktop.exe	102
PID 3300 wrote to memory of 3224	3300	GitHubDesktop.exe	102
PID 3300 wrote to memory of 3224	3300	GitHubDesktop.exe	102
PID 3300 wrote to memory of 3224	3300	GitHubDesktop.exe	102
PID 3300 wrote to memory of 3224	3300	GitHubDesktop.exe	102
PID 3300 wrote to memory of 3224	3300	GitHubDesktop.exe	102
PID 3300 wrote to memory of 3224	3300	GitHubDesktop.exe	102
PID 3300 wrote to memory of 3224	3300	GitHubDesktop.exe	102

C:\Users\Admin\AppData\Local\Temp\GitHubDesktopSetup-x64.exe
"C:\Users\Admin\AppData\Local\Temp\GitHubDesktopSetup-x64.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\Squirrel.exe
    "C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
    3⤵
    - Executes dropped EXE
    PID:4828
- - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\GitHubDesktop.exe
    "C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\GitHubDesktop.exe" --squirrel-install 3.4.3
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4316
  - - C:\Users\Admin\AppData\Local\GitHubDesktop\Update.exe
      C:\Users\Admin\AppData\Local\GitHubDesktop\Update.exe --createShortcut GitHubDesktop.exe -l StartMenu,Desktop
      4⤵
      Executes dropped EXE
      PID:2564
  - - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\GitHubDesktop.exe
      "C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\GitHubDesktop.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\GitHub Desktop" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1904,i,3172860138920571234,9899918645376551419,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2244
  - - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\GitHubDesktop.exe
      "C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\GitHubDesktop.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\GitHub Desktop" --field-trial-handle=2084,i,3172860138920571234,9899918645376551419,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:8
- - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\GitHubDesktop.exe
    "C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\GitHubDesktop.exe" --squirrel-firstrun
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3300
  - - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\GitHubDesktop.exe
      "C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\GitHubDesktop.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\GitHub Desktop" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2060,i,17036835921293916023,18430220890610200835,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3224
  - - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\GitHubDesktop.exe
      "C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\GitHubDesktop.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\GitHub Desktop" --field-trial-handle=2480,i,17036835921293916023,18430220890610200835,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3636
  - - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\GitHubDesktop.exe
      "C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\GitHubDesktop.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\GitHub Desktop" --app-user-model-id=com.squirrel.GitHubDesktop.GitHubDesktop --app-path="C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app" --no-sandbox --no-zygote --disable-blink-features=Auxclick --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2648,i,17036835921293916023,18430220890610200835,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:3656
    - - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe
        
        C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe --version
        5⤵
        Executes dropped EXE
        
        PID:2108
      - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exe
        
        git.exe --version
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3248
    - - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe
        
        C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\cmd\git.exe lfs install --skip-repo
        5⤵
        Executes dropped EXE
        
        PID:3256
      - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exe
        
        git.exe lfs install --skip-repo
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\libexec\git-core\git-lfs.exe
        
        git-lfs install --skip-repo
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exe
        
        git version
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exe
        
        git -c filter.lfs.smudge= -c filter.lfs.clean= -c filter.lfs.process= -c filter.lfs.required=false rev-parse --git-dir
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:8
        
        C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exe
        
        git -c filter.lfs.smudge= -c filter.lfs.clean= -c filter.lfs.process= -c filter.lfs.required=false remote
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exe
        
        git config --includes --global filter.lfs.clean
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exe
        
        git config --includes --global --replace-all filter.lfs.clean "git-lfs clean -- %f"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exe
        
        git config --includes --global filter.lfs.smudge
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:848
        
        C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exe
        
        git config --includes --global --replace-all filter.lfs.smudge "git-lfs smudge -- %f"
        8⤵
        Executes dropped EXE
        
        PID:396
        
        C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exe
        
        git config --includes --global filter.lfs.process
        8⤵
        Executes dropped EXE
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exe
        
        git config --includes --global --replace-all filter.lfs.process "git-lfs filter-process"
        8⤵
        Executes dropped EXE
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exe
        
        git config --includes --global filter.lfs.required
        8⤵
        Executes dropped EXE
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exe
        
        git config --includes --global --replace-all filter.lfs.required true
        8⤵
        Executes dropped EXE
        
        PID:1108
  - - C:\Users\Admin\AppData\Local\GitHubDesktop\Update.exe
      C:\Users\Admin\AppData\Local\GitHubDesktop\Update.exe --checkForUpdate https://central.github.com/api/deployments/desktop/desktop/latest?version=3.4.3&env=production&guid=9d069e2c-bc05-4e00-a956-4682f623a1e2
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2056
  - - C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\GitHubDesktop.exe
      "C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\GitHubDesktop.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\GitHub Desktop" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1544,i,17036835921293916023,18430220890610200835,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1560 /prefetch:8
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:5600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffdbcb646f8,0x7ffdbcb64708,0x7ffdbcb64718
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4480 /prefetch:1
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3776 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6836 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6688 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6976 /prefetch:1
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7220 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:6360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7996 /prefetch:1
  2⤵
  PID:6460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:6560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8220 /prefetch:1
  2⤵
  PID:6568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8296 /prefetch:1
  2⤵
  PID:6764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8696 /prefetch:8
  2⤵
  PID:6264
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8696 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:6848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:6860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8868 /prefetch:1
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:6972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2740 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8956 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:7104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9312 /prefetch:1
  2⤵
  PID:6412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:6912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9580 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9412 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9400 /prefetch:1
  2⤵
  PID:7200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10300 /prefetch:1
  2⤵
  PID:7272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10444 /prefetch:1
  2⤵
  PID:7352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10568 /prefetch:1
  2⤵
  PID:7360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10784 /prefetch:1
  2⤵
  PID:7496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10916 /prefetch:1
  2⤵
  PID:7568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11092 /prefetch:1
  2⤵
  PID:7640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:7992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10272 /prefetch:1
  2⤵
  PID:7872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11208 /prefetch:1
  2⤵
  PID:7792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10064 /prefetch:1
  2⤵
  PID:7132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11140 /prefetch:1
  2⤵
  PID:8104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,18412787749632405334,9124258738552617986,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3728 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GitHubDesktop.exe

Path C:\Users\Admin\AppData\Local\GitHubDesktop\GitHubDesktop.exe
Size 391KB
SHA256 3ca365d099474e2b9ffed249bf2cdac744fa5471af8e1760e064c296ceefae9e
MD5 19bb9ef6e5dca6c156842f50b54df5c3
SHA1 66864bd9a24e996622cca7f484f2b27aca17e057
SHA512 329da30338e6cc15cf5376bc56bae769d6c25feb81a6a8db8ed48fb3316020321d893b4233f3622ec7bd5900fdd9306d7edeaf4a9072da630a21edb2146fabec
SSDEEP 6144:YZzvhs2Z4n1E7g34XtVYAOfTdY6ZVb9dbKE3sgcXnYVKxSSUD:YJ+2Z4nShVY5C6ZV1sg9CSSUD
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\chrome_100_percent.pak
Size 146KB
SHA256 2fb9826a1b43c84c08f26c4b4556c6520f8f5eef8ab1c83011031eb2d83d6663
MD5 6c2827fe702f454c8452a72ea0faf53c
SHA1 881f297efcbabfa52dd4cfe5bd2433a5568cc564
SHA512 5619ad3fca8ea51b24ea759f42685c8dc7769dd3b8774d8be1917e0a25fa17e8a544f6882617b4faa63c6c4f29844b515d07db965c8ea50d5d491cdda7281fc5
SSDEEP 3072:izwJCGIekwusTAaegpIPMKdL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:izw1IekQTARgSK18Gb0OV8ld0GecQ3Ey
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\chrome_200_percent.pak
Size 220KB
SHA256 83d9243037b2f7e62d0fdfce19ca72e488c18e9691961e2d191e84fb3f2f7a5d
MD5 77088f98a0f7ea522795baec5c930d03
SHA1 9b272f152e19c478fcbd7eacf7356c3d601350ed
SHA512 5b19115422d3133e81f17eedbacee4c8e140970120419d6bbfe0e99cf5528d513eea6583548fa8a6259b260d73fab77758ad95137b61fe9056101dd5772e8f4a
SSDEEP 6144:SDQYaSN6svyd/I8M+RgHgx5GMRejnbdZnVE6YoppO4:3fSN6svydl26edhVELoXO4
MD5 SHA1 SHA512 SSDEEP

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\d3dcompiler_47.dll
Size 4.7MB
SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
MD5 a7b7470c347f84365ffe1b2072b4f95c
SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\ffmpeg.dll
Size 2.6MB
SHA256 b46d1f013db32c17625bb21e4ac3b39306aef6ba681a13b88127ba376d9d73b6
MD5 1a95b9e8ccd6a96074526fedecfa4b03
SHA1 7a9653ac38b8f62e4fa03853bc8cb2bfe1aea9be
SHA512 c10cd7ef0d2ff01863542252f863d0991dc0a79da6c15331bdb3e5cf08abaf12441bd18e50958bea13a96622f71a0a803a2d0b7c45373044c928b9a4bdc0d834
SSDEEP 49152:YC8lp7/1UNZrhOP9YJQHUOWwGen6yfW0OfShPdb5x8:vhOVYJiUOWwQaPB8
MD5 SHA1 SHA512 SSDEEP

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\icudtl.dat
Size 10.2MB
SHA256 7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9
MD5 74bded81ce10a426df54da39cfa132ff
SHA1 eb26bcc7d24be42bd8cfbded53bd62d605989bbf
SHA512 bd7b7b52d31803b2d4b1fd8cb76481931ed8abb98d779b893d3965231177bdd33386461e1a820b384712013904da094e3cd15ee24a679ddc766132677a8be54a
SSDEEP 196608:WgPBhORiuQwCliXUxbblHa93Whli6Z26wO+:W8wkDliXUxbblHa93Whli6ZUF
MD5 SHA1 SHA512 SSDEEP

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\libEGL.dll
Size 484KB
SHA256 24d4b79dd6f5eef31e126537fb940ac437777cee3005bfd1cc9acfa6d12ba64d
MD5 b9706bacf74d7fb86aae4bdb0419e675
SHA1 922d633273b961b7914de955ba0561e431db2ec8
SHA512 0b9b506e702c56e7812f9e2dd80b3164bd3e705cc46259740849101cf2c5ba07e676e9a6a3ee8bcb42ef9fbb975692e39866a35213c0a399237b4fae651281ee
SSDEEP 6144:rmfOX/zRR8yWTDLMoqbAIbqkpXy0/KQPJrIJAG/l:iczRSyWTDY6IlpXy0/3h2HN
MD5 SHA1 SHA512 SSDEEP

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\libGLESv2.dll
Size 7.6MB
SHA256 c017e44e3dd0806cfabcff8b174827824fe1e6af7e4b211b7887a87989cf41cf
MD5 4e22d076ac0c176cf629179d58a843db
SHA1 ca9afb71fa4a7b187c66b940206a1a2a9a0ed6f4
SHA512 04781de0cff39729a5fe915acb8a4e3ef96617b3c1ed0cc9f2a6361e8271c090fd81c0eafdb1f61d865c29d4eceaa1cbfd2bff8c53d98c4e13fd45d8f29395da
SSDEEP 98304:AlaVNd6hP9OPvwfWm6sGnoDgCXm3o7KXsB:rClGwpvGngCuK8
MD5 SHA1 SHA512 SSDEEP

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\locales\en-US.pak
Size 443KB
SHA256 95fd54494d992d46e72dad420ceee86e170527b94d77bfaaa2bfc01f83902795
MD5 88bbc725e7eedf18ef1e54e98f86f696
SHA1 831d6402443fc366758f478e55647a9baa0aa42f
SHA512 92a5c6cfc2d88272bb5144e7ee5c48337f2c42083bc9777506b738e3bcb8f5a2c34af00c4ccc63b24fb158c79f69e7205b398c9e22634dae554410450978a2c4
SSDEEP 6144:hbvP4RZJvMeriSIgRMP9evkD0faY0+p7W5PtrbngQH/2z5wB:hD4tEuTRMGkDtZ51r05wB
MD5 SHA1 SHA512 SSDEEP

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources.pak
Size 5.1MB
SHA256 a8538256645c4b136ec9a5724f91f06093c270708dabf948a06e1e5331a72dda
MD5 6b306ad353b8d5701954dbf1e9fb06f2
SHA1 aeb926d9a89c6eb8a2dec61ce40814df9acbbd60
SHA512 ec009a47a962c6caf5706bb7f31333b5e97306febbc02aa8f022e3d68d6061a51efe4e92c524275158f06a9e85ece7af878903bdaf518a893548c0dcc4c5e2ee
SSDEEP 98304:KIMk9g3M2Pe5MgzeUA1+QjbKb/jCErwrfqvqtEdpQcwL7/xrJvK:fMkw3uMwYYwKDjCEkrf8quPgPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

desktop-notifications.node

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\desktop-notifications.node
Size 2.0MB
SHA256 179ed048b12f85b402d79078619cdd5fdc2a7582701bc99eda65e98c9ff5e9ef
MD5 0738f97a76eb9da893352509cfcc1b03
SHA1 25ded06225ab283518a36483490d4a684736ac5f
SHA512 95b1a12e516519513e4dc93299b0feaf602ec03b883cf958c2e862dc51a5242796411544c1ea1a313d6ae5e7cb1850ab17d072b0b9349c36ccda13d62e192191
SSDEEP 24576:xKmrTyM2QbvRGRHx7frUrcy7wDTBLhc/Q2TJmP:Zr2URGRRPUYRTBLhtlP
MD5 SHA1 SHA512 SSDEEP

Submit Download

git.exe

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\git\mingw64\bin\git.exe
Size 3.8MB
SHA256 dc1ede5d773e55d28f93ba10b7ad2aeb2d562ad514039bd93f4d396831f6db7b
MD5 ba2f2776ff6f73418fb1918f2c50d702
SHA1 cebdde089f3df9567e29f67baf88b1cf1de777f9
SHA512 7cacb96ef17c901c387f54e7fdfcc262d80a1fff7c29fbe782d467b18949c92bfde4f2f43d1aa8bf4a130cd8f6998ee20648436f57ec52425e3669c746a32637
SSDEEP 49152:nB+ny3D5GiHUxW5E+Cd3QkliKzniQuzqVpbRKuGodzWJqm869ejMy8Et4UduynZz:BaeUxWm+ZQio5RKuGodzWJAlMyDRZz
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\index.html
Size 236B
SHA256 d44d3b8f637b17fc75c9f3ea14bc08166a7fa931de46b6ea41971ccd6131f553
MD5 50e5c22a717d067ee23135702cb231e2
SHA1 3dcfb4e6d90ee38fc0dd51e812c791ccdd395af8
SHA512 d45cacafcaf96b217939bddedb7374ce93415b08882c918c37c9ce8c2cdd5c525ef4153796bc15e40cae36518696971a52fe5d209bdaa69328fb4299075df506
MD5 SHA1 SHA512

Submit Download

keytar.node

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\keytar.node
Size 706KB
SHA256 68e3501927dadf5c4a0eb1b7701f218522b214199374eacf0c9507f71c8e66c8
MD5 7c42c5ccba5179985441c97274cf8c67
SHA1 df2ae5f74b2f7bd5bd276bd995ab9417d7f7baa5
SHA512 fda29589595e670b91add29eec762f432d5ffd8395be066b5ae8a394953ca67b5986a46dc1357383a8243528be5116d8b7f5097ef45f9e806d41011adffd4edc
SSDEEP 12288:6RInDhSzUpqDDa2XX05VNpk4th460iQlp1Qk5wUFPcvKKR0JQQ8jKOa8Gi:6OnDHpqnaskrdaa
MD5 SHA1 SHA512 SSDEEP

Submit Download

main.js

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\main.js
Size 248KB
SHA256 55824485ca11a66be274012a2a0c2d65705710872bb65b52c1b3e5692206712f
MD5 35a6a60a1880f3948050db8454bbd8e1
SHA1 8f21641cd973c7e64347a406638c6427d0a8a766
SHA512 5f1aacbf27662e690c0dc82ce547410da6d136ea2c6831907c2328cfef71e2bb6b5783cf94f0728dcf2807de8ef3c17e3c12200594cb6d72f450e11e9116cf09
SSDEEP 3072:T3ygXAqJPj7I0Yovjk+5UBlIV5+tvB6wKWcTYaiXGCFFVBNMMOPInJmH58:TtXAqJPfdUhxYqBMMOPInJkS
MD5 SHA1 SHA512 SSDEEP

Submit Download

main.js.map

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\main.js.map
Size 1.3MB
SHA256 d9b0d97a2e5e6f251041fc95f701cace24439cdcb87d9f11cb43bb1482898af0
MD5 811c6a02816515f1bc9fcdfa96623638
SHA1 a9c8ebb2044a1326c54c80fafde2946e4bffb289
SHA512 4b63e095ca779ba28a626ceb8a76057da0bb0f72b97d07b580f9cb7b67f999e14460a6b7dc67008dd736c384b367a965e23e265281b0ca006b71fb0f36148d33
SSDEEP 6144:vCq0UVEi8CSwxacOENzfa+wh2LEhhzfjBAwoZHonEV5LlxLS+RmjUum9Bz7sx9Kh:a8/ja+wnrCyUum9Bzei5BlGrp5VHLpW
MD5 SHA1 SHA512 SSDEEP

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\package.json
Size 446B
SHA256 9f3412fe395b97a467829e77d575c9b87a5db208650b702235a6fcce78820dfc
MD5 9ea6afc90d486c855b849eab6d02e12e
SHA1 5e081e3531d72b317e4e383d88d55a03c98b8aaf
SHA512 04dda3bcc5444b942ee8826f40d1b81f853fa9d578f17414a47ce880aef7378f48e7e354d366ecf505a47a1de27a44b1dd2817962397d7d7c64929ffba9675b9
MD5 SHA1 SHA512

Submit Download

registry.node

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\registry.node
Size 695KB
SHA256 2a86dd7cde320eb4adb2dd6289fa771c389690487ee4322079518f3795dc6fc9
MD5 6aa9188b2ef0d9537f5f29323b7ab6e4
SHA1 924e3894b9a5a8898a6245aad4f99466f7c8f5a7
SHA512 58fa979f77d7cbafdeb4d3a96c62384d93a8cbf2ab5a3da0513ecb35849724c64f0b680fd56350751abec4128fba17068827bd716f82766aa709032d8073021b
SSDEEP 12288:b7P4JLntTmvCGWJ19UOkhOXjpb277I74liAANjDaZrnOB+:IJLyAq2+
MD5 SHA1 SHA512 SSDEEP

Submit Download

renderer.css

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\renderer.css
Size 307KB
SHA256 8b79be4a17e45978ad264440bb1d3859b3ce5cc07530d0f368aa09e050439677
MD5 b4de28ef7e068e4c61605647c553b367
SHA1 12e43e7b6f08d825f33432a4b044e961c94f2161
SHA512 3e474b29071893a3ba5f83c99c8662151abf146df39e68aa0c744da47cb37fbba21ece85cffa739db526a09e9c7d43889faea0817a9372a666ed8ddc521eb661
SSDEEP 6144:tcOgKGbmdV6iWfw7dOb9GlyQhb228ytkUs5tsPLpjhXg+y+Z7AQ9SIWcYF573:COgKGbmdV6iWfw7dOb9GlyQhb228ytkL
MD5 SHA1 SHA512 SSDEEP

Submit Download

renderer.js

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\resources\app\renderer.js
Size 2.3MB
SHA256 6e52aeb54f05b89effded03d15ab9ca1d7e20021467ca5ebaf0370763f256c61
MD5 a09e3327f1ec72b48497f7d75cfbb72c
SHA1 90bf7f30469a624d703a9ca8382459218f1515b0
SHA512 831c7b6908ceba006d056e9c2622bacd18cbf9da1ea3baa4ce6c849f67296219f62b5c64594a6574ed1a09a4347a062c1d189e118ffb389a7a2ff11317f47bb4
SSDEEP 49152:EJpb/hpXo+hqeNylGDWI2clqfc4x+k9We4RpLFDSxoH:GnoJcllpRl
MD5 SHA1 SHA512 SSDEEP

Submit Download

squirrel.exe

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\squirrel.exe
Size 2.0MB
SHA256 f28929f7af38e544d4609cf9f7963a4ec7f87c95df832a715f49adaa9783cc5c
MD5 fa81136f232e93cf5f6bb5972c6dda74
SHA1 c6d792a84d1b1adb5ea25aff941297ed204685cc
SHA512 759a3b7b5fcd19a7bd77bb036ef8e4658546e6659b611ff5ab59bf06222c2fb1050b46c38d45cb6795edfb4fc0d3fa6e3c7ebd70967540822fe73850d30f0b31
SSDEEP 24576:EWltPuAnUCiag6CKM2zCy9sQuOjj1VgZej6GeS4lNrCze5qhYp4t9m2g96B:ht3UCiag6CKM2zCyZuOjJaxSS5qhpgE
MD5 SHA1 SHA512 SSDEEP

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\v8_context_snapshot.bin
Size 641KB
SHA256 367d41b832f2c870c544934b08fa271786b02b8a8cbadc026f02e869c54ce13b
MD5 0028b7601ef225663b8c0c57089617db
SHA1 40a46d864b59eefa30c2f825bf6530ffd8029be4
SHA512 5a32b8e064d073b248154794a0452ec3771b5bbc6e4bab7582e30278c8863fb77d9b002588b2d05ce9cb5406739cafe04af8c9a9db7b010921d8660ce44988c3
SSDEEP 6144:0PGX3u/nfW2vGgwqIXCHHni9GWHQ/3DByi3aZEd40q4qVF+OZcZCMg2jwouoDcu:etfVv9HOGWHohmSqVF+OARjwouo1
MD5 SHA1 SHA512 SSDEEP

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\GitHubDesktop\app-3.4.3\vk_swiftshader.dll
Size 5.1MB
SHA256 991f207135c4038c879700484b766e3c1a049bd5995e413c6254985b0a7475cd
MD5 3f57f375bddf114778ac859905c9bf60
SHA1 2ae981b33ad570cdf5588e5857f2c6d52bb4aa84
SHA512 572e6d989b475b75cbba158d15b243cb8300e59991b27e85c29d1f81f751a7a25a13fdc5e53ddeb60580fa363b64d114e6189147f56b06f34f9f0ee962f85787
SSDEEP 49152:loaTaX1+4J7dN1uB/t4ABL5V1v+3+mFcpZBqtpM5KZwFlox0ikAiJb1XQGBliYDh:7eX1+qULMSx17nb249
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808
MD5 719923124ee00fb57378e0ebcbe894f7
SHA1 cc356a7d27b8b27dc33f21bd4990f286ee13a9f9
SHA512 a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e
MD5 d7114a6cd851f9bf56cf771c37d664a2
SHA1 769c5d04fd83e583f15ab1ef659de8f883ecab8a
SHA512 33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8
MD5 SHA1 SHA512

Submit Download

075c9054-8b69-40ec-a7b2-a529a13c2373.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\075c9054-8b69-40ec-a7b2-a529a13c2373.tmp
Size 4KB
SHA256 5b174d32fccca8fb83a16cb71f0fdf1756056deedc12d9cba06e78c622e99548
MD5 bca4e2fe3c5b6d951afbfb0831e9b269
SHA1 5487892530ae7edc7c1950b255f2839ecd718ed6
SHA512 45a7180003d628abd0c3473724d4a097243608d29f58e978185506c1ae02e3ccd84cb15050a3e009723e51947aafc787c38cfd70147e6f375cde1a7910ed9d37
SSDEEP 96:6fUWUmUmAUd9Up+ieUlUjcUnUBUdUTUhVU+UQUMKU+BUdeUKU01jUJU0UtUUvFUq:sUWUmUmAUnUcUlUQUnUBUdUTUHU+UQUt
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
Size 62KB
SHA256 eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb
MD5 c3c0eb5e044497577bec91b5970f6d30
SHA1 d833f81cf21f68d43ba64a6c28892945adc317a6
SHA512 83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38
SSDEEP 1536:6+yyTwrwGtdPDZMlQcadLSHdqyjTxJMJwh09KWWXDManYPHc:6byTwrXL7ZoM28wPIawHc
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Size 41KB
SHA256 e8be4436fcedf9737ea35d21ec0dcc36c30a1f41e02b3d40aa0bfa2be223a4a3
MD5 f3d0a156d6ecb39d1805d60a28c8501d
SHA1 d26dd641e0b9d7c52b19bc9e89b53b291fb1915c
SHA512 076acfd19e4a43538f347ab460aa0b340a2b60d33f8be5f9b0ef939ef4e9f365277c4ff886d62b7edb20a299aacf50976321f9f90baba8ccd97bc5ac24a580bc
SSDEEP 768:Yo/fQoCysNBtXZYwX8QKePRw01KOJHthpccl5MB8Vi2:YoAxRJYw3Kez1K0HthBly0i2
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
Size 67KB
SHA256 48232550940208c572ebe487aa64ddee26e304ba3e310407e1fc31a5c9deed44
MD5 ed124bdf39bbd5902bd2529a0a4114ea
SHA1 b7dd9d364099ccd4e09fd45f4180d38df6590524
SHA512 c4d180292afa484ef9556d15db1d3850416a85ad581f6f4d5eb66654991fa90f414029b4ce13ed142271a585b46b3e53701735ee3e0f45a78b67baa9122ba532
SSDEEP 1536:FOq3MS+QV9SKZsrdXqTWdSVIiV8tpKSs3h68zj4LDz7F2M8j6:EqcS+0SKyhXSDV8rCcsuBL8W
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
Size 63KB
SHA256 c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b
MD5 710d7637cc7e21b62fd3efe6aba1fd27
SHA1 8645d6b137064c7b38e10c736724e17787db6cf3
SHA512 19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44
SSDEEP 1536:ZNIPgrq59wJU9Czk2BFfKoUwOGeoDfEge1gS+UYSdU6D+sNZnwbo2Fa:TI4S67kEfU11yqlYS1/NZyo2Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Size 84KB
SHA256 535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287
MD5 74e33b4b54f4d1f3da06ab47c5936a13
SHA1 6e5976d593b6ee3dca3c4dbbb90071b76e1cd85c
SHA512 79218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2
SSDEEP 1536:8oEYbzh/Nd/NxQhApy01pxn3bJleVi0Fb+znrC8dOYUBHES/T5gMTeHOWBZeb4b:RE8FFd/zQhApyynn3bJlc1GnrnNURN5E
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009
Size 1.2MB
SHA256 e4e53d750c57e4d92ab9de185bb37f5d2cc5c4fcc6a2be97386af78082115cbb
MD5 540af416cc54fd550dcdd8d00b632572
SHA1 644a9d1dfcf928c1e4ed007cd50c2f480a8b7528
SHA512 7692e046e49fcde9c29c7d6ea06ed4f16216ec9fb7ea621d3cc4493364743c03925e74244785588d1a4bfc2bedd32b41e7e66e244990d4076e781d7f4bbb270f
SSDEEP 24576:jFK5OPq4HHGoD/8RKKjtDd5Z4O5Ajp3snICx7Y/ovtshgUcz2PNw6Lt:jFK5OPrHHj/AtGKcpYU/4t5z2RR
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b
Size 73KB
SHA256 e2b4325bb9a706cbfba8f39cca5bde9dae935cbb1d6c8a562c62e740f2208ab4
MD5 cf604c923aae437f0acb62820b25d0fd
SHA1 84db753fe8494a397246ccd18b3bb47a6830bc98
SHA512 754219b05f2d81d11f0b54e5c7dd687bd82aa59a357a3074bca60fefd3a88102577db8ae60a11eb25cc9538af1da39d25fa6f38997bdc8184924d0c5920e89c8
SSDEEP 1536:wtwflg2OkjCNcaaOGaaEsEiWWFB7vLupN+4CiG52o78vfQ:wYWtkjC6xaaECJ7aNiiYxgg
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c
Size 43KB
SHA256 ecc145203f1c562cae7b733a807e9333c51d75726905a3af898154f3cefc9403
MD5 209af4da7e0c3b2a6471a968ba1fc992
SHA1 2240c2da3eba4f30b0c3ef2205ce7848ecff9e3f
SHA512 09201e377e80a3d03616ff394d836c85712f39b65a3138924d62a1f3ede3eac192f1345761c012b0045393c501d48b5a774aeda7ab5d687e1d7971440dc1fc35
SSDEEP 768:7xfuPSX2nNYAD9454MExjs8isUaXTFolW4BJwnlAWkp0AyBiPXK54nDUardRZ:tfB2nX454MeiJaXxCBJwlAWkjyeKEUux
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d
Size 26KB
SHA256 ba0ecf05941451756a9acfc7a913e64dd56ddee8f3811c8a9f1cdd0a219ad64b
MD5 1de4708beee6992745a7c14b7d8580da
SHA1 03bb2b7dd07f1701da7cf19b68dd23a2b298827b
SHA512 5d21cd342f3f70a7dc4bdd3b100e6677e74a7fec22af3ffc9d048618d1daeb5dc5e3f1511ffaa2fddf2f3e49b31351d7d4613f7f03e21d2b609483ad6aab9c86
SSDEEP 768:wM+uFqGNqKi+2MC/s8Yb9FQuAzdXzFkafZNwZ1W:wljGNqKi+ZaYbDQuAzdXzTZUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000017

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017
Size 42KB
SHA256 ba3783050d8a2d02e1cdc8463b635dc21ac2a84da9ebd33bf362ed83ee53a2b5
MD5 9b0c6e151c40b34b5a20f95a7df9ba0a
SHA1 92a46d7bab01629377f4529a2673b736b96f563b
SHA512 bba02f336168dc9507e9f04bcf7f9c27cc2082f7d9875e3b571fd4b13c1dc9c778d187a0bf6577b92f50111e2bc37b2a7b615fb0be7d0c17ded3451675e28a71
SSDEEP 768:rpYTuO34vlIM3f34SamkB82JUPFLTboXLHMy5Sbvkw8v/QyRS1D3:rsj4iM/zAnJ4RGHEvc/oV
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fe86cec22f3be7c7073aa47aad74c06d59700778a5c3dcdeb62f18af0ed824a9
MD5 b1a856be65449008023891db8b3cccbf
SHA1 4438e608fb7701c9f7aa28b003e675bea66daece
SHA512 608dc6876b732ca2767a189e20290a618e6e79ae86457030686f865df72a08e99e6204b0c3ec6b9f36ba8c6865727dd778fe97b2866e0b6d2e5d7c9fab90598e
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 53176b09db1cdcfb29982ead8ce81dff887403516a295a80c6fec1ea0f539881
MD5 a38d02d5a822de490cc88d4a703148a1
SHA1 52f71ea2011f40dab08032675d1b36cf4125bf63
SHA512 3b3dd78e00bb1ea248f6dac1a2d0b5f2fbbacbcaf6af60e1f6c3b3f66132d626f8751e1c51dc4bce7b44eb783ebaf2f96ff9ffb251454204373ee4520233de86
SSDEEP 96:thHfi1/xeCWGELvcdyqxp9hhOxS6YpF66ZSJAn6mUqVm0aDw6CWq8dKsC2WBjMLJ:tOcvcdfxp9hhOxZOn6OmDCGAlMl
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_whatismyipaddress.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 15KB
SHA256 6e99e7e1e5c27838d7c23591b2c14d7f554b8b281b2d05ffa312451e47156d84
MD5 835ed018be0a1fd3ccd19fac384db408
SHA1 d881335ea4ed6bb6015b4fc508c392f27db9ae02
SHA512 21b444b417faf3511dd69faafa7972bfed93326fb9ce76dfe73ea8a6b998655b6ffc0bad3a1c170ae8cd1ac64d25096d28bd852fe760b1d0641dbd7aae83ca88
SSDEEP 384:BtzY5cish6VP1a6HFXQsqo4AsXxQkkBWYbEZEW6ISU92sSO6ht98H/KSiL8R9Ovv:vUF3VVNYxnaWuRhLQM8Q/yb1fQs6rikl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 16KB
SHA256 df0a33c78739c01805fe325a5bbcd2a3ba782ca8ef86dc189e1f419f25dab301
MD5 4f4b43f855850833ec883134c09e61ae
SHA1 3d0bf4f51486b9d0d862e88bc481f584ca5d9004
SHA512 3e73ee76e343a506972c8fba96264f14ded6edece3523a6b048ee8f17b484345c47f6c599d7b9898a8ce61a903d620c4ee9f5e95cbd7e5cc11803a2460fadc42
SSDEEP 384:RrN5cii6HXQsqo4AsXxQkkBWYbEZ6IU92sSO6h8dL8R9OvATe1y1xdbZtLwRk3zp:j3VNYxnOhuRh489/M1rFqIBPaB4nwU92
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 16KB
SHA256 507be95e081db469b0955f48151e9bed2ed67b2385c04ff1061ae1d9037f4914
MD5 cb1d50841de4bae0832e87d4beaeb333
SHA1 5eac64ea1ff496861ce71da8a563c50f58f34ce4
SHA512 c0a6c597d170cb2f6c0b8d4cb3a9987c40a79106b13e9d4ed0b6ba35b24f33ac3f49ec771ceca10f57e64fbe672e5015f65dce7e702e81d9881d09589bb7a0de
SSDEEP 384:BtN5cii6HXQsqo4AsXxQkkBWYbEZ6IU92sSO6h8dL8R9OvATe1y1xdbZtLwRk3zP:B3VNYxnOhuRh489/21rFqIBP12B4nwU8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e2b61af77e31638baf27b8733cf87063c4bf44fd113433162bf21ca38c208eb5
MD5 6003fb4939910db113f54789d3ce7434
SHA1 2f3d1c2473e174428eb44b6ce286984a2db40be6
SHA512 b72323476857978a7d9436de4dfd06351757c8e5e2c6bef3ba4f5f8a8e7aa46e527f9bca1dd67856f577eec11a600ad6684a353e325c40bf1e3faa3a7f877d86
SSDEEP 192:nQkzwqDFhPWtWMOuxTLGdl+/Mp5pNw5ky3xBqiYXp+VtpF+zvYqamdlUu0hXTk6S:nQfqxhYWm2hPKBcMB6uoFVAa3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 9094407b753dc841e06b6dbd1137db1d9beddc45d7070096b7252906e9f96b30
MD5 d0965e393ec3794979aa1a50fe8137b6
SHA1 84a928f7e4640f0068fbffb106e3e31dd72bd15d
SHA512 f5872203fabed3018e35fa8373a752c4539b05ac93402cf0b72637065b3d865a12c7b232277c6d3b8d46b95b787fbd8d3406dad232b3369fd96784e0f73d44ed
SSDEEP 192:nQknCqFFhPtaWMZVcy8gYIREPsdf1N6uMr2BpNw9rL7b0IBqcYeboe2jV4EteynS:nQhq7h0WfstaG2fBUMseV1JVAsX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 417962002487d4cf76df00c0733760615caac6c55598ba5c4947866862e55f00
MD5 983d9ae3991a9dbb31aed16b4b951e99
SHA1 38c6ad1d880f2ea924061de59d905d94941f5830
SHA512 68f12a91ff7b8260fe14a9619ed1a0ef271a68e42340512cd2105b432a060dd3eebc756b8902b56bff800408206d6bcb566f8c2d60fdfad30240511269ac67ab
SSDEEP 96:nQktaZ1QQLSFhPwpvWMoiVmdeH/bjUWQyV+VDCziEwb:nQktO6RFhPGWMXnro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 abc3e2b5f587f1ee110601997924ed83bcba7e9a51ddbf8f1f98f623412dd4c6
MD5 10e3090473902ccff9809e159f475da6
SHA1 022109c8ecdf0ddcf3c3c91354646b1b5f3e4b79
SHA512 c3655a1ddc18a4214ad1edf76320d0d2934e546365271cbba60aef2fba25e00b2dd6bca97cc27c4f31816e3a2f40e5f0c5c68b0d9c9bb4fb3abe4014e4b1b284
SSDEEP 96:nQkzLZ1QTLSFhPwpVtWMoiVmdeeux1j/ejUWQyV+VDCAiEwb:nQkzV6yFhPWtWMOuxhQrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3de0ceab68b2630d31f4eb662dee7b704923535d364b53abb73ed52789ae13fd
MD5 0e8cf75900c222ba5e86bf972280f197
SHA1 85dcf95f0fe976316c0e98d80855bea33d342f62
SHA512 a2f7b17db066d3778553b77c379397be1946ea95d4827ebfd1c87abf765520f2352d375e84679446919aa6d4d1d108c4f4959fa4d0f255a6b474e6c55b8d088d
SSDEEP 192:nQkzw6DFhPWtWMOuxTLGdl+/Mp5pNw5ky3xBqiYXp+VtpF+zvYqamdlUu0hXTk63:nQf6xhYWm2hPKBcMB6uoFVAaC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 80830672e522e2311177be1f738a548ec0722445970b6795ccf6a32eb21cafec
MD5 061844e64c8c7ff49d86ae6897c99a3c
SHA1 51dc1df22fe477676ef73e5ed94b67fe2e99f5ce
SHA512 f58aec8da999886c972f47ea49f974281cad09366a95e7711b2be23bf64445e32f404dbce5f429b6d32f0e8b78841a293af20c5c712fb8fb6d65a74b80485b33
SSDEEP 192:nQknCqGFhPksWMZVcy8gYIREPsdf1N6uMr2BpNw9rL7b0IBqcYeboe2jV4EteynY:nQhqSh3WfstaG2fBUMseV1JVAsx
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 4KB
SHA256 9f02178029188370203dec4cc5d2ed6601df699b78a13b194617844b630ac5ff
MD5 1e6c88b477b71c4e3246b3c7478c2566
SHA1 734a1b92e241038705e29a852b87df38bd7b2248
SHA512 d14a2bf8f88a90e1109eee4c5181220c962c35852f66d281b06f7821de64ecd090a727d5c25f1bd78762a1ccb6d4a778c6efb36f7231f4ee8d9bfbe6c294c490
SSDEEP 96:ofUXUmUmAUd9Up+ieUsUyUjcUnUBUMUo3UFUhVU+UQUMKU+BUdeUKU03jUbU/UmT:CUXUmUmAUnUcUsUyUQUnUBUMUo3UFUH4
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 5KB
SHA256 5223931dd4c44591e0fbfb63d334551c33e9adc707fda277cd488d9989675782
MD5 e42ef6d963f419893ca2cc39f0f0a978
SHA1 ec9cd3ad53a4008dbda42cd8f8dc01a6dd766f67
SHA512 9b33a3f95f7e2c8abc1014805ced684f65baf808cbd4d6fed4dba142bf9277a8427acfe81201d25714f537d5b7d456c8dbdd64a8dc2e8ec61e573470a1628df4
SSDEEP 96:ofUhUDU0UmAUd9Up+ieUsUyUj8UlUzsUXvUaUINUKl3UYUcUhVUwIUFUBoUKrKUU:CUhUDU0UmAUnUcUsUyUoUlUzsU/UaUIF
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 5KB
SHA256 484f82a3ca53bf10096063164ad777071c32aeed32a930bf4a2d74dcc17dd009
MD5 47a6b4665b323844295e75159612edd3
SHA1 70b17882e9d2af80fb32f694c633b9bd17cf7df1
SHA512 4022cd5d8e995219ccb390286758488bd6865b2cf5ed26c38bf1af74591ad54f185a0eebfe096a57c21340f1acd5045c46eb5513f112395cec44e434ae647777
SSDEEP 96:ofUhUDU0UmAU8UJc9Up+ieUsUyUj8UlUzsUXvUaUINUKl3UYUcUhVUwIUFUBoUKq:CUhUDU0UmAU8UIUcUsUyUoUlUzsU/Uah
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 5KB
SHA256 a987c87b88e86751a4c522c437b418b8622b4ab058fe829333c667d39cdfc060
MD5 aeef8f365bca2d879a5dd965013ebaa9
SHA1 b2ec035be1edda09fe8ec87d9f8f21ecb3890dc6
SHA512 1e8add895c3296b8d25e50db5d807f9e3b007ce51873e9e7745b1cd63af350ac1266fd4c9299ca3171d8faaa0baae9e845ec9747c00d59bca7bb06a1d8156413
SSDEEP 96:ofUhUDU0UmAUPUH9Up+ieUsUyUj8UlUzsUXvUaUINUKl3UYUcUhVUwIUFUBoUKrm:CUhUDU0UmAUPUdUcUsUyUoUlUzsU/Uah
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity~RFe588fb8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588fb8.TMP
Size 1KB
SHA256 bff7df23bd1f36030daaaee5e7e893f7a43836d6af458b39f3a33d596b62e6ce
MD5 d822d05856a68ed1aba275d06c325b50
SHA1 547175f00bf5115e94df3da1359628f528b8934e
SHA512 d9f11c415c669811ea9b46d7dba53bbb3c5a537e7833faebe951e2c3231306d89eeffc1716a75965730e49d92dddc6fde7578c8832963c2a911a35116bd78d53
MD5 SHA1 SHA512

Submit Download

d1a7da10-1528-440c-a02d-71cfbadd60f4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d1a7da10-1528-440c-a02d-71cfbadd60f4.tmp
Size 5KB
SHA256 21c9b7abf65ef0369cd7626da414b0acf55a13a447a6a51e8feff8a4f5dc005e
MD5 a79373c3eb66cde1a707c968c5a411c8
SHA1 07c597cb22694aaf89394bc44f9332ec0c252755
SHA512 9678d5e005d12f893aaf7fdf00186aa064ec11177f8a301a405ee213cb9399bfc90474a039f9dbfe7d26207c5c3eb219f58820ee43c1800ad08159edab77470a
SSDEEP 96:ofUhU5UmUmAUd9Up+ieUsUyUj8UlUvUK3UaUMUo3UYUcUhVUwIUNUQUMKU+BUdm7:CUhU5UmUmAUnUcUsUyUoUlUvUKUaUMUc
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 c6dadeb3c88a31d166d8744d3d281f7b037cc0c7c50ed04a04db386ae0857d6c
MD5 c2258d96c44b8c14e7b878c281de0998
SHA1 7c069bb9ee817bdbfc8a1ae5dc2cc11f7b55e084
SHA512 56f7934fad34b9e393c4ad99862e3ceaa9c31ff4253e2c77aa21c2c698361b0cbb0ee0045659ae3470a44b6c405963e9ce41488107862625b8890c8857ad7fd1
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupq9Q2RUC/xNiRw5Ytj9Zkle:A9iIxuERzA83h09RZxYqrrztkLsfb2
MD5 SHA1 SHA512 SSDEEP

Submit Download

RELEASES

Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
Size 84B
SHA256 b0b3c93b5237b0a95aa03abe1fa49a9bb114d693090e7adb32f849b59f86edba
MD5 0a5785a384660ac4a05980fb0d106d76
SHA1 4cce3b6f54e7803357a52976106aae6f045c72b9
SHA512 5448c356931ffce51bc993bf5a5a9feeaaef7021089e69116654f7008d49875fcdec7c20f60cfb17d0d61bfa7dfec4d0b1fa7b78673a51961994b405233e298e
MD5 SHA1 SHA512

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 1.8MB
SHA256 8096d3f3cca239cee5ef26f1a6616979485fb5680514dfa3736da5ab986f771a
MD5 b42702f8d0627bcbaef4891d1ab31001
SHA1 bb9fe44fbfb5b452a26c76e4f3b41d4796b6bd26
SHA512 eb3d89190f237e67a2185e963ec1c5a291a72df85bcd3937a601f5f115a6cc9ce9774eed12d81dbe714cdc99a6fddf9ff500fe0f4ab6c835d55a733e1fd33055
SSDEEP 24576:WWltPuAnUCiag6CKM2zCy9sQuOjj1VgZej6GeS4lNrCze5qhYp4t9m2e:3t3UCiag6CKM2zCyZuOjJaxSS5qh2
MD5 SHA1 SHA512 SSDEEP

Submit Download

background.gif

Path C:\Users\Admin\AppData\Local\SquirrelTemp\background.gif
Size 28KB
SHA256 f1b5abcae2553b087045362562f659f7def98edb1e003a1b4cb6f3a99dd5680e
MD5 1eb5b397a8a018b268cc40e6628af3b9
SHA1 d25a56d87af30360893d5a84909e206005b4259c
SHA512 3158da743f8b65c3f1af1111d28227bef3d71f9b20d42dd6f19a3123e7756c68018b0afb39975804b2f373e8da493155d9d8b0cc306d2c48f7bec5fa091a2adc
SSDEEP 768:UhQxkc6x6Xw0rD1QENdJb1Vomoq+h1hdrM/8206ZDW:udjuw0rD1QENdF1+P9fMDW
MD5 SHA1 SHA512 SSDEEP

Submit Download

setupIcon.ico

Path C:\Users\Admin\AppData\Local\SquirrelTemp\setupIcon.ico
Size 126KB
SHA256 88517264611cdd0ea5270be87edae52447ee043f8a45b3e87a4b7a9238375333
MD5 1839b2cdf7b9a3f589cf204afa588076
SHA1 cf24a4544ef3ef6f9969289b62cd99c6ceda616a
SHA512 cc4207306ac041f6794ae9b85a1d91c34a8ad8f504ede790414017447ef09312ef0e7812d04d028a54268109edd35c86356612a36048df2a79a8d70dd3229732
SSDEEP 1536:RZVb9dfF9IfffH9fffffHfffMfffPfffffYXfDGnyffIBwDKvkrkX/kkkVQk7aTw:RZVb9db6aTHJFIFE3sgc6AnpqB7Bxfnm
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\GitHub Desktop\IndexedDB\file__0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\GitHub Desktop\Local State
Size 434B
SHA256 bd7ee2fd04e631e90d99aef9c6ef708f1bbf9583e977942b7b5c6b9bbcdbb971
MD5 0a42f1bd5f36ed1c922aaafc11cdd88d
SHA1 3fdd651eb49b315834b9b273eb7f590df1938e90
SHA512 770fa2a892244763ee880520649b3870a3ee5b73595d76fd0aea32e8531d5510ca46eaf670ca0920f74d7a03830e15e3e1a96c3a1dec8c9dbc355b190b544eff
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\GitHub Desktop\Network\Network Persistent State
Size 380B
SHA256 9fe3adab90006b9cf58c57ab2732c38eacd93971215dffcd4342855cc9b53195
MD5 bb8c56cf49c23b465a4d09e09f9323fb
SHA1 f99090006849740cb4a8d9656a33ea01bb292c19
SHA512 cff8ae62b33ad1668cd330a69fffa37a75e273857ee56be8b880ac7d8b6f62d2e38bdb966010eebe23d4eb3336813b9e6590eb1789571967bc2dfddec9d7418a
MD5 SHA1 SHA512

Submit Download

Network Persistent State~RFe590cb8.TMP

Path C:\Users\Admin\AppData\Roaming\GitHub Desktop\Network\Network Persistent State~RFe590cb8.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
MD5 SHA1 SHA512

Submit Download

2024-08-31.desktop.production.log

Path C:\Users\Admin\AppData\Roaming\GitHub Desktop\logs\2024-08-31.desktop.production.log
Size 2KB
SHA256 553fc1d306ce5e9b852a51e5b57f34845cd4b88c3fde6cf5ddca1a53e95ad252
MD5 fdbd6c411267d72b444b91be5b1b69c1
SHA1 d645d3ce2ec9a4f4757214885128f871fb6095f3
SHA512 03ae7fcac9b2943cc29fc3ce636bb5693a2143a95406782e726ca28dd7c5e32e95639d0cd287d2f4e22e189718debdd79ae0d507a899c3b91a8af6606a92fe90
MD5 SHA1 SHA512

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

GitHub Desktop.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GitHub, Inc\GitHub Desktop.lnk
Size 2KB
SHA256 3d729d9227e6d9361987715385f22f9baacd3cb6709a6a066e4253dc9af75e18
MD5 d4ff599b808e113e3ff659592d598774
SHA1 28458770917e8eddd404f432f6d57607b1ecebc5
SHA512 0107ed97688e0134de8bcca386dadd2f8a352afaebe084c52691952076031247c2c15447bc5182fae164800d5a7ad218b5ec23c7b0972742a5d48ca00886a7d0
MD5 SHA1 SHA512

Submit Download

memory/8-2008-0x00007FF7D3110000-0x00007FF7D3544000-memory.dmp

Download

memory/8-2010-0x00007FFDB6DA0000-0x00007FFDB6E45000-memory.dmp

Download

memory/8-2013-0x00007FFDB6B10000-0x00007FFDB6C29000-memory.dmp

Download

memory/8-2012-0x00007FFDC2C90000-0x00007FFDC2CB4000-memory.dmp

Download

memory/8-2011-0x00007FFDC9ED0000-0x00007FFDC9EE6000-memory.dmp

Download

memory/8-2009-0x00007FFDCBE80000-0x00007FFDCBEB5000-memory.dmp

Download

memory/396-2052-0x00007FF7D3110000-0x00007FF7D3544000-memory.dmp

Download

memory/396-2054-0x00007FFDCBE80000-0x00007FFDCBEB5000-memory.dmp

Download

memory/396-2053-0x00007FFDB6B10000-0x00007FFDB6C29000-memory.dmp

Download

memory/396-2057-0x00007FFDC2C90000-0x00007FFDC2CB4000-memory.dmp

Download

memory/396-2056-0x00007FFDC9ED0000-0x00007FFDC9EE6000-memory.dmp

Download

memory/396-2055-0x00007FFDB6DA0000-0x00007FFDB6E45000-memory.dmp

Download

memory/848-2047-0x00007FFDC9ED0000-0x00007FFDC9EE6000-memory.dmp

Download

memory/848-2046-0x00007FFDB6DA0000-0x00007FFDB6E45000-memory.dmp

Download

memory/848-2045-0x00007FFDCBE80000-0x00007FFDCBEB5000-memory.dmp

Download

memory/848-2044-0x00007FFDB6B10000-0x00007FFDB6C29000-memory.dmp

Download

memory/848-2043-0x00007FF7D3110000-0x00007FF7D3544000-memory.dmp

Download

memory/848-2048-0x00007FFDC2C90000-0x00007FFDC2CB4000-memory.dmp

Download

memory/1980-2078-0x00007FFDC9ED0000-0x00007FFDC9EE6000-memory.dmp

Download

memory/1980-2076-0x00007FFDB6B10000-0x00007FFDB6C29000-memory.dmp

Download

memory/1980-2077-0x00007FFDB6DA0000-0x00007FFDB6E45000-memory.dmp

Download

memory/2056-1997-0x000000001CED0000-0x000000001D3F8000-memory.dmp

Download

memory/2108-1995-0x00007FF77ACA0000-0x00007FF77ACF2000-memory.dmp

Download

memory/2164-2032-0x00007FFDC2C90000-0x00007FFDC2CB4000-memory.dmp

Download

memory/2164-2028-0x00007FFDB6B10000-0x00007FFDB6C29000-memory.dmp

Download

memory/2164-2029-0x00007FFDCBE80000-0x00007FFDCBEB5000-memory.dmp

Download

memory/2164-2031-0x00007FFDC9ED0000-0x00007FFDC9EE6000-memory.dmp

Download

memory/2164-2030-0x00007FFDB6DA0000-0x00007FFDB6E45000-memory.dmp

Download

memory/2164-2027-0x00007FF7D3110000-0x00007FF7D3544000-memory.dmp

Download

memory/2388-2001-0x00007FF7D3110000-0x00007FF7D3544000-memory.dmp

Download

memory/2388-2006-0x00007FFDC2C90000-0x00007FFDC2CB4000-memory.dmp

Download

memory/2388-2005-0x00007FFDC9ED0000-0x00007FFDC9EE6000-memory.dmp

Download

memory/2388-2002-0x00007FFDB6B10000-0x00007FFDB6C29000-memory.dmp

Download

memory/2388-2003-0x00007FFDCBE80000-0x00007FFDCBEB5000-memory.dmp

Download

memory/2388-2004-0x00007FFDB6DA0000-0x00007FFDB6E45000-memory.dmp

Download

memory/2440-1233-0x0000000020E00000-0x0000000020E38000-memory.dmp

Download

memory/2440-8-0x0000000000050000-0x0000000000226000-memory.dmp

Download

memory/2440-1236-0x0000000002590000-0x000000000259E000-memory.dmp

Download

memory/2564-1857-0x0000000000D70000-0x0000000000D90000-memory.dmp

Download

memory/2616-2060-0x00007FFDB6B10000-0x00007FFDB6C29000-memory.dmp

Download

memory/2616-2062-0x00007FFDB6DA0000-0x00007FFDB6E45000-memory.dmp

Download

memory/2616-2061-0x00007FFDCBE80000-0x00007FFDCBEB5000-memory.dmp

Download

memory/2616-2059-0x00007FF7D3110000-0x00007FF7D3544000-memory.dmp

Download

memory/2616-2064-0x00007FFDC2C90000-0x00007FFDC2CB4000-memory.dmp

Download

memory/2616-2063-0x00007FFDC9ED0000-0x00007FFDC9EE6000-memory.dmp

Download

memory/3212-2039-0x00007FFDB6DA0000-0x00007FFDB6E45000-memory.dmp

Download

memory/3212-2036-0x00007FF7D3110000-0x00007FF7D3544000-memory.dmp

Download

memory/3212-2041-0x00007FFDC2C90000-0x00007FFDC2CB4000-memory.dmp

Download

memory/3212-2040-0x00007FFDC9ED0000-0x00007FFDC9EE6000-memory.dmp

Download

memory/3212-2038-0x00007FFDCBE80000-0x00007FFDCBEB5000-memory.dmp

Download

memory/3212-2037-0x00007FFDB6B10000-0x00007FFDB6C29000-memory.dmp

Download

memory/3248-1991-0x00007FFDCBE80000-0x00007FFDCBEB5000-memory.dmp

Download

memory/3248-1993-0x00007FFDC9ED0000-0x00007FFDC9EE6000-memory.dmp

Download

memory/3248-1989-0x00007FF7D3110000-0x00007FF7D3544000-memory.dmp

Download

memory/3248-1990-0x00007FFDB71D0000-0x00007FFDB72E9000-memory.dmp

Download

memory/3248-1994-0x00007FFDC2C90000-0x00007FFDC2CB4000-memory.dmp

Download

memory/3248-1992-0x00007FFDB6DA0000-0x00007FFDB6E45000-memory.dmp

Download

memory/3544-2019-0x00007FF7D3110000-0x00007FF7D3544000-memory.dmp

Download

memory/3544-2020-0x00007FFDB6B10000-0x00007FFDB6C29000-memory.dmp

Download

memory/3544-2021-0x00007FFDCBE80000-0x00007FFDCBEB5000-memory.dmp

Download

memory/3544-2022-0x00007FFDB6DA0000-0x00007FFDB6E45000-memory.dmp

Download

memory/3544-2023-0x00007FFDC9ED0000-0x00007FFDC9EE6000-memory.dmp

Download

memory/3544-2024-0x00007FFDC2C90000-0x00007FFDC2CB4000-memory.dmp

Download

memory/4196-2069-0x00007FFDB6B10000-0x00007FFDB6C29000-memory.dmp

Download

memory/4196-2068-0x00007FF7D3110000-0x00007FF7D3544000-memory.dmp

Download

memory/4196-2073-0x00007FFDC2C90000-0x00007FFDC2CB4000-memory.dmp

Download

memory/4196-2072-0x00007FFDC9ED0000-0x00007FFDC9EE6000-memory.dmp

Download

memory/4196-2071-0x00007FFDB6DA0000-0x00007FFDB6E45000-memory.dmp

Download

memory/4196-2070-0x00007FFDCBE80000-0x00007FFDCBEB5000-memory.dmp

Download

memory/4828-1832-0x0000000000AC0000-0x0000000000CB6000-memory.dmp

Download