468f23cfef27e659fda7842961ee04b80110722449da0b6d40aef2dab89be5ee

Analysis

user interaction
yes
max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 22:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
horizonFixed/uncracked/82594f5ec0be4e56b1d797495996600f_Engine.exe
Size 6.0MB
Sample260705-2ghzjsf151
SHA256 468f23cfef27e659fda7842961ee04b80110722449da0b6d40aef2dab89be5ee
MD5 ed435d4181e045170a179860f305e90a
SHA1 f3bfaa0d522dbc281a8e46275a21b643d2b01571
SHA512 97d3a0d0f9ae39e9396814ad7e0e542d8199a21bd5287506bb36c33ee992292f9df47751ce31c6a8a551de46f93370a9433c245fe451c77c7b9aec7af618b984
SSDEEP 49152:qGtlqbIU6iRrVwASOTLqKRhQWCboZC7HNFMLBql4vSDaqH2wveHqV51r3bBxYQiE:v+JLqFD/e6NBlLuWbXnxJtWTQ1Un
TLSH
T1D356BE69A9BC00D5E87A967AC28A5337D771BD1417B007CF2794ABE60F23AD01E7B740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_720400202\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_1837109333\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_1837109333\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_1837109333\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_1837109333\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_714807511\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_950340145\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_950340145\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_720400202\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5804	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277644110711349"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1086369643-1618123105-2567081378-1000\{3624959E-C858-4D36-9CA3-DADD0A023D5C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3416	msedge.exe
3416	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4332	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 4332	3432	82594f5ec0be4e56b1d797495996600f_Engine.exe	89
PID 4332 wrote to memory of 3568	4332	msedge.exe	90
PID 4332 wrote to memory of 5644	4332	msedge.exe	91
PID 4332 wrote to memory of 5804	4332	msedge.exe	92
PID 4332 wrote to memory of 5644	4332	msedge.exe	91
PID 4332 wrote to memory of 5644	4332	msedge.exe	91
PID 4332 wrote to memory of 4716	4332	msedge.exe	93
PID 4332 wrote to memory of 4716	4332	msedge.exe	93
PID 4332 wrote to memory of 2264	4332	msedge.exe	95
PID 4332 wrote to memory of 2264	4332	msedge.exe	95
PID 4332 wrote to memory of 5516	4332	msedge.exe	96
PID 4332 wrote to memory of 2264	4332	msedge.exe	95
PID 4332 wrote to memory of 5516	4332	msedge.exe	96
PID 4332 wrote to memory of 5516	4332	msedge.exe	96
PID 4332 wrote to memory of 3656	4332	msedge.exe	97
PID 4332 wrote to memory of 3656	4332	msedge.exe	97
PID 4332 wrote to memory of 3656	4332	msedge.exe	97
PID 4332 wrote to memory of 4896	4332	msedge.exe	98
PID 4332 wrote to memory of 4896	4332	msedge.exe	98
PID 4332 wrote to memory of 4896	4332	msedge.exe	98
PID 4332 wrote to memory of 3572	4332	msedge.exe	99
PID 4332 wrote to memory of 3572	4332	msedge.exe	99
PID 4332 wrote to memory of 2788	4332	msedge.exe	102
PID 4332 wrote to memory of 1064	4332	msedge.exe	101
PID 4332 wrote to memory of 2788	4332	msedge.exe	102
PID 4332 wrote to memory of 1064	4332	msedge.exe	101
PID 4332 wrote to memory of 5208	4332	msedge.exe	104
PID 4332 wrote to memory of 5212	4332	msedge.exe	107
PID 4332 wrote to memory of 5212	4332	msedge.exe	107
PID 4332 wrote to memory of 920	4332	msedge.exe	108
PID 4332 wrote to memory of 920	4332	msedge.exe	108
PID 4332 wrote to memory of 1328	4332	msedge.exe	110
PID 4332 wrote to memory of 2360	4332	msedge.exe	111
PID 4332 wrote to memory of 2000	4332	msedge.exe	112
PID 4332 wrote to memory of 4420	4332	msedge.exe	113
PID 4332 wrote to memory of 4420	4332	msedge.exe	113
PID 4332 wrote to memory of 5872	4332	msedge.exe	117
PID 4332 wrote to memory of 5872	4332	msedge.exe	117
PID 4332 wrote to memory of 5812	4332	msedge.exe	118
PID 4332 wrote to memory of 5812	4332	msedge.exe	118
PID 4332 wrote to memory of 1108	4332	msedge.exe	119
PID 4332 wrote to memory of 1108	4332	msedge.exe	119
PID 4332 wrote to memory of 3416	4332	msedge.exe	120
PID 4332 wrote to memory of 3320	4332	msedge.exe	121
PID 4332 wrote to memory of 3320	4332	msedge.exe	121

C:\Users\Admin\AppData\Local\Temp\horizonFixed\uncracked\82594f5ec0be4e56b1d797495996600f_Engine.exe
"C:\Users\Admin\AppData\Local\Temp\horizonFixed\uncracked\82594f5ec0be4e56b1d797495996600f_Engine.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://horizon.boltgroup.dev/loader-auth?link=a6d5be1f84c9c44fef168889b65768d9
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x31c,0x7ffa0236c188,0x7ffa0236c194,0x7ffa0236c1a0
    3⤵
    PID:3568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,5130534324906940449,1014416683996355452,262144 --field-trial-handle=2248,i,16559271527414809554,4093287207727628681,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
    3⤵
    PID:5644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,2501039802144893911,541935892612229569,524288 --field-trial-handle=2248,i,16559271527414809554,4093287207727628681,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,100154088719250940,7546774709269958487,524288 --field-trial-handle=2248,i,16559271527414809554,4093287207727628681,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:13
    3⤵
    PID:4716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,8800471236083704243,11218759495941933514,2097152 --field-trial-handle=2248,i,16559271527414809554,4093287207727628681,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:2264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,14731788477176408488,4620068492411499195,2097152 --field-trial-handle=2248,i,16559271527414809554,4093287207727628681,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:5516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,17458828527783144458,347597220295152507,2097152 --field-trial-handle=2248,i,16559271527414809554,4093287207727628681,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:1
    3⤵
    PID:3656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,13012479430028322198,15730518908768486974,2097152 --field-trial-handle=2248,i,16559271527414809554,4093287207727628681,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:9
    3⤵
    PID:4896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,13031675520459040471,5918838710722565218,524288 --field-trial-handle=2248,i,16559271527414809554,4093287207727628681,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:14
    3⤵
    PID:3572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,5938673046724595746,818126982893738049,524288 --field-trial-handle=2248,i,16559271527414809554,4093287207727628681,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
    3⤵
    PID:1064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,10578827257740856236,7460597196120118609,524288 --field-trial-handle=2248,i,16559271527414809554,4093287207727628681,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
    3⤵
    PID:2788
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,10380108782089268192,6264342277135539064,524288 --field-trial-handle=2248,i,16559271527414809554,4093287207727628681,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
    3⤵
    PID:3964
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,10380108782089268192,6264342277135539064,524288 --field-trial-handle=2248,i,16559271527414809554,4093287207727628681,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
    3⤵
    PID:5208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,12850985427349325034,1911967530917916338,524288 --field-trial-handle=2248,i,16559271527414809554,4093287207727628681,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
    3⤵
    PID:5212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,3274749992419886071,16625183642982075579,524288 --field-trial-handle=2248,i,16559271527414809554,4093287207727628681,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
    3⤵
    PID:920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,17208572656850611985,3040342717959518345,524288 --field-trial-handle=2248,i,16559271527414809554,4093287207727628681,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
    3⤵
    PID:1328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,2920921094775919623,4602035025318691624,524288 --field-trial-handle=2248,i,16559271527414809554,4093287207727628681,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:14
    3⤵
    PID:2360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,11159430149420757540,6451846174144245240,524288 --field-trial-handle=2248,i,16559271527414809554,4093287207727628681,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
    3⤵
    PID:2000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,16058504980025320200,4616377277846437127,524288 --field-trial-handle=2248,i,16559271527414809554,4093287207727628681,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
    3⤵
    PID:4420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,17593053957825283297,14014737436191926534,524288 --field-trial-handle=2248,i,16559271527414809554,4093287207727628681,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
    3⤵
    PID:5872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,8985384380852178283,11374435509867559436,524288 --field-trial-handle=2248,i,16559271527414809554,4093287207727628681,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
    3⤵
    PID:5812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,4363330758272090178,3150500207605179821,524288 --field-trial-handle=2248,i,16559271527414809554,4093287207727628681,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:14
    3⤵
    PID:1108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5880,i,8496131758543875240,4683449114290161551,262144 --field-trial-handle=2248,i,16559271527414809554,4093287207727628681,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,13148397556880417498,6325573680467453989,524288 --field-trial-handle=2248,i,16559271527414809554,4093287207727628681,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:14
    3⤵
    PID:3320

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 285edd241c61b650f4ebb0af692fa8c3d423cd90ceb6cc13a4b1822090ff7f06
MD5 1ee4bd81bebf6a852c6b54515323121f
SHA1 adf27a1ea63272fb43f4920a3b1a89af6bc47898
SHA512 d0806667d6103fe42ef7bf71acd230ca635df50a2173225c0edf389977fa5eb0e18b2e196eeaaf466f38c23aa14f637dbb68a39dea3ce483c41b7f120f6ac9fb
TLSH
T116D012243A159504D684203668A05613662589A164A586495151E11FDC68595635F1AB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e6f2ec3da5a55b94951d91a6f68f09f5b5302626e9b44f9c5ae85087d4b011ce
MD5 8b9572b87c690bba0911ee169fe3145a
SHA1 13949d8863f21886aac212914e50a63f98fc3bb7
SHA512 7e95e8da9da23d57209d6c9e77c4f541610f40a846f3d7f4e86fa753400725decbbb597f6f5a37185d9772cbccee30e292f8166bd22e61b5a143ce28a34d7562
TLSH
T110D080303B15D404D684303B68E1571377258DB124F587495151F12FDC785D5735F1DB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f2c3b2e79fc1b969cf35f1ee9b9c484eb02887614188fe66e4a3181b3242d989
MD5 5eaef2521c938f39f6a378d6d27a315c
SHA1 5f8bd3cdf12b913bcc32298fe879ad926a8e1e86
SHA512 6883e5bf8d74d19473d7ab69f1bd24b9456c46dd5282fda0110ce32a3c2947459ec10aa7efc7fde2afa37a97c3d22fa03a0021645a6850cc21e0fcb3165daec1
TLSH
T1BD61A79217BF1999C72A0EBDBCF2A1A8FF30FC9605076E255094ACB539073E93552A30
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592793.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592793.TMP
Size 3KB
SHA256 d0954dd58c8d4e4bea1135dc7eed92064a4b203b36a7fcb775915966ee56cb3c
MD5 9a3dee1bac66932bf28726f1caa94e76
SHA1 d8f9c1042885b83df89ebaa22fc9ded0cb7edcc0
SHA512 0295591ba6913f61f63d2255434a0fec2b0263ac80f323fe00188810a25f70905632f21a5011a38e164d07a4943f5c49ba3a25b020e1ce937d0ff6e356376f42
TLSH
T18A61CA9113BF0989C72A4FBDBCF2A1F5FF70FC9600076E114494AC747A473A93451A21
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 000c96c5bf3014303d883541d6f32da421638ea631bf78a0b19f553edf078b7a
MD5 3839de6ded4d823615b0a8c8d6b7bab8
SHA1 a24fb1270296522d84d04c72901f383d967f7546
SHA512 5ccbf69ab77a687b96dfe0d29e222b0160cfd564ab9d410f521eb24b2d9c03a6a44f4412817926d4312f41ec480266f4f165f1ac3a73e362f525403fc7f0fdc3
TLSH
T1D9618EF7C2E8856D891156F0AB24AE1BCE1D0915832C3D5AC9E4DF1B93E3472E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6b1f04884ed93cb89bd1471612f45f6992e19920f8e896983a191a6009590d96
MD5 fd5e49634190341899434f057be115c0
SHA1 80bd56a6e931482e93b38fcd0d00ba74b2ce8e8a
SHA512 e555f51b074142f11a0d7bc75c8b240ff0ec4fddedf900d786eac036f86f686c853e4351f672d5aa71ad3229694f843cf5b409c774d10182a5b5d99131cc6612
SSDEEP 192:sxRFRIyM/jK1Ml8wc2/fpsW7PJZH0GzoA8phv/g6+WNvwEM/YwSmG1IgtJ:sxRFaC2/fpsWTHel/5v8/83
TLSH
T13E62FB1666385937CCDBD209FA857F63D6F91573A2901E44AAFCCA0C05E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 08c41815d886568481c62ce6f4c1f65edf78db5c0caa83219e3c7298da85c1d0
MD5 3220201e7e2a900392d707c221f83100
SHA1 68cc3ce6a4e41274c64b6bcef004ea00ef57e402
SHA512 35a8675ac2d4958ad70a4af010482cdb82c44b84b19ddd485fbc9c21aac9e3d42613b65e2a1419ba0f359969bb5ae781ec170918929ee75839e03bc4c7fe5f40
SSDEEP 192:sxRKRIyM/jK1Ml8UQYc2/fps97NJZH0GzoA8pHv/g6+WNvwEM/Yw2mG1IgDlJ:sxRKaq32/fps9pHeP/5v8/Aj
TLSH
T14B62E916A5385937CCDBD209FA867F63D6F81563A2901E44AAFCCA0C05E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c1bd80470a34f8004131560b540606ab294da177ffc6de1fdb4b89c29a4895e3
MD5 3d34e52ef46148b75b60c482bff41868
SHA1 786ca8213d0ee3610b65ad18b8d05b84efecb36c
SHA512 5a9f9faf32adbdfe37356d767afc93b3a912f29d30fa8ba1f682e924aba6ad6b4cfec08c66f8c53b23b43d28f4a0ccd83aa224448119fe162345fcb723f3f561
SSDEEP 192:sxRKRIyM/jK1Ml8wc2/fps97PJZH0GzoA8phv/g6+WNvwEM/YwSmG1IgD/J:sxRKaC2/fps9THel/5v8/8l
TLSH
T10062FC1696385937CCDBD209FA857F53D6F91573A2901E44AAFCCA0C05E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 1ea3fee2760f6978f8e8407f04d1c075870f9d47a55deb0fea4f911dd260f84f
MD5 c925011bcc03a892f584402601e1e81c
SHA1 cc2a8b3148724994a8bc390d6aeea1ae83d205a2
SHA512 cbdb07e1e2c3a21cbd4827c1a5aba9ea3270d2034fbd54dd6d6508b8637661d6d5b2d8f12113e7ce0ff613c0cdb3677a0ece14f74d029bb60381fba9ef844ad8
SSDEEP 768:Ra7VjA7pLuL7wZWgmofLk8F1+UoAYDCx9Tuqh0VfUC9xbog/OV31Fd4vAroIyVQ:Ra7VjME7wZWgmofLku1ja81FavLrQ
TLSH
T105E2FD7B680CCB7E4F804A9CEC29BD9BADEC01CF5AD8895447EA840C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4af6fc95-9854-4f40-901a-b1a7812fb7b5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4af6fc95-9854-4f40-901a-b1a7812fb7b5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6e49dc4a7ff78409e159dec9d09a8c444a044830b1bcdb980ada1312dba55325
MD5 dd66c0655807cf62a22c35a491445185
SHA1 1fe7a3f374d8260a794163e4ed3973ef67638852
SHA512 35f3ddeb966667d88aee17c7d97e27019499b68209886f192d60d31507b6135b5487fd01719bcce9c3639f667865de9859c232eee0856e0e8f8e312744fab766
SSDEEP 768:fj+9I3HZq/jy6iAfmtnq2dlcnSl0bCTwZW2G+wcAO:S9I3gie92dynSl6bNG+wXO
TLSH
T165F2BE31BC55DE235CE2D688B2073A53BEF801A345C21E958EDE5B0E018779E271B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 96f17af9f09ed5e9ae14e694ba40b2366f88e2d0ca3e4a4ad297d18f4a7d24af
MD5 b79ae85fb3d37a731ff8d2bed18b3b4a
SHA1 40d6443bebf98a3ede4e15b7be4ef0ea87fa0435
SHA512 3168dc64894c421afad63b161e926dd7128c5801fb70ab1cc6742c86f6441387976d6a6567023bd7bb478f35befedc37e73587c52f6004da7cbbe073944f839e
SSDEEP 768:+rv+4UNbd+3tq/jy6iAfmtcq2dlcnSl0bCTwZW2k:+bsbs30ieI2dynSl6bNk
TLSH
T15C03BE31F858DE739CF2D285B14B3A53BEB811A345C60F94CDDA5B0D028759E2B1B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 bb563b422985c19f8ad410c73a74a6632dc7e0f5ffae84a67a615fe9c6a61070
MD5 5b43c1b01d7a0ffa601c0d9a2cced5b1
SHA1 97e38c396a574e10a46fbadf98c546b534cd584d
SHA512 c904876a1ca7cc751f407962aa1054d62b6d309bd2fc479f58a583af5e180a950314f5d4d227c4486cc9cbd3bbe61643d1caf2b3910b069bd12aaed1bb467b1f
SSDEEP 768:Jrv+4UNbdr3Pf/jy6iAwq2dlcnSl0bCTwZiGV+8rEnk:Jbsbl3nia2dynSl6bXDrEk
TLSH
T12C03BF31ED189A739CE2C684B14B3A03BEF841A356C50BD4CDDE2F0D428B59E231B963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2b04878f9eeb5cca3ad8b7100bdb886cbd5804742271e351d452031abe846da7
MD5 9b0e0f24ea09513c97bd0c9ee36e21e1
SHA1 28efb1e0946bf91c8899af84db9aeae9e04b608c
SHA512 a87b64e747cbd3220dd4c52ee6bc75c4c47221bf1270aba98a944eaff5f85d1c7176e0985c3416e19b5b43ed2f63b6b36a71583a98d7c5e8d94ebfe123124d09
SSDEEP 768:cj+9I3oZq/jy6iAfmtnq2dlcnSl0bCTwZW2G+wcAO:79I3lie92dynSl6bNG+wXO
TLSH
T11AF2BF31BC55DD235CE2D688B2073A53BEF801A345C61E958EDE5B0E018779E271B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 ddd5ae7629828aa94b74534f9207404647f1b79916b805a56a57384e260dc07e
MD5 72cbaaddb643ea95884bf85a2bbe1acf
SHA1 c8d752bfc9ff9e1d5c57a5831474f76eec8b2894
SHA512 5c52ae32ec2cf88201af026a63defaba36fe710b4fa8e45720a316cc73bd938899df7613d4c594bb53530e88779650016f531bc260fce7f62c0ae9116084df87
SSDEEP 768:ZF1j+9K3gwgJMeSiAfmt9q2dlcnSl0bCTwZW2G+wcAO:o9K3lieD2dynSl6bNG+wXO
TLSH
T16F1339F198C38936D8EE9787A33E6D42ADBCC06375855994BBC95E0DCC821BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4332_1362494695\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download