118622de99fbefa7112f30504a884fb1647ec0877628c6f847c4edf437932584

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 22:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
horizonFixed/cracked/82594f5ec0be4e56b1d797495996600f_Engine.exe
Size 6.0MB
Sample260705-2ghzjsf151
SHA256 118622de99fbefa7112f30504a884fb1647ec0877628c6f847c4edf437932584
MD5 0b8b11ef489d607a844871e46d756410
SHA1 b0841a007ed494bc5d2538246470a2f79f1be7db
SHA512 8fa439afd33db44f36024a3df6ed7b5060708ed4da74e8c6a6c48cf4fdec4dd618552cff373c9990b773ca2a60ef099a92eb5280df152ff7e45fa7967f1efe59
SSDEEP 49152:qGtlqbIU6iRrVwASOTLqKFhQWCboZC7HNFMLBql4vSDaqH2wveHqV51r3bBxYQiE:v+JLqBD/e6NBlLuWbXnxJtWTQ1Un
TLSH
T17F56BE69A9BC00D5E87A967AC28A5337D771BD1417B007CF2794ABE60F23AD01E7B740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
6500	msedge.exe

Drops file in Windows directory 30 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6500_1667200848\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6500_410409723\Mu\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6500_410409723\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6500_410409723\Mu\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6500_410409723\Sigma\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6500_410409723\Sigma\Fingerprinting	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6500_410409723\Mu\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6500_410409723\Sigma\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6500_1667200848\safety_tips.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6500_410409723\Mu\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6500_410409723\Mu\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6500_410409723\Sigma\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6500_1874991560\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6500_1874991560\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6500_410409723\Mu\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6500_410409723\Mu\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6500_410409723\Sigma\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6500_410409723\Sigma\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6500_1667200848\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6500_410409723\Mu\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6500_410409723\Sigma\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6500_410409723\Mu\CompatExceptions	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6500_410409723\Mu\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6500_410409723\Mu\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6500_410409723\Sigma\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6500_1667200848\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6500_410409723\Mu\TransparentAdvertisers	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6500_410409723\Sigma\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6500_410409723\Sigma\Staging	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4400	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277644103072110"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2900715619-172032027-1873877232-1000\{3865D941-DB01-4213-8E88-611A6A87FB2D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
6876	msedge.exe
6876	msedge.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe
716	82594f5ec0be4e56b1d797495996600f_Engine.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
6500	msedge.exe
6500	msedge.exe
6500	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6500	msedge.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 716 wrote to memory of 6500	716	82594f5ec0be4e56b1d797495996600f_Engine.exe	90
PID 6500 wrote to memory of 6712	6500	msedge.exe	91
PID 6500 wrote to memory of 4764	6500	msedge.exe	93
PID 6500 wrote to memory of 4400	6500	msedge.exe	94
PID 6500 wrote to memory of 4764	6500	msedge.exe	93
PID 6500 wrote to memory of 4764	6500	msedge.exe	93
PID 6500 wrote to memory of 7024	6500	msedge.exe	95
PID 6500 wrote to memory of 7024	6500	msedge.exe	95
PID 6500 wrote to memory of 4404	6500	msedge.exe	96
PID 6500 wrote to memory of 3876	6500	msedge.exe	97
PID 6500 wrote to memory of 4404	6500	msedge.exe	96
PID 6500 wrote to memory of 4404	6500	msedge.exe	96
PID 6500 wrote to memory of 3876	6500	msedge.exe	97
PID 6500 wrote to memory of 3876	6500	msedge.exe	97
PID 6500 wrote to memory of 5212	6500	msedge.exe	99
PID 6500 wrote to memory of 4120	6500	msedge.exe	98
PID 6500 wrote to memory of 5212	6500	msedge.exe	99
PID 6500 wrote to memory of 4120	6500	msedge.exe	98
PID 6500 wrote to memory of 5480	6500	msedge.exe	101
PID 6500 wrote to memory of 1148	6500	msedge.exe	105
PID 6500 wrote to memory of 6716	6500	msedge.exe	106
PID 6500 wrote to memory of 6088	6500	msedge.exe	107
PID 6500 wrote to memory of 3564	6500	msedge.exe	108
PID 6500 wrote to memory of 3564	6500	msedge.exe	108
PID 6500 wrote to memory of 3600	6500	msedge.exe	111
PID 6500 wrote to memory of 3600	6500	msedge.exe	111
PID 6500 wrote to memory of 4064	6500	msedge.exe	112
PID 6500 wrote to memory of 4064	6500	msedge.exe	112
PID 6500 wrote to memory of 6876	6500	msedge.exe	113
PID 6500 wrote to memory of 4396	6500	msedge.exe	114
PID 6500 wrote to memory of 4396	6500	msedge.exe	114

C:\Users\Admin\AppData\Local\Temp\horizonFixed\cracked\82594f5ec0be4e56b1d797495996600f_Engine.exe
"C:\Users\Admin\AppData\Local\Temp\horizonFixed\cracked\82594f5ec0be4e56b1d797495996600f_Engine.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://horizon.boltgroup.dev/loader-auth?link=3abb36634cc7028e15a951bc3c819992
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7fffcc29c188,0x7fffcc29c194,0x7fffcc29c1a0
    3⤵
    PID:6712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,16537238403844727577,5496165407281575678,262144 --field-trial-handle=2380,i,8833130348695715653,14866520420657982883,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:2
    3⤵
    PID:4764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,6464609820431768998,15734873311045049627,524288 --field-trial-handle=2380,i,8833130348695715653,14866520420657982883,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,10833295434655546612,14285896380904269938,524288 --field-trial-handle=2380,i,8833130348695715653,14866520420657982883,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:13
    3⤵
    PID:7024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,4338763676707569177,14377944825628184318,2097152 --field-trial-handle=2380,i,8833130348695715653,14866520420657982883,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:4404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,8808063717840521907,3087014435000177545,2097152 --field-trial-handle=2380,i,8833130348695715653,14866520420657982883,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:3876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,18202445091838033785,7226777568956426882,524288 --field-trial-handle=2380,i,8833130348695715653,14866520420657982883,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
    3⤵
    PID:4120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,11057888841520955673,3630002111236364450,524288 --field-trial-handle=2380,i,8833130348695715653,14866520420657982883,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
    3⤵
    PID:5212
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,12449145346121894582,7558880644768537890,524288 --field-trial-handle=2380,i,8833130348695715653,14866520420657982883,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
    3⤵
    PID:7060
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,12449145346121894582,7558880644768537890,524288 --field-trial-handle=2380,i,8833130348695715653,14866520420657982883,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
    3⤵
    PID:5480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,13125621099581488773,8499927058355804698,524288 --field-trial-handle=2380,i,8833130348695715653,14866520420657982883,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
    3⤵
    PID:1148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,2613720864658952843,15799301601581422917,524288 --field-trial-handle=2380,i,8833130348695715653,14866520420657982883,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
    3⤵
    PID:6716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,4954201130746685243,2534341141813560676,524288 --field-trial-handle=2380,i,8833130348695715653,14866520420657982883,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
    3⤵
    PID:6088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,4761270043875805385,3631640309680103343,524288 --field-trial-handle=2380,i,8833130348695715653,14866520420657982883,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
    3⤵
    PID:3564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,14006685308408436870,16346036206877732313,524288 --field-trial-handle=2380,i,8833130348695715653,14866520420657982883,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
    3⤵
    PID:3600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,3809536970952670197,18282976750898461139,524288 --field-trial-handle=2380,i,8833130348695715653,14866520420657982883,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
    3⤵
    PID:4064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6504,i,11179899659829548626,18294920560131869047,262144 --field-trial-handle=2380,i,8833130348695715653,14866520420657982883,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,586581085016585979,15387745616548307701,524288 --field-trial-handle=2380,i,8833130348695715653,14866520420657982883,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
    3⤵
    PID:4396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b363f693690aa479b03b10f13d837c7277e1cd8d6c10d7150235a6d4eee0f34
MD5 ddf8b13fdf9db751ce6cc3328e266fa7
SHA1 1cd0cf7ab6698157c24338d81d076859d18cfba7
SHA512 e7b35b46a0f47d516568817a1f6db4f2445e353959197912eea8a7ab8f6a257b9bc5ba855ad99faa8b859e7ac8c3141a43c223c051fe9bd656f75b6384e18fc8
TLSH
T1E8D08CF0BB297982D26534B2B5229711B2B140AA3A2BD6D1A4A0C50C8C3B8D9A786183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da3763f60ede3fa709aa0345487a9c5f026859c06ed1a1549de777571c438d2d
MD5 2ebd0330bb082497ebc47348c4ecee38
SHA1 f164cfe0a87fae91d8a0b0b31f0178ebf3aadd02
SHA512 294595e3213375937c97fffd24323394a2b90fd0b46d24771fcf9359e2edbe425b26aefe714432eaccd7516ab0d793eaa33eb35fa55b9df13c535af5d9da8f67
TLSH
T1FFD080F0B7197582D5653471B521971171B1409D391BD5D19090850C4C778D55745187
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3838e0c9b97b740997025cc20f9894a4fb2fc1d09513fd3de779b19d7f969df9
MD5 339ab2331fb3aae4a95fd88c7e816532
SHA1 6574ff6ed98e60945fa77f8a7d8ad1edb5290a0d
SHA512 5703e993048ce770ae38db5cd87e9d20ad636253535d52856c3755705dc6df3c453a6d3e0d99cf03becd2767b8b650787c5242fb56cd30f29d5089d3da98f0d9
TLSH
T14DE02BEAC961EC3B08FC0F2C74924749EB50132B2B41494F3B3C920C4FB5276819187C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 bdc942fc04cf6c236a690f04d7d23cb94f4bbfbfa3d66d73873531400313ae70
MD5 40c10f01917d61a7fb215681cfa68cbc
SHA1 e2e955369811f05d91ec7f4ae74d60d4f76c7a07
SHA512 919c0aa4de6a2ab67d10d99d7d334440977ce44481c5b1f00ada9ea647779adc8e96f2a7c81509b9c880215adbc8f75a4be36d3a5ff8e0e97eb30a2b4cd19e80
TLSH
T16571E8259F1D798ECBB700B052D33199FF788495C9CB6E21C06B92B55C4BF2874433A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d608.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d608.TMP
Size 3KB
SHA256 7cfe40a90c51420739d699bdf1aba9434e31707330710ab4829404350eb03091
MD5 a0bd66d8b99d4b1de50361619bcc4a31
SHA1 92e62d3dad88851d3d7bfd444f818fb3ce787f44
SHA512 c8d398f7e1c1b317bd9a036f65591d7ffdc1cf15994ac292eb69e4db401584ae0ab0bdf4c7fbe84f500e38b137b6461db34a1f1ea0ccd8527141f5aa94bb274c
TLSH
T10D61B3155F2D399ECB7B05B052D370A5FF7880A5C6CB6E11C46BA2759C4BF68B4833A0
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0312012a9aea03033fce87c36dd060eead156473edbd9866e4a6d283cd57c93e
MD5 3a31933a2f92c45ed38be9bfd35d222d
SHA1 a9838906f30bedc596e85b163fa1086b02cba903
SHA512 4d231fa89d244bb562f7e53baf3e840d42d494c9977ef0c21f2b6c160defc4a05c00707bf2bb5bd3edeb18dee421670b8c68203fa6209d0f5c15dccbd0459539
TLSH
T1C251AEF3C2E4856D990196F0AB18AE2FCE1D0515832C3D5AC9E4EE5793E3471E142A4F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 197458881bd5cd6243da3f762bad3132ea82f2fb7f4162a5d91693d60617819f
MD5 4763c9b65e67348e48827629405c7605
SHA1 baaa17693ff953e0da98df1deec4fbb70c4bc28e
SHA512 ee0ff8a491345d18d1898b980a2382896da0e4fcac99aece33de83e8dcaa3912a6cf3ce4bc38bb41e3b43e0b8994f119790bbb072fd34f7393498ff646f11ed4
SSDEEP 192:sxRiRiyMqZjK1Ml8wcX/fzs6MV2pZsGJlsJ7zoA8pHj/g6+WNvwkW/YmGIGEIgj2:sxRiTCX/fzsnMnsGr4aD/5vi/Fj2
TLSH
T1D872E91A6538593BCCD7D219FA857B63C6F81573A2805F44AAFC8A0C05E76ED221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 c178fee9d715acb8894bd2a44174a0ab9e4caeb36974ff57ad5770e92902141d
MD5 a98fd65e706eaa76d5c8b1d314faa49a
SHA1 c2bc6c6d0a5cdeab731ebd9f253d3b3ed52b41cb
SHA512 f4d35f5f9633299401e70787e5d8839dee52576c93753235820c143904138d0bacd3fcfe8985372ebc46b0947f90a991991312e20e193ef036a30449e588f345
SSDEEP 192:sxRiRiyMqZjK1Ml8UQ0cX/fzsYMVsbpZsGJlsJ7zoA8pHj/g6+WNvwkW/Ym8IGEf:sxRiTqTX/fzs1ybnsGr4aD/5vi/XBik
TLSH
T19172E81A6938593BCCD7D219FA857B63D6F81563A2805F44AAFC8A0C05E76DD321383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 610112e3e4b830d3f5bc40a45edfe74f63fc4b5a5e9f8897be7061fb108387de
MD5 a6c525d2c5f15f4b342e524ae51d44fd
SHA1 153dd13955223c8b97e61e3dff69bf0552c5f368
SHA512 3a7eeac101c5f3f9a3be9854b5d735d3b27129a647b665a328e36fefe834e4794edb33f09b3f64c72affefd4adc2957d31ca1045cb055bd058564e88660b1f74
SSDEEP 768:RGqO3j7pLuL7yrWgzvfiX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVju7z9wQroPwhV:RGqO3VE7yrWgzvfiXu1jawu7pw7PwhV
TLSH
T1EBE2EC3B680CCB7E4F804A9CEC29BE9B6DA802CF56D8895447EE844C03C76FB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 c88477a12cff84d04749607b760def944a9fcc98e2055e2ed55a2a181930c52d
MD5 90c3a0b303ef1ce698e8e0aa74afc52b
SHA1 d5c78eafddcf3e39d0406d28a338f01a6926d9c9
SHA512 64ad6d91da31f7a0f767e0f37b9f254101a334dbb1247fa69399c6d161be06d2a858d0524897d219e5532729d87e7b13f623c48d08b3a4d57caf02ade97fbafd
SSDEEP 384:9TqfDxl5UVY3bXp3ZUzD4BzSc7eCUG2XatW6AE3k18UFa20TWaseefCFeSo83Mtt:aR55IlHnOLRXxxinNcM
TLSH
T1ACB2805071BA2B00387D290993BDD42F194630A230DEA87B7B6835E56F67E005FFDAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

df301c23-bc73-4f4c-b639-65210018a9e1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\df301c23-bc73-4f4c-b639-65210018a9e1.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
Size 83KB
SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
MD5 956f610121cd5827fd5549097b79cd9f
SHA1 dbd23f99895a3a92fbe04c3c35d475a6f6998fd0
SHA512 3cc4712f64474497495d229ddd743c6bf25c30c3fbfca2525f46227d99a59a0f9e80e2119ffb40bc8a707b539f65f907e2e1565ea937e0387db47cf7269944e6
SSDEEP 1536:sNGnmI1FOxAdgxBf8paY3JQzQik428fKagFVbydki8yyafuzWk:sNG91FPgrfrPza428fIenya2Sk
TLSH
T16D83F180DF58411BF86F4835E0B269857A78E6B50FE092DF2376C9590E12FD1AF39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 ff60900a5f973ab41602f1e337f06a5f3f4d95c55d1ef64a9f6d7ba88e667546
MD5 dbc6b4959492a3fdf93df9f2a1f8150c
SHA1 276451d01d813307ebfa2f9d8520be3da47698c0
SHA512 201c7f6b09c0171af65066ef293c83c7092b43c07b84225d7a1e686b190932b7dbc0b1717ffa3a4215a22bbc6ef60c2fe15cdf6ba04eebf1f71f652c2a4679c8
SSDEEP 384:npiF1tNn/s3n9Sa8N68TUNTUlIRVznNUXhZX+fo11FIEt5VyxgDcOObjI9G6w7WG:AF1j+9XHwgQhH1DXymc29MF
TLSH
T122E2C3F198D78A76D8AE4B97A37E2D469EFCD163B4885984B7C85D0CCC831BFC206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 43961fc26b8c0f9269d16b09b59b32ab8f1a1cfd728689184da6a00612563306
MD5 d74b49c7d2e63d2a4ea311bb90269665
SHA1 7bfe97cbf2033b1217d1e4c9e1d081f7ec538f47
SHA512 04d1302cb892d7fde0000b2618c2a0a85d04f992925d1388baf4ee20b2cda024d7aee010878e3609709d8ec732f2d573781880f52952500cb235e1e390dd32f4
SSDEEP 384:ndiF1tNn/s3n9SZ8N68TUNTUlIRVznNUJZX+fo11FIEt5VyxgvcOObjI9G6w7WhU:UF1j+9kHwgGH1DXyIc29MF
TLSH
T148C25A72EC55CE77ECE68BD9B74A3A46EEE011A7848C5DC8EAC85E4D05831EE0307C19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 474885303c20d3e637ddeaeab48f94d35903f26fef528a440bc37b90b68dd272
MD5 03442298097146f93107ff5bff77a55a
SHA1 3690a670e05d1172c0ff4d2137af3f8ebed4b49a
SHA512 4c9f5f5c3de65ebc2ae01008a97f4d1e49d808ebd3bbd1ba419d44f2783e64d1e1a914ada5c6608eb286ac201fd3237aff3d6c9734571250d9982872bcdbc286
SSDEEP 384:n1iF1tNn/s3n9SsD8NJ68TUNTUlIRY1znNVvHX+fo11FIEt5Vwgmn15wbAjEJ2io:8F1j+9RJwgmt1DXwgmn12bfJ2j
TLSH
T143C24936DC64CA7BEDE38FC9B70A7606EEE412A7819859D4DAD84E4D01C72DD0307D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f2aa753f6e81c20de804d94bccd541e80799483075aa7f791ab0eea7d4eeb406
MD5 0a09ea32f90d64d689b42f7cd5d25492
SHA1 0400f509de659937d26eb2ae2320729abe704370
SHA512 3a5a215323821f4fb00b9fc5f4817ca4d55fced8b6021e3fd2cedb740a6f5ea302e59dfcb7917c8ef952dfd61e956185f996dee2214d3a0f2e9a5e7a9745d670
SSDEEP 384:nRiF1tNn/s3n9SZ8N68TUNTUlIRVznN1JZX+fo11FIEt5VyxgxcOObjI9G6w7WhU:4F1j+9kHwghH1DXy4c29MF
TLSH
T1E3C26A72EC55CE77DCE68BD9B74A3A46EEE011A3848C5DC8EAC85E4D05831EE0307C19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 31fa46e668eb5a51efc7119707121f6695527135642ebd9485d154ad34d35691
MD5 9744276a02022a745cfab5c62928a249
SHA1 539b79b6a5977ac2d3def75f0f7bed9576531288
SHA512 529ced3a918e704fc2148e5d4be7e0d870b00e552f404544db843aec3a34d1a66caafecc6be343653d49d8f198cc6f75c69107094b39b45fa849f3dbbb42f440
TLSH
T1A22142E19C3929D1D47E0DEFB04B25FC94E8C316F49434386858ED98567A15E224087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 f98f9248cb9b2f8a67ac7f3d2435bde85a2efed72e75ee8190f189967a285fa3
MD5 0ed090c9176e255cf182c37bac18f945
SHA1 09db6ea1b477ad27db9d334484f40524a49eb4a8
SHA512 a19912217b926290e521153330ff0e0c09b02dd06f331ec32be1081b521d42a664a990eb3be82400389ee4c2efc96a08c1ff0dfda261cf1f2407a75628449a08
TLSH
T1982114E19C2929C2D47E0DEF644729EC94E89316F4D434386898ED94567D21D268087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 1edb301c73064d13c15c9b58cb5da13876589b93217a8e19095b600839b1144b
MD5 c7e677e9279489252b0c9637852fe066
SHA1 1d8a7d4e215ec032a80103feb2a1ca785351654b
SHA512 30f82f3c0b3ed74ee9f4ad20ab072d85678492d0862bf3d650e607bc80c5ec4383692d35840dca5fba7cfb4e5bec3ea22bb830c6a8d99ea6cf9691093d0567b5
TLSH
T15C3141E19C3929C2C4BE0DAF744B39FC94E8D326F59470386888EE58523A65E224087F
MD5 SHA1 SHA512 TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6500_410409723\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download