discordrat | hxxps://www[.]mediafire[.]com/file/ko3rvsvd8e6snij/horion-antikick[.]zip/file

Analysis

max time kernel
1170s
max time network
1174s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
29/03/2025, 08:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/ko3rvsvd8e6snij/horion-antikick.zip/file

Score

10^/10

discordrat discovery persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTM1NTQ1MzUwNTA3ODQzMTg0NA.G7a2Y0.C1kz3tq4Niv0TEc-eatWAXKH_DFZbqGjF1FsD4
server_id
1355454078355898368

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
290	discord.com
432	discord.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_869875226\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_869875226\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\json\i18n-ec\cs\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\json\i18n-ec\th\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\json\i18n-tokenized-card\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\Notification\notification_fast.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\wallet-webui-227.bb2c3c84778e2589775f.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_869875226\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_869875226\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_1954080946\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\json\i18n-notification\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\json\i18n-notification-shared\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\wallet.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_869875226\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_170674211\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_1013828050\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\load-hub-i18n.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\Notification\notification_fast.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_869875226\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_869875226\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_1317677069\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\json\i18n-notification-shared\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\Wallet-BuyNow\wallet-buynow.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_869875226\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_869875226\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_869875226\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\json\i18n-hub\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\json\i18n-notification\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\json\i18n-notification-shared\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\json\i18n-ec\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\json\i18n-tokenized-card\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\Wallet-Checkout\load-ec-deps.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_742383592\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\Tokenized-Card\tokenized-card.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\json\i18n-ec\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\json\i18n-ec\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\json\i18n-ec\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\json\i18n-mobile-hub\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\json\i18n-mobile-hub\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\json\i18n-notification-shared\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\json\wallet\wallet-checkout-eligible-sites.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\vendor.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_869875226\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_869875226\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\json\i18n-notification\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\Wallet-Checkout\app-setup.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_869875226\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_869875226\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\json\i18n-ec\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\json\i18n-ec\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\Notification\notification.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_869875226\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_1317677069\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_746043207\shopping.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_869875226\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_869875226\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_170674211\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_746043207\product_page.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\json\i18n-mobile-hub\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\json\i18n-tokenized-card\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\json\i18n-tokenized-card\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\shopping_iframe_driver.js	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133877109508835116"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2873637269-1458872900-2373203793-1000\{D9DCA5B8-F725-44C2-8AFB-0BCB16894F59}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\horion-antikick.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3416	msedge.exe
3416	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1656	horion-antikick.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 3796	2416	msedge.exe	81
PID 2416 wrote to memory of 3796	2416	msedge.exe	81
PID 2416 wrote to memory of 4980	2416	msedge.exe	82
PID 2416 wrote to memory of 4980	2416	msedge.exe	82
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 4340	2416	msedge.exe	83
PID 2416 wrote to memory of 3744	2416	msedge.exe	84
PID 2416 wrote to memory of 3744	2416	msedge.exe	84
PID 2416 wrote to memory of 3744	2416	msedge.exe	84
PID 2416 wrote to memory of 3744	2416	msedge.exe	84
PID 2416 wrote to memory of 3744	2416	msedge.exe	84
PID 2416 wrote to memory of 3744	2416	msedge.exe	84
PID 2416 wrote to memory of 3744	2416	msedge.exe	84
PID 2416 wrote to memory of 3744	2416	msedge.exe	84
PID 2416 wrote to memory of 3744	2416	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.mediafire.com/file/ko3rvsvd8e6snij/horion-antikick.zip/file
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x25c,0x7ff9037ff208,0x7ff9037ff214,0x7ff9037ff220
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1756,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:11
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2232,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2296,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:13
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3452,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3460,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4972,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=5140,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5332,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=5296,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5304,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5848,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6220,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
  2⤵
  PID:5420
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6308,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=6284,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=6216,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:1
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=6808,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=6508,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=7348,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=7456 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=7448,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=7488 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7792,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=7800 /prefetch:14
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=7320,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=7820 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8120,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=8132 /prefetch:14
  2⤵
  - NTFS ADS
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=7748,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=8232 /prefetch:1
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8220,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:14
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8220,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:14
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5936,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7664,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=7876 /prefetch:14
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --field-trial-handle=7532,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=7460 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8684,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=8576 /prefetch:14
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8688,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=8200 /prefetch:14
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7104,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=8668 /prefetch:14
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5648,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7560,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=7948 /prefetch:14
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7924,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:14
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=8356,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7420,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=7484 /prefetch:14
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7272,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:14
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5704,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5756,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7864,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3560,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1028,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:14
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5924,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=8720 /prefetch:14
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8672,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5700,i,4476511498418906493,17279736675336905499,262144 --variations-seed-version --mojo-platform-channel-handle=7768 /prefetch:14
  2⤵
  PID:668

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:5412

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5312

C:\Users\Admin\AppData\Local\Temp\Temp1_horion-antikick.zip\horion-antikick.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_horion-antikick.zip\horion-antikick.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
8272581d8cb38484cc8cb6afbdd0d37e

SHA1
2baa96a0439003aabaad1ce5619ea0a581cf261a

SHA256
025356bf819ea8a5da44ac2c4510bc380a9448247a30665577430ca7a44ca297

SHA512
60574186c595b0018d9223afd38e59378b1b00ef4f39be17ef2d7613cdac5b8f9e6dc3f2efefd559a0e4e8d64884d6ea155e874df13f170bb6dfbb41a0104959

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
d89428ca1e88081319df89934e011260

SHA1
8d5223c8a3f5ede82f2034a65891c39071114b9a

SHA256
9789d3575c738a4a23d5de751eb21db2647a8f7c1c3cc66c400f1ea2b5230cdb

SHA512
8a1d8a4c312cb85afe805d2b73c9212717de27d2ae2de2c41a3dda0cf8dea82aec6de31679d8b0d3899abbd22e3baf3613450796f0869bdbd5ef6cbbcafa54fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000007.log

Filesize
21KB

MD5
6b3365d1dd47d79c4949f7a5aac638b5

SHA1
5667e92d1337870654ca5fbce211c5ab537042a3

SHA256
f65822fd25899d1a03a5f582b90ff34d3f1854cec8bd33ef976f556137317ee4

SHA512
2ff613fb302cc0dc56c0f798fc9d6637e04035113849cfcddb9f55ea1132ae31a26447800c8776870ca145875fe7fa8e2b3df31b5bfdbce0b7cbe6c663b2fab0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Filesize
334B

MD5
39e355c0230b10b4c87e0ec4e976dab0

SHA1
9240f7c29007c38479a8a63cd55cdb83d02313b5

SHA256
1a276a43fd66186a652b2f8a2b5a8626bca061f64d3209431bc6a1507dbab83b

SHA512
3ed7382ee1c16e312e8681a2c40b256ffd4d419e001f4971cc840f63986711765e183c6835ca1bde0687e056680d17047f0f017ce3ee5a62354d7f6382b7221b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Filesize
352B

MD5
31f10494cb595e94b9abd07061d7c7e9

SHA1
445d3b80222006193f1047654fbf00b9794eb6e4

SHA256
1e9f7e25887bc06a047565ac69f3504840c018376b1e539ee9a6974bb177e289

SHA512
b8a1b7cd19f1f557ff113456f9621c3e14a79711e49d7f9d8425996cdec69563ff6d3e9f41ecb964eab304aac5bde2a210405407e01f7477134e4c412bd77d80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Filesize
268B

MD5
ae52241cbffb1512930b58c8f22337a1

SHA1
6d563b44bfc56bcd0cde64a36c255f68743f67ba

SHA256
a71ba1d58219c864cca7fe8763a5ea3fbdadaa4696aae3510da0b62c7b1182bc

SHA512
3155628adde16553809f89865c52fbad832f9eb05db45fa134b6e6d8fda44d4be3ee67fdd1ad7491a670e0ecdaa5023f9ffd9177904df7673be8283c0aa4f955

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
7e9b09aba606413c120cd427e43000fc

SHA1
b987065f778ea5df9486e8bc6108e65410ad887d

SHA256
920d5de4ef7900fbfe24c711ba6309ea36f27a625d9c3b39f13d026dc67c7e2f

SHA512
b76f3c328099acc36a56a5a23dee348b197021a3de81624bbfd21c52bdfe4722f4a1db0c024f5c2de0e68bed85265d225c60282f8e6af4dd576b9603f4428a1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
4e5c36cf6e2db3386f1cefa1e81e65dd

SHA1
b9f3b50bdfa24b376eb13773eeed916948e1d0fc

SHA256
8b69eff16033504ca430889d6f4cc31136d90471322ed9d0163aba65a3930c37

SHA512
1fc81e81dfcbb8c9acd7656652ef1afe1885d059694b04bd75c9681f220b59e93a6d6bd6ebf65f24608c546be7d3b7f9437886921b7bc65215b1e759684cbb87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
cee08e4072a23b0c74243f2a2cef7a35

SHA1
2023b332c47c090fc840cffff497a5a3fe33ddd9

SHA256
ec130ff3a0765d481c4df7732ade391ff75bfe3a325db5c5a62e696c26772670

SHA512
fe2a3c5c1388fc846fba0bbecda5cf90faa22ebc95b1f65f0211902e41768face3604fea3180295cf62b4cff8aff9261c3ba3313fad46d4ef6703209f624c3af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57e7b0.TMP

Filesize
3KB

MD5
4e6f073ab55268a8a75c596e3a777ff1

SHA1
4619bc9c567b2af1fd534320afcc0f96019806c6

SHA256
936417d47be85f8b112e2d903d4c8041688b0277494443abf07e2172ec88d332

SHA512
eb84bad91cec4bec28e5c1b315ccc0fe34ee7ee2ad2705f2daa7cf12045243b2d305eec98c80a5d24d5feaa036d7c3b64252e10e6229d839dbdc359b368f3e5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
21KB

MD5
56d1198c14720987fdfded807c80c2af

SHA1
85bb5364168ee7c694e7c4b15548dc5f724ecbff

SHA256
8b5b2f5e83d8aff5a2153d2a533a39b9b250e4f9c01cff3206041cdedb0cd321

SHA512
edb6708c46b4b95172da56075070f9e2687c8e3e9f9a56b7286c124c95d48786aba4b1ac0c70ce062481e66ff8406dc273c9cd3dfdcab24515688c68329395d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
21KB

MD5
30aacfa74ec06d90dddbc433b7d3571b

SHA1
103ba195682d1f77ff889ad066c24aabc70de914

SHA256
e96f03ebc04cf5026f7860f1b08a8a67733be1278dc0c1af274950b0a6b0a191

SHA512
2770e5eca1c14c4518d52c59ad5aaf2ce16e7680ff280b398e7f806107910416577f235fb1aba2a5d0b6903a651ba8246b6ab5a65b17f2e055c5e5e67b2402e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
22KB

MD5
2022847973698b0373c36979fec37aa6

SHA1
352f70fa8b045bd79101b49f94730c3113ae0b6f

SHA256
6fde608bda0b4456a6e221993751b127de6235349d9518e9ae3fd0e73e8b0667

SHA512
851074686b38ce616d88a213b684d7bc3fdb25c22314cca91e0f0d9faf29834b84d7dce15788ad3955a7dbc2854367a0ad422a3478ffa37061130fe03a0b63a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
23KB

MD5
6006d97df30af7031e01236ee9d4fa31

SHA1
148057bc7c209d260d8478c02e94a6fb069270a4

SHA256
2a1a5b182f8284eeec1c93ffc6e1ac289314c6369e380868b082359a3399ce7f

SHA512
148e742e9fd668e21d237adcfb80d565ee5ef638cb429f1a41a75d608e29c4ab4454daf9fc8101182f4617daa36956fe4c95c99f6f7f66eb85be17a1afe1387c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
98c56978ba976bb36eedf15cd65227ac

SHA1
5efa0c611f5d45e8692cbd42648c0836321b06e8

SHA256
8c908624507441f2c41e510479c25d3d4d2c5b3b158ed9b819c49321ab2e9316

SHA512
5cc5e4e382e780148779dbe5cb61079821ea57c0a0eb992d1278aca2abae723926010ff6a76743cc3ac2d38018c991153f754770b48c75e10e4fff5a2a74e36b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\28dacc6d-8082-4aba-9cb9-067408b474cf\index-dir\the-real-index

Filesize
1KB

MD5
775d8c99d4f93203d35c8ec65aaee7c4

SHA1
b78d2a1fa3e95411297c9e2deb0304a431a5eb91

SHA256
da0a6d09d2228fbbd3c19cf014bfc12524201bccba86f5fef57534a53f7b7a50

SHA512
4413dade20965488d64ed64202531b1d35b93ec66bf610ae6c83a59ab9b2f65f89afe06b296f19f51916c600dab916c3ed67f92a53b13338cfeb153d63ab2f15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\28dacc6d-8082-4aba-9cb9-067408b474cf\index-dir\the-real-index~RFe5bf931.TMP

Filesize
1KB

MD5
35ea5f1c4e0a9c7edeaa16b815896520

SHA1
bc3e6fe8ce4b6f505d51361c03dc548237084750

SHA256
35f57b756cd34fc3fcf408443128a6f9581bce24a4ee694fdf608552561e392a

SHA512
dc0d7802f9c63edea85aaf9002d053a3858f1ba00f005dd772244304530217d648b4629f89a5012f93b4073839c1ebd8dcd0f4547a6982293d380afe996c8a83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
253B

MD5
6b50aa5aa8b9fc16e71fe096c244df3c

SHA1
48ffbbc1b031e26152fe2491b92aaf4dbf7dccd1

SHA256
fe0db5b34a81c70e7c83255db33b9fc2160c8dda43aa398b4a51dc8d92a59baa

SHA512
1887249fa6332b16c7aef52376a640d5b3ecb669202177d6394719cd71a28069e007ce00ed7792180c4ae6d9a2ecda9cf42cce6012bd0c9d235d6d2bc1688c36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
bd09c11403e7ff78bfc2166e3a91e3de

SHA1
709f24f9d4cde86bb795f166c5f1b5602204d4cd

SHA256
c12de3890b70e8c443a6755cc8dbe109bfa517bb5d8b87948ba011dc76b91596

SHA512
976956b893c3bf9b23d2d37eafd472be62fccafb319267e91577e56a8c2c5efe5d4aa5385fbe9580ab58d81667761dd9d40b0623e50b57c88bb3f373ccb4fd7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
c3a124fe773e2aba0531cb988d34e186

SHA1
ef4abd548d942b2d550112e3f4608e85ab9b7349

SHA256
21315247fb7d543b3ef4859ffd163503b0c9f690ecf3cfe4fe1d7eae2eceec64

SHA512
847d10bce2a372200100e2b1e76bac0fd8d472a3200ed2650d64b16d2b62e9ec3deeab4f073583c8882f2d707136b0060b434a9eba338ea344e408b43b31e862

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
a84a5706d89d9feeb5d428f0807acee0

SHA1
e4a4c4c1db56ed9a263be920cdfee7f8cfab7d0f

SHA256
b573cb5ac572963eb818f8ccbea3d89a89e02f39f20d8940dfd8b16723aee016

SHA512
e276adb26a97392737860370d626d6732d1560d29f5f7a0fb1ad9e2ae0373e811c43db99bc74a9a39bb38ebe23658a145500190ab8a11e4e7b1b21fba6cebf6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
575d1957d435ea1d3f7e361072ded81c

SHA1
df70899b6845a7e35906b9e75ab961f8391f2af0

SHA256
5d0dd3257ff2ba238e846491e54d1253806ab2efbcb5e00eef1e7769a5e10bc1

SHA512
9367ca8f02c5e5b4fcc32029246011814a4d8f433eef061578be80830b8e581420ad4c79fe12fd33f8435a834575c2446cc8d3aa7352ebbccecdaf2ae4c077b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.1.31.0\edge_checkout_page_validator.js

Filesize
1.1MB

MD5
0e3ea2aa2bc4484c8aebb7e348d8e680

SHA1
55f802e1a00a6988236882ae02f455648ab54114

SHA256
25ffb085e470aa7214bf40777794de05bf2bb53254244a4c3a3025f40ce4cef7

SHA512
45b31d42be032766f5c275568723a170bb6bbf522f123a5fdc47e0c6f76933d2d3e14487668e772488847096c5e6a1f33920f1ee97bc586319a9005bacd65428

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18346.18345.1\json\wallet\wallet-checkout-eligible-sites.json

Filesize
23KB

MD5
16d41ebc643fd34addf3704a3be1acdd

SHA1
b7fadc8afa56fbf4026b8c176112632c63be58a0

SHA256
b962497993e2cd24039474bc84be430f8f6e6ab0f52010e90351dc3ff259336c

SHA512
8d58aa30613a2376ccc729278d166a9b3ec87eca95544b9dec1ee9300e7dd987326ea42d05dca3f1cc08186685f2fdaf53c24fd2b756c1ed9f2b46436689dc74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18346.18345.1\json\wallet\wallet-notification-config.json

Filesize
804B

MD5
4cdefd9eb040c2755db20aa8ea5ee8f7

SHA1
f649fcd1c12c26fb90906c4c2ec0a9127af275f4

SHA256
bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd

SHA512
7e23b91eab88c472eec664f7254c5513fc5de78e2e0151b0bcc86c3cd0bf2cb5d8bb0345d27afdd9f8fcb10be96feaa753f09e301fa92b8d76f4300600577209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18346.18345.1\json\wallet\wallet-stable.json

Filesize
81KB

MD5
2e7d07dadfdac9adcabe5600fe21e3be

SHA1
d4601f65c6aa995132f4fce7b3854add5e7996a7

SHA256
56090563e8867339f38c025eafb152ffe40b9cfa53f2560c6f8d455511a2346a

SHA512
5cd1c818253e75cc02fccec46aeb34aeff95ea202aa48d4de527f4558c00e69e4cfd74d5cacfcf1bcd705fe6ff5287a74612ee69b5cc75f9428acfbdb4010593

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18346.18345.1\json\wallet\wallet-tokenization-config.json

Filesize
34KB

MD5
ae3bd0f89f8a8cdeb1ea6eea1636cbdd

SHA1
1801bc211e260ba8f8099727ea820ecf636c684a

SHA256
0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d

SHA512
69aff97091813d9d400bb332426c36e6b133a4b571b521e8fb6ad1a2b8124a3c5da8f3a9c52b8840152cf7adbd2ac653102aa2210632aa64b129cf7704d5b4fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
33e355ccc630070c705e8935a720091d

SHA1
0bfddad572113e9af4578253c36e06a5e6aa7365

SHA256
0bc345e5e96cf641a5a0f851a9db6559cf4f7712e8202bc677236a12960647cd

SHA512
857d2ef45faa983f55d60ef953961d822571cb329d875cf46e457c616badace52f6544236b5db603dae198918327f2f9d70a33d4a43150e4ba8665fd862271ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
d249eca7acfd5aaa0c80b873c9ba0b09

SHA1
ebab11c6286d537ff76156ae81846e1b5f620b54

SHA256
f8f72e6b064266b536390a6e7915db6c06d2999ddea42f423ae8922d4696d714

SHA512
9b65bcc39f4dac9c598f90a887bff2479fd8ce7c91ef714c07aa55838b085e2052866ab0b5076afd4df8b3d29e408200b74442f5e7e091082d064c65f5ef75c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
4361ed9a512969cf6e2491a5b9d01df6

SHA1
8a5a6916500a56961baecdca7a9e6c9fc18bdf74

SHA256
09851343b8a57f9c8b863ed23c1d5edcd6baa41b7d9682973a8bfda336e63ee0

SHA512
582d70da75026db74b21edc2cc4c63cf55868c3144944fdfeced1d75bef343f0e86ad57b0ea3f9c98c144873fd9ecba38900f2886eff9f1c251569f099305361

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
688cfabf906a793c04f6c09cc4005f96

SHA1
c04f551678c56067ed094a7eedf6f4c5f90df293

SHA256
ad6f88192dd056ce56d3533bb5a0a2f0d991980cd8b45c4e57fff57605c51ddc

SHA512
73386310fc72dcc72a7811267b30232a170435a21a343051ef47c724e3213b1edafe67528e320fb3fe0748f77142e1729657a64f43ca70817105cb289a2c9e18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\Downloads\horion-antikick.zip

Filesize
28KB

MD5
b3ba81c9381b107079434d30f60a1ee2

SHA1
755533529d02360f19a8344432615b1eb4e17fc3

SHA256
31e10033c76f33fe1dad2fa22b07e162c5c5587a128bc2ae2a85f25e8ce9e124

SHA512
edcbda86c336aa9af8cf58f9c8dc4d998bb3a0f456c479623d7d2adaae75cd417e4539e7ce7a42a6189d995c8f500c715caa4500335c81ec7e3ba7d744b482da

Download Submit
C:\Users\Admin\Downloads\horion-antikick.zip:Zone.Identifier

Filesize
66B

MD5
91a932dcd7bffe18428528359af8f18f

SHA1
bee30924f7cdee4b6332c7e53726c14e0e5acf36

SHA256
467b8610308d08ee1a4d30fd9ed93e238352b3020d19a8417c51df22eed98b3e

SHA512
0f2e141a64a55088b078d789159fde7bf407ebcd5583528a380cde89f573b104c29045dc1dd923fff562e4bbf1f710443a2ba5d617292cbd625030bcab074fc2

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_1731983595\manifest.json

Filesize
1003B

MD5
578c9dbc62724b9d481ec9484a347b37

SHA1
a6f5a3884fd37b7f04f93147f9498c11ed5c2c2d

SHA256
005a2386e5da2e6a5975f1180fe9b325da57c61c0b4f1b853b8bcf66ec98f0a0

SHA512
2060eb35fb0015926915f603c8e1742b448a21c5a794f9ec2bebd04e170184c60a31cee0682f4fd48b65cff6ade70befd77ba0446cc42d6fe1de68d93b8ea640

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_742383592\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_742383592\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_742383592\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_746043207\manifest.json

Filesize
145B

MD5
465cc76a28cc5543a0d845a8e8dd58fa

SHA1
adbe272f254fd8b218fcc7c8da716072ea29d8ba

SHA256
e75fb1fa1692e9720166872afe6d015e4f99d4e8725463e950889a55c4c35bb9

SHA512
a00286cd50d908883a48f675d6291881ad8809dcae5aca55d5d581e6d93a66058e1fe9e626852bf16e5bb0c693a088a69d9876ccac288181b1f74254bf1da1a2

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\Notification\notification_fast.bundle.js.LICENSE.txt

Filesize
551B

MD5
7bf61e84e614585030a26b0b148f4d79

SHA1
c4ffbc5c6aa599e578d3f5524a59a99228eea400

SHA256
38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179

SHA512
ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt

Filesize
1KB

MD5
8595bdd96ab7d24cc60eb749ce1b8b82

SHA1
3b612cc3d05e372c5ac91124f3756bbf099b378d

SHA256
363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831

SHA512
555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\json\i18n-tokenized-card\fr-CA\strings.json

Filesize
2KB

MD5
cd247582beb274ca64f720aa588ffbc0

SHA1
4aaeef0905e67b490d4a9508ed5d4a406263ed9c

SHA256
c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5

SHA512
bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_847602668\manifest.json

Filesize
121B

MD5
16f004af39a3675a73f5c15f6182a293

SHA1
e7027edbadfd881e03d8a592ae661a985fd89cd7

SHA256
4e5ef1851bc910ceeb59a63bb53725cf5d8149feff9483e960b54cc26fdc419b

SHA512
8ef0d80259b5a38424676918f07238a76c527b643267008999dc3b2cff5c93e29ae85cbf0605f0d0b4f880fd6ae96254ebd30e5b80097eea95f5d27b5d461ff6

Download Submit
memory/1656-698-0x000001AC76D80000-0x000001AC76D98000-memory.dmp

Filesize
96KB

Download
memory/1656-699-0x000001AC793F0000-0x000001AC795B2000-memory.dmp

Filesize
1.8MB

Download
memory/1656-700-0x000001AC79CF0000-0x000001AC7A218000-memory.dmp

Filesize
5.2MB

Download