hxxps://cdn[.]discordapp[.]com/attachments/1227501429699383317/1227511242629976064/HorionInjector[.]exe?ex=6628abee&is=661636ee&hm=a05b9fd30ff8bc69280dfdd7139a9480056f1a82546924ca1c67ab2db9ba6945&

Analysis

max time kernel
130s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 08:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1227501429699383317/1227511242629976064/HorionInjector.exe?ex=6628abee&is=661636ee&hm=a05b9fd30ff8bc69280dfdd7139a9480056f1a82546924ca1c67ab2db9ba6945&

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
1072	HorionInjector.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies registry class 48 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616209"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616193"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Rev = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\NavBar = 000000000000000000000000000000008b000000870000003153505305d5cdd59c2e1b10939708002b2cf9ae6b0000005a000000007b00360044003800420042003300440033002d0039004400380037002d0034004100390031002d0041004200350036002d003400460033003000430046004600450046004500390046007d005f0057006900640074006800000013000000cc0000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	explorer.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 426955.crdownload:SmartScreen	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4404	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4088	msedge.exe
4088	msedge.exe
4240	msedge.exe
4240	msedge.exe
3228	identity_helper.exe
3228	identity_helper.exe
4496	msedge.exe
4496	msedge.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe
1072	HorionInjector.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4404	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1072	HorionInjector.exe
Token: SeDebugPrivilege	4536	firefox.exe
Token: SeDebugPrivilege	4536	firefox.exe
Token: 33	3416	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3416	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
1072	HorionInjector.exe
4536	firefox.exe
4536	firefox.exe
4536	firefox.exe
4536	firefox.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4536	firefox.exe
4536	firefox.exe
4536	firefox.exe

Suspicious use of SetWindowsHookEx 28 IoCs

pid	Process
4404	explorer.exe
4404	explorer.exe
4404	explorer.exe
4404	explorer.exe
4404	explorer.exe
4404	explorer.exe
4404	explorer.exe
4404	explorer.exe
4404	explorer.exe
4404	explorer.exe
4404	explorer.exe
4404	explorer.exe
4404	explorer.exe
4404	explorer.exe
4404	explorer.exe
4404	explorer.exe
4404	explorer.exe
4404	explorer.exe
4404	explorer.exe
4404	explorer.exe
4404	explorer.exe
4404	explorer.exe
4404	explorer.exe
4404	explorer.exe
4404	explorer.exe
4404	explorer.exe
4404	explorer.exe
4536	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 3928	4240	msedge.exe	85
PID 4240 wrote to memory of 3928	4240	msedge.exe	85
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 1744	4240	msedge.exe	87
PID 4240 wrote to memory of 4088	4240	msedge.exe	88
PID 4240 wrote to memory of 4088	4240	msedge.exe	88
PID 4240 wrote to memory of 1480	4240	msedge.exe	89
PID 4240 wrote to memory of 1480	4240	msedge.exe	89
PID 4240 wrote to memory of 1480	4240	msedge.exe	89
PID 4240 wrote to memory of 1480	4240	msedge.exe	89
PID 4240 wrote to memory of 1480	4240	msedge.exe	89
PID 4240 wrote to memory of 1480	4240	msedge.exe	89
PID 4240 wrote to memory of 1480	4240	msedge.exe	89
PID 4240 wrote to memory of 1480	4240	msedge.exe	89
PID 4240 wrote to memory of 1480	4240	msedge.exe	89
PID 4240 wrote to memory of 1480	4240	msedge.exe	89
PID 4240 wrote to memory of 1480	4240	msedge.exe	89
PID 4240 wrote to memory of 1480	4240	msedge.exe	89
PID 4240 wrote to memory of 1480	4240	msedge.exe	89
PID 4240 wrote to memory of 1480	4240	msedge.exe	89
PID 4240 wrote to memory of 1480	4240	msedge.exe	89
PID 4240 wrote to memory of 1480	4240	msedge.exe	89
PID 4240 wrote to memory of 1480	4240	msedge.exe	89
PID 4240 wrote to memory of 1480	4240	msedge.exe	89
PID 4240 wrote to memory of 1480	4240	msedge.exe	89
PID 4240 wrote to memory of 1480	4240	msedge.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1227501429699383317/1227511242629976064/HorionInjector.exe?ex=6628abee&is=661636ee&hm=a05b9fd30ff8bc69280dfdd7139a9480056f1a82546924ca1c67ab2db9ba6945&
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc8b6046f8,0x7ffc8b604708,0x7ffc8b604718
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,5148372540225823837,11416401892234388637,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,5148372540225823837,11416401892234388637,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,5148372540225823837,11416401892234388637,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5148372540225823837,11416401892234388637,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5148372540225823837,11416401892234388637,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,5148372540225823837,11416401892234388637,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,5148372540225823837,11416401892234388637,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5148372540225823837,11416401892234388637,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,5148372540225823837,11416401892234388637,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2116,5148372540225823837,11416401892234388637,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,5148372540225823837,11416401892234388637,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4496
- C:\Users\Admin\Downloads\HorionInjector.exe
  "C:\Users\Admin\Downloads\HorionInjector.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1072
- - C:\Windows\explorer.exe
    explorer.exe shell:appsFolder\Microsoft.MinecraftUWP_8wekyb3d8bbwe!App
    3⤵
    PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5148372540225823837,11416401892234388637,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5148372540225823837,11416401892234388637,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5148372540225823837,11416401892234388637,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5148372540225823837,11416401892234388637,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,5148372540225823837,11416401892234388637,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6092 /prefetch:2
  2⤵
  PID:6104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4524

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault00722c7ahc235h4fe6h8191h243ed7d7cd82
1⤵
PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffc8b6046f8,0x7ffc8b604708,0x7ffc8b604718
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1452,8110025834265357056,2172633510257716730,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  PID:3968

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:924
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.0.1017307590\220882612" -parentBuildID 20221007134813 -prefsHandle 1884 -prefMapHandle 1856 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0cfce0b6-0726-47c7-971d-9bd29c0024a5} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 1964 24bf6ad6558 gpu
    3⤵
    PID:4704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.1.60713126\1343580852" -parentBuildID 20221007134813 -prefsHandle 2352 -prefMapHandle 2340 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6d57d249-881e-4e51-80e2-f8ff421c8ae3} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 2364 24bf69fb758 socket
    3⤵
    PID:3624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.2.389206672\2042810425" -childID 1 -isForBrowser -prefsHandle 3448 -prefMapHandle 3444 -prefsLen 20823 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed05ce32-02a5-4146-8d52-c5f8d166a864} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 3460 24bfabc6e58 tab
    3⤵
    PID:5392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.3.326992025\430752694" -childID 2 -isForBrowser -prefsHandle 3040 -prefMapHandle 3656 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {25520db3-f7e6-474c-8b15-6ecc2bd15827} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 3272 24bf9394058 tab
    3⤵
    PID:5520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.4.321717986\690387315" -childID 3 -isForBrowser -prefsHandle 4556 -prefMapHandle 4552 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c19d8564-528f-46ff-81dc-f916e61e6e2d} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 4568 24bfca09358 tab
    3⤵
    PID:5892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.5.485168067\157710515" -childID 4 -isForBrowser -prefsHandle 2832 -prefMapHandle 4552 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7edeee8e-bde3-4dbf-ae22-d599fa043bb7} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 4768 24bfb1a8d58 tab
    3⤵
    PID:5320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.6.479251855\1570765926" -childID 5 -isForBrowser -prefsHandle 5172 -prefMapHandle 5176 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8093b7b0-22bf-45d7-a559-b3882230ecf6} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 5164 24bfd01fe58 tab
    3⤵
    PID:5328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.7.1362681524\2118457010" -childID 6 -isForBrowser -prefsHandle 5364 -prefMapHandle 5368 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dce0caa0-77dc-4ccb-9a36-b0b5e1f3c0ad} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 5356 24bfd021058 tab
    3⤵
    PID:5336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.8.478369806\176615420" -childID 7 -isForBrowser -prefsHandle 5900 -prefMapHandle 5896 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9299cd5a-0066-4416-9ca1-46f680968270} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 5912 24bfed18a58 tab
    3⤵
    PID:5200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.9.921309709\1967221206" -parentBuildID 20221007134813 -prefsHandle 5424 -prefMapHandle 3680 -prefsLen 26381 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0b49c46-a930-4a35-9ce6-b4571adf2e8b} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 5888 24bfa037f58 rdd
    3⤵
    PID:5176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.10.167544638\846463347" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 5188 -prefMapHandle 6112 -prefsLen 26381 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b6491b7-d522-43ab-8f6f-1d00b6ded15d} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 6060 24bfcdbab58 utility
    3⤵
    PID:6092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4536.11.1594237198\1387409074" -childID 8 -isForBrowser -prefsHandle 5084 -prefMapHandle 5080 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {429c377c-2e5f-4ac6-b7e4-c2d0b7668bb3} 4536 "\\.\pipe\gecko-crash-server-pipe.4536" 5184 24bfcdbdb58 tab
    3⤵
    PID:2640

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f0 0x40c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c6136bc98a5aedca2ea3004e9fbe67d

SHA1
74318d997f4c9c351eef86d040bc9b085ce1ad4f

SHA256
50c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2

SHA512
2d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1879a3c0dcd9c75af3d3411dc371a58e

SHA1
67fee215a7c45b96078a8735a530cd61802cd4ef

SHA256
11a874635cf0b077409543bea684dfbafb9925025ec5c59d1f07c28b48313a37

SHA512
34130eb237d56de0733f66a1f0991b6e4ea53221c0ee5f9e406dd87506cd863ef729c6776bc9f2f79eba1611d7cf4bb45e7d022e137b41c50d2f039bdd0f7ab8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c6aef82e50d05ffc0cf52a6c6d69c91

SHA1
c203efe5b45b0630fee7bd364fe7d63b769e2351

SHA256
d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32

SHA512
77ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
094ab275342c45551894b7940ae9ad0d

SHA1
2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

SHA256
ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

SHA512
19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0523c6c4c8079bfe81199819c47085b9

SHA1
a012d8d59a8b62fafa2ff849063a699748557cf1

SHA256
1944ed63cf4fc5c6d043bb4b8770638c3370bd3260fe299c7e14486d26385608

SHA512
9988ae4d542c3f07cc1992a6ef8cd48621f40c155b721394e5bbd3896385332d62929824cde5dc9f843dff1bec4a2fe95164da27ba45b4f4554a2a7411383013

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
818ceb5ef7de585ed483b79d03697754

SHA1
ab7de861fa55676dede3ec7faa9eab5e23091c22

SHA256
6f73123fe9347bf56d1b3d8a5289d4b1e978359e41954e2388daf9dc99085d77

SHA512
79f9c39f60d7481406c07a2047c97ad6a789ac45731d4eef3a008b2808f7c0d6b34c7239a233144e4ad6cb3f5aed1e18be87389215e882b12106ee3b49ce3807

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
75d197803516495658891fad8fb0030f

SHA1
392a6c615bb3608038cfa250dd3a7ee2dcee4bd8

SHA256
458b03561fa4553af5802a3b6fe00ba1d93acc4ebe9bac7139f78970d9a2b9c9

SHA512
d56ec606f76457a09207d99e1488805a422a82409994060107827e436f30b45cb5179daf55a8519cd8cb860af1818a78c763b4a52c70a58386b0abd67029bc09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
bf523f01bf26e6b17e9a3a9912b56ec8

SHA1
38dd1a93977e7f99af84cf5132b393bf6f854645

SHA256
3c4b5751c680f0c7e20e6a15afbbb4f3cca8e44520b7ccd15c20337117db5f1e

SHA512
633f786c463b34ae4a2e51dcaa8539aa8721b87f0f130c8449bb7a5ef370b530b2faf0269ca90651c9641753f09e597c5c671510d5bb5ea0491210cfbf74608f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
4330ae409d546bc32134a2a92c3ba21d

SHA1
8f1c62f4d2531a012882bd1b15a034890f036acc

SHA256
ac7a87846ebdaaa1bdfbdb7c944bc573bd9fca66c4438ea3905d8ee4883ec63c

SHA512
464c353288a1b8505132e13e6d2478c6671cec82b711f63606018258afe1556d510f7ad38f6e525b8483ae5c7e2a869af33d289bb1fd09b7f8052112e15f0b66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
d5324fc96ad7b2ee8a7ad2d7b7b8608b

SHA1
7a948cf6d2d0d92d821174e744a869e707909a1b

SHA256
40b8dd6cb3f4dc3aa9e922ac8b217e40c0782070197fe5604d8ff40727d61204

SHA512
a924f874e41739bd1234164e9d1c5b9a1cfccdf098e105e4271c87f863f84da233aa764107752d34a61eb692194b981293c3c7edca972706957001b67b51a5f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
b129f08464cbeafb74626911b617c13b

SHA1
249c9b6e33bc74f40cab26fb97236b7021219a82

SHA256
0e395195c86d6c5c6555bfe31a8946fa15a5fc4f464b394348aafc352c86a505

SHA512
c616b7496125886edc8b2ee3994b4cb0cffef679e2e79978b2461f298d3ff0386715adf778876f70349a732ce3e8ad93f1968d30545f36b61fd685714ee5ba9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
589464551409111f2f1572b9bdc05f8b

SHA1
9564cb6abc23ade40d0a36125e4b364da5dfd273

SHA256
e3559c500e75b1e5f215268b7f342b74dc65f7d7cf39f07e6fd1fc1900d4816c

SHA512
4a3a00534ff228517a8412a0037891ad13da220193658ec86ec0467353a27a441edbb6dc89d2e18f56e7b4a3576f77793050b1b124fb021aca9ce38411bc426a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
18595141c23be201d1ce8696afdaadb2

SHA1
5adde40905d043cc3f4ae6663b81a01564046fb4

SHA256
7cb063e4056f1827091c5a2945c4ea2e2ac194e20118f80d445d147c7d15755c

SHA512
5792ec3110ce4a60a0796240df00e1eb34ce571d090489721068b16b208f26e5f922f8ad6321508249ac5aec9903da72163abddd271776c6c25918488879411a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\cache2\entries\25ABFFBD3350464574206F51A623A118CF97575F

Filesize
17KB

MD5
7e081d194f04a19bb8d93c001a4136bb

SHA1
132f2f1a07b303580280bdbaa78ecc72032484bd

SHA256
dc0bad38c69abbb05d8ab0a1f5d347d5a24de402c36c4ec8a7ee00ec8092d5b3

SHA512
30a056d0f0712991b5c4cf991b1e6eb779821a8f2561d0397525100b46e064031a2bf5db7b52366c55d78e12f00fcd5741a6e846f37ec3cbbc1a56b9b516923d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\cache2\entries\CEAA45F9786010FB50033008C8BB7D7980F713C9

Filesize
14KB

MD5
d4d61c96bdf63101341494952e8e78ed

SHA1
0aa50c4785f48990cc737ff48877fa771d7263f7

SHA256
ed140caa71412de1139f426ed6a19e4e3a91b858a1f2f7eb7c1906120860d9a0

SHA512
f5f31d882952a9d03ae7f88e44d7f755f58fc5b836cb61efe005c2bce0e6682c49957550cf76020f33110d5433813a02b82d7a39c30561f7b4f201c90da4110c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\thumbnails\6721e571b8c8b5954a42198af9f1d571.png

Filesize
8KB

MD5
6119fba93fbbeb4e2d67523d51156654

SHA1
b986de937c33fd5b0c78a66359505e024695153a

SHA256
21403b301b8f2316e0c352316f1fea444948913e0950b294dd42e004b5fbb1c6

SHA512
bf6f07f3ef2ba5472bbd10f1ea8303dd57e900f6efe9b6325c3eea69c654bdeba5ec467bf05c6833fe88f669b0aa7fffe5772491f9a8abaf790db09f6729042a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
c35b74f4df0005185818e6deb74d2758

SHA1
1999f9d701aed64ec15d343e3235bea8056d0093

SHA256
720ea2fca878e47989f48266a4f789ff281a4a84ad9474bfe813bf7bbb754e82

SHA512
2e00b8c40c7b23f2a2c1020cafb4c33f26f14300d63308d11290060e06d0451f67302ee5403902098deca4a56855d9962fc8b8bb1ac51c7f7a33988fa2d55961

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\datareporting\glean\pending_pings\5fa7547a-4bb2-4075-b66b-8040ace1da1e

Filesize
12KB

MD5
46e03cef9d66b0a730bfea274293ba3f

SHA1
f419c8e11341bde1321315cfa65842cf2a0fcf65

SHA256
3a9e2bac94e54f4c76009989a28f04cd6940608de1b2383e415e90312bcc672f

SHA512
fe2875e77c572d5f253ac5d85e642192f0028528ab0bdeb82377c826711844f57ed73df6406d8bfe2b58c1feeb5f55c3c7d8fd9f51cb2762cb18fed7bf0a3166

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\datareporting\glean\pending_pings\b190ce87-c20f-487b-a1a0-488ffbb66ebe

Filesize
746B

MD5
2fe1a4c7131e59960a0f3b13ca23b3bd

SHA1
25cfefcc85bbe810c3482bae4155967ca2718ab5

SHA256
ceb05263ac35504b722b4e66f09a3604b48a5a68cfcc7154f4d0d7598871bf78

SHA512
9a2315aadfa906f5b4832e26e2a6bee7a9b9c9b24c6fa1546490ecc80c7fba571a096843b1c4f1d1aecc9e972af2e363c55b799c7022d95cff2d81ee9c9857bc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\prefs-1.js

Filesize
6KB

MD5
5c8fba69b93920dd20e806036b9daef3

SHA1
257bba36ac6e967836cdd5c035c812784ef35f92

SHA256
6d7bd24894e9b1d924f33dd9b240cf1056e59f7672f3e0d658eacd325882aefb

SHA512
fffb07e209f1d0311df551d7f271308bbde83f7388c89c58b1471619e0dec36d85c1d762210fa37486597451f692c77dad3278419533a17656350dd7ee111da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\prefs-1.js

Filesize
6KB

MD5
eff5bba9b28db765176e8bbea0e2ef49

SHA1
b957827266ebc6a2c808f2e4daad65f5ef3b2894

SHA256
74c6a5a3b0ad792e52eb9ab19fc047ab0a71191852f61b27d03d111d33bc4933

SHA512
9384e8da93976a05e38d76eb1225a7cb357432cda73c1076efa3e8cde4b7949dd1d7f4a598eb95d4112d905a734407be7889ddaf3d44cec5bb7c5dffb5a5fcc9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
6e5bc1cc554528a2916c7b0b59a83855

SHA1
1604c95dc74e0748eb4c4a02b7a8c16faf2c6c10

SHA256
ff863fea24aa6ae638010fb1b3116fec75a22f673cd85924532ffcdf624d35f5

SHA512
866f4fcebed6bb650c456d7b09e65a29bfd72b0ba64d2a38b12fb05e2153ff9f95d9884a85421e7d4184e6077f63e9477a123e6f438444c654720940ef64db17

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
273fa4f0c406e5a1903500b7cf1897f4

SHA1
a3731af842fa0b300f489e6ddde17382891d2734

SHA256
33045e6764d9843812ddeadfea14f163bf99d20b800fa8f1e7c1dc04bd61aa18

SHA512
f4ee760eb2a930196c959c7261c795f67d14e6b1894f61f97f1ef45a992e50782da130e5694b5bd240d95b9846ee42196daac978bbe2b27d87e20808ebd9dc94

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
1cccd886874058c1c614a279695461c7

SHA1
e8de52078a9cd1ecbca011033c1fba4502d71ccc

SHA256
f137855dbb7e39d214ab8f9562dbced1e815f9215390ecae91006ef3cb5c438a

SHA512
e38b250ac00767e1c39a53ce4df00a68b891e1a176cad97e99f9a009fcfabb3a40c4082affbf4cc1ca0da084ddcda886f3da46108acb961d095fc4f777eb1c05

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
adbc341164c19b2446b7575cb3396418

SHA1
a3d46c8712d325c3c188bc77020611bd3e0d4260

SHA256
55e81b8986fef1f49e2c585f74e27c5d9f0513fd97d559df6c3fa3bed899fdd6

SHA512
7beebc72dd9850a20ff91f87c4db58705dc529c787d3bdeceedc2626324905410b0a27774a2ec4f2fab3fa135dfa384d3afebd990fd8211ee06f83ccead401a9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
176KB

MD5
6d4608ee13c33645b0331b17154af3a2

SHA1
0ade0ca874072ade9760bcc9f0a8bddbc2ee01f0

SHA256
94307e878e66e6cb30e30a9af2573f760289cb3f06a212f00748e4998b5682fa

SHA512
c40aa53d40b9b0179b5754baa7254e20517e1576866e1e129539a8eb1a94d798970ad514eba6f24dcf91c12633f09ccd506d7a108468ebe4769f76bfa49c00ed

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 426955.crdownload

Filesize
147KB

MD5
6b5b6e625de774e5c285712b7c4a0da7

SHA1
317099aef530afbe3a0c5d6a2743d51e04805267

SHA256
2d79af8e1ff3465703e1dc73d3ef2182fd269ea2609c8afabdf1b80693405c1d

SHA512
104609adf666588af4e152ec7891cedafd89ad8d427063d03fb42a228babefc59428b0c8b1430cb3fc319a5014d2ee1083ff2b74fa585cab2d86cdad346e8b08

Download Submit
memory/1072-103-0x00007FFC785E0000-0x00007FFC790A1000-memory.dmp

Filesize
10.8MB

Download
memory/1072-100-0x00007FFC785E0000-0x00007FFC790A1000-memory.dmp

Filesize
10.8MB

Download
memory/1072-77-0x00000203DF8F0000-0x00000203DF8FE000-memory.dmp

Filesize
56KB

Download
memory/1072-76-0x00000203DF920000-0x00000203DF958000-memory.dmp

Filesize
224KB

Download
memory/1072-75-0x00000203C1400000-0x00000203C1410000-memory.dmp

Filesize
64KB

Download
memory/1072-74-0x00000203DF400000-0x00000203DF408000-memory.dmp

Filesize
32KB

Download
memory/1072-73-0x00000203C1400000-0x00000203C1410000-memory.dmp

Filesize
64KB

Download
memory/1072-72-0x00000203DB5B0000-0x00000203DB66A000-memory.dmp

Filesize
744KB

Download
memory/1072-71-0x00000203C1400000-0x00000203C1410000-memory.dmp

Filesize
64KB

Download
memory/1072-70-0x00007FFC785E0000-0x00007FFC790A1000-memory.dmp

Filesize
10.8MB

Download
memory/1072-69-0x00000203C1030000-0x00000203C1058000-memory.dmp

Filesize
160KB

Download