2d79af8e1ff3465703e1dc73d3ef2182fd269ea2609c8afabdf1b80693405c1d

Analysis

user interaction
yes
max time kernel
119s
max time network
112s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/05/2026, 20:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HorionInjector.exe
Size 147KB
Sample260509-zhdecags2j
SHA256 2d79af8e1ff3465703e1dc73d3ef2182fd269ea2609c8afabdf1b80693405c1d
MD5 6b5b6e625de774e5c285712b7c4a0da7
SHA1 317099aef530afbe3a0c5d6a2743d51e04805267
SHA512 104609adf666588af4e152ec7891cedafd89ad8d427063d03fb42a228babefc59428b0c8b1430cb3fc319a5014d2ee1083ff2b74fa585cab2d86cdad346e8b08
SSDEEP 3072:ckgHqUGSCoEslON/q178+oO3BAE4T/DvueX:cNHqUGSCPBh+7VST/Ke
TLSH
T13DE3E6B0E397D428EC96473D8432BB528A27FD6B5CB0571C541EB13DA9B3316C1ADA0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery spyware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
55	3532	chrome.exe

Executes dropped EXE 2 IoCs

pid	Process
3172	HorionInjector.exe
4756	HorionInjector.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\HorionInjector.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3532	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134228329864562395"	chrome.exe

Modifies registry class 27 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e80922b16d365937a46956b92703aca08af0000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\HorionInjector.exe:Zone.Identifier	chrome.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
380	explorer.exe
5552	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5012	chrome.exe
5012	chrome.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe
3172	HorionInjector.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1848	HorionInjector.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
380	explorer.exe
380	explorer.exe
5552	explorer.exe
5552	explorer.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 5056	5012	chrome.exe	79
PID 5012 wrote to memory of 3532	5012	chrome.exe	80
PID 5012 wrote to memory of 1080	5012	chrome.exe	81
PID 5012 wrote to memory of 1080	5012	chrome.exe	81
PID 5012 wrote to memory of 1208	5012	chrome.exe	82
PID 5012 wrote to memory of 1208	5012	chrome.exe	82
PID 5012 wrote to memory of 5196	5012	chrome.exe	83
PID 5012 wrote to memory of 5196	5012	chrome.exe	83
PID 5012 wrote to memory of 4016	5012	chrome.exe	84
PID 5012 wrote to memory of 4016	5012	chrome.exe	84
PID 5012 wrote to memory of 4052	5012	chrome.exe	85
PID 5012 wrote to memory of 4052	5012	chrome.exe	85
PID 5012 wrote to memory of 2452	5012	chrome.exe	88
PID 5012 wrote to memory of 2452	5012	chrome.exe	88
PID 5012 wrote to memory of 4140	5012	chrome.exe	89
PID 5012 wrote to memory of 5536	5012	chrome.exe	91
PID 5012 wrote to memory of 5536	5012	chrome.exe	91
PID 5012 wrote to memory of 2252	5012	chrome.exe	92
PID 5012 wrote to memory of 2548	5012	chrome.exe	93
PID 5012 wrote to memory of 5348	5012	chrome.exe	94
PID 5012 wrote to memory of 2032	5012	chrome.exe	95
PID 5012 wrote to memory of 2032	5012	chrome.exe	95
PID 5012 wrote to memory of 1884	5012	chrome.exe	96
PID 5012 wrote to memory of 1884	5012	chrome.exe	96
PID 5012 wrote to memory of 4328	5012	chrome.exe	97
PID 5012 wrote to memory of 4328	5012	chrome.exe	97
PID 5012 wrote to memory of 5444	5012	chrome.exe	98
PID 5012 wrote to memory of 5444	5012	chrome.exe	98
PID 5012 wrote to memory of 5072	5012	chrome.exe	99
PID 5012 wrote to memory of 5072	5012	chrome.exe	99
PID 5012 wrote to memory of 1256	5012	chrome.exe	100
PID 5012 wrote to memory of 1256	5012	chrome.exe	100
PID 5012 wrote to memory of 4124	5012	chrome.exe	101
PID 5012 wrote to memory of 4124	5012	chrome.exe	101
PID 5012 wrote to memory of 5016	5012	chrome.exe	102
PID 5012 wrote to memory of 5016	5012	chrome.exe	102
PID 5012 wrote to memory of 3256	5012	chrome.exe	103
PID 3172 wrote to memory of 2012	3172	HorionInjector.exe	106
PID 4756 wrote to memory of 872	4756	HorionInjector.exe	112

C:\Users\Admin\AppData\Local\Temp\HorionInjector.exe
"C:\Users\Admin\AppData\Local\Temp\HorionInjector.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1848

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff7e76c728,0x7fff7e76c734,0x7fff7e76c740
  2⤵
  PID:5056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1904,i,9545317154915053633,12665438095042106378,524288 --field-trial-handle=1664,i,10259212240209517041,3911041332140540681,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2072 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,15051114128268485943,16076868678525314761,262144 --field-trial-handle=1664,i,10259212240209517041,3911041332140540681,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:1080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,4590454671116653147,10565800471452029503,524288 --field-trial-handle=1664,i,10259212240209517041,3911041332140540681,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2388 /prefetch:13
  2⤵
  PID:1208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,2135872517440486914,3838644161091058765,2097152 --field-trial-handle=1664,i,10259212240209517041,3911041332140540681,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3432,i,1555995683113423771,4321644384789537670,2097152 --field-trial-handle=1664,i,10259212240209517041,3911041332140540681,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4172,i,1719211913235775387,8922442700877440799,2097152 --field-trial-handle=1664,i,10259212240209517041,3911041332140540681,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4196 /prefetch:9
  2⤵
  PID:4052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4612,i,14578568995447251923,13716901798708491897,2097152 --field-trial-handle=1664,i,10259212240209517041,3911041332140540681,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,17711236411537016574,15920884277629884148,524288 --field-trial-handle=1664,i,10259212240209517041,3911041332140540681,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:4140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5704,i,266716266133562262,12642386331017493220,2097152 --field-trial-handle=1664,i,10259212240209517041,3911041332140540681,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3840,i,17552913991792489833,600441737683903055,524288 --field-trial-handle=1664,i,10259212240209517041,3911041332140540681,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3528 /prefetch:14
  2⤵
  PID:2252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4528,i,9494160704028476834,5516296273701701167,524288 --field-trial-handle=1664,i,10259212240209517041,3911041332140540681,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3608 /prefetch:14
  2⤵
  PID:2548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3228,i,5149469969779827132,16623931547709112875,524288 --field-trial-handle=1664,i,10259212240209517041,3911041332140540681,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3600 /prefetch:14
  2⤵
  PID:5348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3632,i,15659850188979088679,6250617325654593947,2097152 --field-trial-handle=1664,i,10259212240209517041,3911041332140540681,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4660,i,10789325488455954239,16741204973846537907,2097152 --field-trial-handle=1664,i,10259212240209517041,3911041332140540681,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3444,i,1226196921989907101,1899683227157877835,2097152 --field-trial-handle=1664,i,10259212240209517041,3911041332140540681,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5832,i,4104007843731195260,7055956921311926292,2097152 --field-trial-handle=1664,i,10259212240209517041,3911041332140540681,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:5444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6004,i,6957226190705303114,5675505390673129935,2097152 --field-trial-handle=1664,i,10259212240209517041,3911041332140540681,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6176,i,8792419851077913432,17150943100391774894,2097152 --field-trial-handle=1664,i,10259212240209517041,3911041332140540681,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6340,i,18098760976024608584,1771747305544507774,2097152 --field-trial-handle=1664,i,10259212240209517041,3911041332140540681,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6600,i,10493330825226507442,1066408392148455551,2097152 --field-trial-handle=1664,i,10259212240209517041,3911041332140540681,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6544,i,3044006868188281617,3435330164452498682,524288 --field-trial-handle=1664,i,10259212240209517041,3911041332140540681,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6548 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:3256

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1964

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1740

C:\Users\Admin\Downloads\HorionInjector.exe
"C:\Users\Admin\Downloads\HorionInjector.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Windows\explorer.exe
  explorer.exe shell:appsFolder\Microsoft.MinecraftUWP_8wekyb3d8bbwe!App
  2⤵
  PID:2012

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:380

C:\Users\Admin\Downloads\HorionInjector.exe
"C:\Users\Admin\Downloads\HorionInjector.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\explorer.exe
  explorer.exe shell:appsFolder\Microsoft.MinecraftUWP_8wekyb3d8bbwe!App
  2⤵
  PID:872

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 829e4f7c001849a08366628382fc94ce122515dd640e0aa2cc15942e3905b0ff
MD5 d09f2d2aebbb1c1bee29afabdb04bf6b
SHA1 d7796a8e3da4ec3508c45e73077b348d19f1817b
SHA512 7d279007725ce5025934a688a64533ce44d59c55e61080fc7b8f8bb4eedc1bb5ec9babdbdc20bc296c1975081301bfd0feb1eda5f35a7d1c3adb09d4dcf3f3ad
TLSH
T1B5E0E56AC820DC370CFE0718A0509709EB5113172B80890F7A3D96088FB462B4186C1D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 c68f054136e202a657fa3960e948e3eaa57eb3efe9a93d6f185025ce8512fdd6
MD5 0de394d896c45511019ec4a618593e4a
SHA1 255b473a7ac7ef2ef97d7b40b24832287ee552cb
SHA512 77357c0bb1020d530e6ab0f6c1721ba64ec2e141d860d215bf4819aedfc4d024d98e56883ce15b0b2ca942df4f7ec5e097cd03ae8ce98b251e099d9ce1160872
TLSH
T1E02156CAE8814213EF18DFB187420F182A086A2145205B7F0297B9E970737EC40353D3
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 17KB
SHA256 7aaaa26b619714bace96f645df8c0ebcfdf3772ab466b1440ceab3abe505e058
MD5 2a8baec8cc5fb46bed6775a002bd5cd3
SHA1 ca0d5917ccd125050152a2ff978d4fed69c865af
SHA512 4cbf6d2c439ed3f63de22ec632ab445ec05aadeb61979ee22ee88267f8cd0cc1916b2017a0ea7ea05df3c394e073947617b875e042f443e631ae856db0334889
SSDEEP 384:D5MijovAxPYe+lv6+gJKRG910JaBeVQFSe/JERaIaVa87aiJO3h23NlJ54vcCEKX:Qcb+gvB+wmPoo
TLSH
T12B8292B3C3D4CA6D8A1156F1BA257E1ECD1D092C03683C2AEDD5AF8BA3E5471E24158F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 691B
SHA256 5e2162b63886224d91142e41fb1ca139505cc2c5368bc7d1446d77882adac57c
MD5 7a20741b6cf7146f64358435b2a54710
SHA1 92653c29d6cbf4c172cdefa3a01c5913680ef0e5
SHA512 5bbed1c2a89c45b302dc44f7568cb05746920465b69482d7451a07aef59e0e6e3826f28886aed5346fdf1f12272c694c96316b098fd364e41243a6feb66a4b01
TLSH
T17E017BE7E2B9B86311BD897F7D00B8559E76A43401906CF0CFE6812CB0855E31F16493
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 58d4363d8ce007d00d56ab6f2e3d7584aa482e8117bd8a2b6d4109fbc45c554e
MD5 f3ae74f13fb333ef285768634eed925e
SHA1 609d298aa542462aa6853d790cbae99d71f561cc
SHA512 b424cf706696b46776df06e7674e7b2098d6816dfa150d8cb748bec3ddd57b083934c3838814786d8c25ff18a4b5e45eb06a5f101a1024ffeab9f284b7ab105e
SSDEEP 192:vRjWcBzQerRFSw+/mn/f3xetua4mv7pFhAPRp2bo5H9YHsb+WNnHzT7AM27D2fee:vRymzQerl+b8XVOwnn2n2PMe
TLSH
T12A52F72EB96069BB5CC7C629FA21BB2BE7F1102221D41F84E6FC8A1C15E79CD711741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b8f0daa08ae77bfdc417aa7e9f7baa72ac38e02c9253739a4550a9391ea8a73f
MD5 102096e86a5fa696e987b6824298df05
SHA1 186f6a87d4deaa72e383e785464aab64f9ac3f25
SHA512 450a6aa6c25c10a7a51c268476f68f43d49c7ac3c5bab3a1033c82a5072e2e7c1354afa1f0646950f3c506770fc517c016c5414d80088e20b26b3fab9b529356
SSDEEP 192:vRjuUerRFSw+/mn/f3xetua4hv7pFhAPRp2a9YHsb+WNnzTdsD2feejqVyIsnAU/:vRiUerlNb8XtOwHdy2PG8
TLSH
T15842E72EBA50797B5CCBC629FA21BB57E7F5102221D41E84E6FC8A2C15E79CC611701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 aabc6431d27443d9a209d65da1c7def06ff9b37611671459470521e70c5b47ae
MD5 d09189fcd887f4b7d3ed751e45f553e7
SHA1 c318aab38a9e1c7068c69424a327087cf0d02769
SHA512 f7cec825d93f61d996685c251e31a1a06fecacb3bd55e60ffc5e10828acfc16c807de9043899f55a19f7e3d3881b961c20a60669acbe79baa62cd00523662d31
SSDEEP 192:vRjWcBzUerRFSw+/mn/f3xetua4mv7pFhAPRp2bo5H9YHsb+WNnHzT7AM27D2fee:vRymzUerl+b8XVOwnn2n2PMe
TLSH
T1A252F82EB96069BB5CC7C629FA21BB2BE7F1102221D41F84E6FC8A1C15E79CC711741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 21e81c420f3d017ae32c8b64d4e6d75c94b8234e6b16495dd8068581d8c1d8ae
MD5 00354c26d974dd37c82892cc4543401d
SHA1 998a31960482acf892a8127374d96c3a440e9e8d
SHA512 002a30061d299c004f2cb1f953a686553784e46d60be4a0ead8a5803cc85dda5c5d4c62a1b8c130db4c0b1023316a356061b53cd0cdbc9a204299c12d96f29e7
SSDEEP 384:OEjql7KxkXqKf/pUZNCgVLH2Hfgsl817pLuLcifMtXODql+ErU3HtHGDu9P:OIql7KxkXqKf/pUZNCgVLH2Hfgsi17p+
TLSH
T1BA72FA676C4C9E770F94C9CCD8267E4FADB5024B65DDC86482FA982A03D5ACF110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 23bf1136989356f8747bc860473721044cc3d3a56d33df67b20d352de073db66
MD5 ee346d9c88072d56e3ae747779fa944b
SHA1 e4e5f669f9277438d7796f1a05124754e71b025b
SHA512 d789701aa0e4d1add5e923a21ade0289fbc0e63bd931272788366ceb3ccf9fc2d46c0a18f1430d5d37977ec0d6377b347f0515de5876c2daf15270d567ee205b
TLSH
T13DB01211C0056511C44302B02192048831146F198705170153E06971D82B1A140181B2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587366.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587366.TMP
Size 96B
SHA256 5d4b48f8238d5f2a70cc044f781662e4b35ecb69604cdfd255db69eba16de882
MD5 358ff6b4a9ce121ec1d1a2042b574190
SHA1 45c9ddb685fd263c75abb86cc81c2b196b6e917d
SHA512 fa40af1ded7b5dd50cc1f97f5a21c8cc56acb6d71015946ccb19098abd7b8d98bc9f68d87bdd2a295a74d82fb5e4d3bc8878f26b3e67b9f2a918407eb1c04a2f
TLSH
T114B0220AC2023A22C08203F020C0C0E83030CF22C203032282E00AA2CC2F23382200A2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 6d585c4e1b6b8f8a75a174e371b4ab59b3cfc04f37426465fb9e336d050a8875
MD5 eb846972696683b03ab60ee76b4f8d94
SHA1 47c9384a41300a6bcac8a2507c0cf762748ac0a1
SHA512 b6832b2a6ad1c70dca56fd177aacea94040d544e7c3edc77aae512b6cbd98d2e99362d25ef90c38136b09e11f53e8a1aaca4264d2951150a727f9af5cb994ec8
TLSH
T1AAA0026083564001C142A2B715850F58732D89118115026751B566A4FCE09D48D31801
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 adf558a4fb62c915ee8211e58d2b23f47a8d9826aca086cb111f12f9df8e6f37
MD5 6ad3ad6eee0c7460a4ef0d73e75c6b54
SHA1 429366c3406b89e759ed8e449413b181c594d08f
SHA512 695b8c0bb70c88be0811b3974ff47251dae719c18d920b32ebc991be93167de9b23eafd14e5eda242a584defe5f329390edcbd97b4a7a3470b658651d5904e6b
SSDEEP 6144:qdJxyATKB2qIMkv/LOXD6++JjcMW2VcVLK:U60KB2qIXvjDOMWQ
TLSH
T1BC1422794F1E2C34638ED1FAAA05749C4CE7D687474CA8A81087670E2ADF7526367CC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 6d9f35c2a150f138fb2df903d0f80288e19c77218691491666efc9f4d85bf530
MD5 2f00468233067e92e7a91fae8640bc6a
SHA1 e3dd76158d64e3ca06bc93a4d92e0c3aec40e09a
SHA512 06f98efb5cda5a3d431a132dae6b4844acc4e653c8a649d1f7163303be681399626de001c940c1c24182a00bea5e6658b2a7ee3db00f8248cbfe87d21759fc84
SSDEEP 1536:S+P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNz:b++J3qUQm08KMWF0bFTcVHr6zo
TLSH
T1949312B99D1FBC79635EC69690079CAC4CE39CDD151054BC30C79F1E18BA3A2A30B8E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 b60eeed4e3b5e8d611c161e334f5f367859b1039d11f116cbfbb6622aee725c7
MD5 3bdcde2c0f3988b23b3214032a5ba7b2
SHA1 ef81c967583c5b5df432c5754574ac7ef955fe0f
SHA512 cd1252f453d8e65a56584242d1d7e3f58b0bec2a46440fa446544fd0db75223f37de68639a80b0963ea0041962e16c946c3feb5faa5851df91498c163161648d
SSDEEP 6144:tdJxyATKB2qIMkv/LOXD6++JjcMW2VcVLK:P60KB2qIXvjDOMWQ
TLSH
T1EF1412694F1E2C34638ED1FAAA05789C4CE7D687474CA8A81087670E2ADF7526367CC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 15eaa14888159c0ce85aa9be83696484a2f0b0ce37272bf52797b8539dc5f8c9
MD5 a0c4ea593d4f3945d86c5c7c1f222490
SHA1 1b67e02be5c7d45d77339ba7057c20db373bb576
SHA512 e0685dcff2638aeb554e38560b6604e92cf6920113cdb76a25e399c3f3220a594c64acf3f73d6d1d5518216c39419bfb5fac54b735f91b3c126df0a24d931e9e
SSDEEP 6144:UdJxyATKB2qIMkv/LOXD6++JjcMW2VcVLK:q60KB2qIXvjDOMWQ
TLSH
T1551422694F1E2C34638ED1FAAA05749C4CE7D687474CA8A81087A70E2ADF7526367CC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 3bc0134055c8f14594dbf6bae7b19f9c379575868772025f75a7b52587f481a3
MD5 7bce53b1115bdbad1db5601c07bafe70
SHA1 410f4842d1ff58ab6d4f4d5ac2193ce5663888d7
SHA512 17a112f5f78cf91bf05e21d0ef86103733cf167b8efe4cfa0c0c7a60693bd83cf316acc0c2ff0f82f098b84ce00cde7a5f030b1db99842b032720c516af8148e
SSDEEP 3:MsEllllkEthXllkl2zEkl7ORu:/M/xT02znuu
TLSH
T1E74404447FC00405C500117050F1C3550370D41045137753345354D35CC55400D10341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Horion.dll

Path C:\Users\Admin\AppData\Local\Temp\Horion.dll
Size 3.3MB
SHA256 9945bc975e1fa8ed460ea0e8f0f93255bab5a4f41e8c127b2631d2b66e675901
MD5 d4c70e991ce98f1d010da6c573817e7b
SHA1 992645432b90e8a9b08a75abbb865d479ef3f64b
SHA512 8619c03f2ab999d07cd2a74b6d55153c32912ad6e004b9dbc16b2178bca0541800009c1c6451b9d2d81bae734c8d963e7fe9d823614a77db9fb9fde82e239774
SSDEEP 49152:nS90IlDoTwfUyjOqly/gAXfPw7thEqYri++TZBLjEyyk1B5dY1nfw9rfoY2viZkd:G9Mri++znABDuVS
TLSH
T16BF58D36759503BDD2B1C0798D8A1D62E970780D03526ADB06F1D6AB6FBB3E8057E0E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HorionInjector.exe

Path C:\Users\Admin\Downloads\HorionInjector.exe
Size 147KB
SHA256 2d79af8e1ff3465703e1dc73d3ef2182fd269ea2609c8afabdf1b80693405c1d
MD5 6b5b6e625de774e5c285712b7c4a0da7
SHA1 317099aef530afbe3a0c5d6a2743d51e04805267
SHA512 104609adf666588af4e152ec7891cedafd89ad8d427063d03fb42a228babefc59428b0c8b1430cb3fc319a5014d2ee1083ff2b74fa585cab2d86cdad346e8b08
SSDEEP 3072:ckgHqUGSCoEslON/q178+oO3BAE4T/DvueX:cNHqUGSCPBh+7VST/Ke
TLSH
T13DE3E6B0E397D428EC96473D8432BB528A27FD6B5CB0571C541EB13DA9B3316C1ADA0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HorionInjector.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\HorionInjector.exe:Zone.Identifier
Size 120B
SHA256 6daaace1c451f36b21339d5709aaf2bdf0d17d9690c788f061924bb14f12f6b5
MD5 2e74e2a76462d44a4ea64a0b5e36f1fb
SHA1 b8bf7fc44a55dc14a2753596087ddff9f1dbc4c5
SHA512 59ce43a88e3ec53233ff811428c41fa0c515a1457e5384ba0235c22492e37c13d5572caa5610e1d2a5655ab0de1d5bae88e2d6319002dd986712556dd0fa1135
TLSH
T1E4B092AB4410C8001B8126C007DE924CE42B288A4FA74A48E864809ABC609A483E3923
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1848-5-0x000002805CA90000-0x000002805CAA0000-memory.dmp

Download

memory/1848-0-0x0000028042440000-0x0000028042468000-memory.dmp

Download

memory/1848-3-0x000002805CA90000-0x000002805CAA0000-memory.dmp

Download

memory/1848-2-0x000002805CC60000-0x000002805CD1A000-memory.dmp

Download

memory/1848-1-0x000002805CA90000-0x000002805CAA0000-memory.dmp

Download

memory/1848-6-0x0000028042870000-0x000002804287C000-memory.dmp

Download

memory/1848-7-0x000002805CC10000-0x000002805CC22000-memory.dmp

Download

memory/1848-4-0x000002805CA90000-0x000002805CAA0000-memory.dmp

Download

memory/3172-386-0x0000017868350000-0x0000017868358000-memory.dmp

Download

memory/3172-388-0x000001786C340000-0x000001786C34E000-memory.dmp

Download

memory/3172-395-0x000001784DF10000-0x000001784DF1C000-memory.dmp

Download

memory/3172-396-0x00000178682A0000-0x00000178682B2000-memory.dmp

Download

memory/3172-387-0x000001786CE50000-0x000001786CE88000-memory.dmp

Download

memory/4756-410-0x000001B071310000-0x000001B071322000-memory.dmp

Download

memory/4756-409-0x000001B06EF70000-0x000001B06EF7C000-memory.dmp

Download