hxxps://release-assets[.]githubusercontent[.]com/github-production-release-asset/1403446451/bc747307-d923-4aa9-bb06-cf5fd1b85314?sp=r&sv=2018-11-09&sr=b&spr=https&se=2026-10-30T00%3A44%3A07Z&rscd=attachment%3B+filename%3Dhorizon-launcher-windows-x64[.]zip&rsct=application%2Foctet-stream&skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skt=2026-10-29T23%3A43%3A10Z&ske=2026-10-30T00%3A44%3A07Z&sks=b&skv=2018-11-09&sig=DuhVj1vDJy3wZjqJMPzeZK9ZZdGvC2vADRzAdyPWjT8%3D&jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9[.]eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmVsZWFzZS1hc3NldHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tIiwia2V5Ijoia2V5MSIsImV4cCI6MTc5MzMyMDIzMCwibmJmIjoxNzkzMzE4NDMwLCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZXQifQ[.]SJP2Yji-x-XsCO5i91XCENsZmz9TAX4ZzhXsqgqzSTI&response-content-disposition=attachment%3B%20filename%3Dhorizon-launcher-windows-x64[.]zip&response-content-type=application%2Foctet-stream

Analysis

user interaction
yes
max time kernel
66s
max time network
75s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 00:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://release-assets.githubusercontent.com/github-production-release-asset/1403446451/bc747307-d923-4aa9-bb06-cf5fd1b85314?sp=r&sv=2018-11-09&sr=b&spr=https&se=2026-10-30T00%3A44%3A07Z&rscd=attachment%3B+filename%3Dhorizon-launcher-windows-x64.zip&rsct=application%2Foctet-stream&skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skt=2026-10-29T23%3A43%3A10Z&ske=2026-10-30T00%3A44%3A07Z&sks=b&skv=2018-11-09&sig=DuhVj1vDJy3wZjqJMPzeZK9ZZdGvC2vADRzAdyPWjT8%3D&jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmVsZWFzZS1hc3NldHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tIiwia2V5Ijoia2V5MSIsImV4cCI6MTc5MzMyMDIzMCwibmJmIjoxNzkzMzE4NDMwLCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZXQifQ.SJP2Yji-x-XsCO5i91XCENsZmz9TAX4ZzhXsqgqzSTI&response-content-disposition=attachment%3B%20filename%3Dhorizon-launcher-windows-x64.zip&response-content-type=application%2Foctet-stream
Sample261030-abprcstycs

Score

6^/10

discovery execution

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
45	raw.githubusercontent.com
49	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6404	powershell.exe
5552	powershell.exe
4128	powershell.exe
9104	powershell.exe
6404	powershell.exe
5216	powershell.exe
5468	powershell.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5180	cmd.exe
8212	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4712	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{2AA54A38-C24B-4AE4-9946-8005DC928756}	msedge.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
4128	powershell.exe
4128	powershell.exe
4128	powershell.exe
9104	powershell.exe
9104	powershell.exe
9104	powershell.exe
6404	powershell.exe
6404	powershell.exe
6404	powershell.exe
5216	powershell.exe
5216	powershell.exe
5216	powershell.exe
5468	powershell.exe
5468	powershell.exe
5468	powershell.exe
6404	powershell.exe
6404	powershell.exe
6404	powershell.exe
5552	powershell.exe
5552	powershell.exe
5552	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4128	powershell.exe
Token: SeIncreaseQuotaPrivilege	4128	powershell.exe
Token: SeSecurityPrivilege	4128	powershell.exe
Token: SeTakeOwnershipPrivilege	4128	powershell.exe
Token: SeLoadDriverPrivilege	4128	powershell.exe
Token: SeSystemProfilePrivilege	4128	powershell.exe
Token: SeSystemtimePrivilege	4128	powershell.exe
Token: SeProfSingleProcessPrivilege	4128	powershell.exe
Token: SeIncBasePriorityPrivilege	4128	powershell.exe
Token: SeCreatePagefilePrivilege	4128	powershell.exe
Token: SeBackupPrivilege	4128	powershell.exe
Token: SeRestorePrivilege	4128	powershell.exe
Token: SeShutdownPrivilege	4128	powershell.exe
Token: SeDebugPrivilege	4128	powershell.exe
Token: SeSystemEnvironmentPrivilege	4128	powershell.exe
Token: SeRemoteShutdownPrivilege	4128	powershell.exe
Token: SeUndockPrivilege	4128	powershell.exe
Token: SeManageVolumePrivilege	4128	powershell.exe
Token: 33	4128	powershell.exe
Token: 34	4128	powershell.exe
Token: 35	4128	powershell.exe
Token: 36	4128	powershell.exe
Token: SeDebugPrivilege	9104	powershell.exe
Token: SeIncreaseQuotaPrivilege	9104	powershell.exe
Token: SeSecurityPrivilege	9104	powershell.exe
Token: SeTakeOwnershipPrivilege	9104	powershell.exe
Token: SeLoadDriverPrivilege	9104	powershell.exe
Token: SeSystemProfilePrivilege	9104	powershell.exe
Token: SeSystemtimePrivilege	9104	powershell.exe
Token: SeProfSingleProcessPrivilege	9104	powershell.exe
Token: SeIncBasePriorityPrivilege	9104	powershell.exe
Token: SeCreatePagefilePrivilege	9104	powershell.exe
Token: SeBackupPrivilege	9104	powershell.exe
Token: SeRestorePrivilege	9104	powershell.exe
Token: SeShutdownPrivilege	9104	powershell.exe
Token: SeDebugPrivilege	9104	powershell.exe
Token: SeSystemEnvironmentPrivilege	9104	powershell.exe
Token: SeRemoteShutdownPrivilege	9104	powershell.exe
Token: SeUndockPrivilege	9104	powershell.exe
Token: SeManageVolumePrivilege	9104	powershell.exe
Token: 33	9104	powershell.exe
Token: 34	9104	powershell.exe
Token: 35	9104	powershell.exe
Token: 36	9104	powershell.exe
Token: SeDebugPrivilege	6404	powershell.exe
Token: SeIncreaseQuotaPrivilege	6404	powershell.exe
Token: SeSecurityPrivilege	6404	powershell.exe
Token: SeTakeOwnershipPrivilege	6404	powershell.exe
Token: SeLoadDriverPrivilege	6404	powershell.exe
Token: SeSystemProfilePrivilege	6404	powershell.exe
Token: SeSystemtimePrivilege	6404	powershell.exe
Token: SeProfSingleProcessPrivilege	6404	powershell.exe
Token: SeIncBasePriorityPrivilege	6404	powershell.exe
Token: SeCreatePagefilePrivilege	6404	powershell.exe
Token: SeBackupPrivilege	6404	powershell.exe
Token: SeRestorePrivilege	6404	powershell.exe
Token: SeShutdownPrivilege	6404	powershell.exe
Token: SeDebugPrivilege	6404	powershell.exe
Token: SeSystemEnvironmentPrivilege	6404	powershell.exe
Token: SeRemoteShutdownPrivilege	6404	powershell.exe
Token: SeUndockPrivilege	6404	powershell.exe
Token: SeManageVolumePrivilege	6404	powershell.exe
Token: 33	6404	powershell.exe
Token: 34	6404	powershell.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
4788	horizon-launcher.exe

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
4788	horizon-launcher.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 1168	5060	msedge.exe	83
PID 5060 wrote to memory of 4712	5060	msedge.exe	85
PID 5060 wrote to memory of 2620	5060	msedge.exe	86
PID 5060 wrote to memory of 2620	5060	msedge.exe	86
PID 5060 wrote to memory of 2620	5060	msedge.exe	86
PID 5060 wrote to memory of 1036	5060	msedge.exe	87
PID 5060 wrote to memory of 1036	5060	msedge.exe	87
PID 5060 wrote to memory of 2400	5060	msedge.exe	88
PID 5060 wrote to memory of 4080	5060	msedge.exe	89
PID 5060 wrote to memory of 2400	5060	msedge.exe	88
PID 5060 wrote to memory of 2400	5060	msedge.exe	88
PID 5060 wrote to memory of 4080	5060	msedge.exe	89
PID 5060 wrote to memory of 4080	5060	msedge.exe	89
PID 5060 wrote to memory of 4040	5060	msedge.exe	90
PID 5060 wrote to memory of 4364	5060	msedge.exe	91
PID 5060 wrote to memory of 4040	5060	msedge.exe	90
PID 5060 wrote to memory of 4040	5060	msedge.exe	90
PID 5060 wrote to memory of 4364	5060	msedge.exe	91
PID 5060 wrote to memory of 4364	5060	msedge.exe	91
PID 5060 wrote to memory of 5104	5060	msedge.exe	94
PID 5060 wrote to memory of 5104	5060	msedge.exe	94
PID 5060 wrote to memory of 4004	5060	msedge.exe	95
PID 5060 wrote to memory of 4004	5060	msedge.exe	95
PID 5060 wrote to memory of 5096	5060	msedge.exe	96
PID 5060 wrote to memory of 3756	5060	msedge.exe	97
PID 5060 wrote to memory of 5096	5060	msedge.exe	96
PID 5060 wrote to memory of 3756	5060	msedge.exe	97
PID 5060 wrote to memory of 3756	5060	msedge.exe	97
PID 5060 wrote to memory of 4404	5060	msedge.exe	99
PID 5060 wrote to memory of 2340	5060	msedge.exe	101
PID 4788 wrote to memory of 4128	4788	horizon-launcher.exe	110
PID 4788 wrote to memory of 9104	4788	horizon-launcher.exe	115
PID 4788 wrote to memory of 6404	4788	horizon-launcher.exe	131
PID 5060 wrote to memory of 6680	5060	msedge.exe	119
PID 5060 wrote to memory of 1100	5060	msedge.exe	120
PID 5060 wrote to memory of 3948	5060	msedge.exe	121
PID 4788 wrote to memory of 5180	4788	horizon-launcher.exe	123
PID 4788 wrote to memory of 5216	4788	horizon-launcher.exe	125
PID 4788 wrote to memory of 5468	4788	horizon-launcher.exe	127
PID 4788 wrote to memory of 8212	4788	horizon-launcher.exe	129
PID 4788 wrote to memory of 6404	4788	horizon-launcher.exe	131
PID 4788 wrote to memory of 5552	4788	horizon-launcher.exe	133
PID 5060 wrote to memory of 5016	5060	msedge.exe	136
PID 5060 wrote to memory of 5016	5060	msedge.exe	136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://release-assets.githubusercontent.com/github-production-release-asset/1403446451/bc747307-d923-4aa9-bb06-cf5fd1b85314?sp=r&sv=2018-11-09&sr=b&spr=https&se=2026-10-30T00%3A44%3A07Z&rscd=attachment%3B+filename%3Dhorizon-launcher-windows-x64.zip&rsct=application%2Foctet-stream&skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skt=2026-10-29T23%3A43%3A10Z&ske=2026-10-30T00%3A44%3A07Z&sks=b&skv=2018-11-09&sig=DuhVj1vDJy3wZjqJMPzeZK9ZZdGvC2vADRzAdyPWjT8%3D&jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmVsZWFzZS1hc3NldHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tIiwia2V5Ijoia2V5MSIsImV4cCI6MTc5MzMyMDIzMCwibmJmIjoxNzkzMzE4NDMwLCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZXQifQ.SJP2Yji-x-XsCO5i91XCENsZmz9TAX4ZzhXsqgqzSTI&response-content-disposition=attachment%3B%20filename%3Dhorizon-launcher-windows-x64.zip&response-content-type=application%2Foctet-stream
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff86466c188,0x7ff86466c194,0x7ff86466c1a0
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,5555194488832200132,2111493645793026277,524288 --field-trial-handle=2324,i,3650686067869671884,5822108959842554890,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,2495226814541076183,3947512782550636273,262144 --field-trial-handle=2324,i,3650686067869671884,5822108959842554890,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,12598244974065006328,11085978139085673977,524288 --field-trial-handle=2324,i,3650686067869671884,5822108959842554890,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,2619844309851097823,241371013904314430,2097152 --field-trial-handle=2324,i,3650686067869671884,5822108959842554890,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,3502601277190119059,6404676681849100968,2097152 --field-trial-handle=2324,i,3650686067869671884,5822108959842554890,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,14485073301917394876,5890741950651801203,2097152 --field-trial-handle=2324,i,3650686067869671884,5822108959842554890,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,14759397412929865717,10746684323871911067,2097152 --field-trial-handle=2324,i,3650686067869671884,5822108959842554890,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:2
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,9906649262063914548,15180222946990226871,524288 --field-trial-handle=2324,i,3650686067869671884,5822108959842554890,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,15325728335590039820,12808172878155636027,524288 --field-trial-handle=2324,i,3650686067869671884,5822108959842554890,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,8767831815426054475,2262990727104958845,524288 --field-trial-handle=2324,i,3650686067869671884,5822108959842554890,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5672,i,3836889378673368118,15271742054366686510,2097152 --field-trial-handle=2324,i,3650686067869671884,5822108959842554890,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,5266014779049662733,16147476208157073625,524288 --field-trial-handle=2324,i,3650686067869671884,5822108959842554890,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,2941503963504693276,2326005460876244563,524288 --field-trial-handle=2324,i,3650686067869671884,5822108959842554890,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,2941503963504693276,2326005460876244563,524288 --field-trial-handle=2324,i,3650686067869671884,5822108959842554890,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,11057268080156232103,2630774641033349325,524288 --field-trial-handle=2324,i,3650686067869671884,5822108959842554890,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  PID:6680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,18370857790697061512,14987618209643905135,524288 --field-trial-handle=2324,i,3650686067869671884,5822108959842554890,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,14857419001916094215,12292899408553634448,524288 --field-trial-handle=2324,i,3650686067869671884,5822108959842554890,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,983344042755889371,12617409392842080298,524288 --field-trial-handle=2324,i,3650686067869671884,5822108959842554890,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:8
  2⤵
  PID:5016

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4360

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3224

C:\Users\Admin\AppData\Local\Temp\Temp1_horizon-launcher-windows-x64.zip\horizon-launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_horizon-launcher-windows-x64.zip\horizon-launcher.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "(Get-CimInstance Win32_Processor | Select-Object -First 1).MaxClockSpeed"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "(Get-CimInstance Win32_Processor | Measure-Object NumberOfCores -Sum).Sum"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:9104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "@(Get-CimInstance Win32_Battery).Count"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6404
- C:\Windows\system32\cmd.exe
  "cmd" /C ver
  2⤵
  - Executes a command shell one-liner
  PID:5180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "(Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "(Get-CimInstance Win32_Battery | Select-Object -First 1).BatteryStatus"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5468
- C:\Windows\system32\cmd.exe
  "cmd" /C ver
  2⤵
  - Executes a command shell one-liner
  PID:8212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "(Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:6404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "(Get-CimInstance Win32_Battery | Select-Object -First 1).BatteryStatus"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 b58f994c644f7b4a831e889630bfd7ca0860aeb1e0920dc0f5d4928585a9dbab
MD5 3bfc414667e1ebc31e9259fa1db290fa
SHA1 9bff989429779efef334e5524a362e7b6ff266cb
SHA512 e6cb000e8f900132f7dc661f943b8e91e945d171157ff3289b91e9d79f70230e363ed65b7ec97f451b376cf4706a14de9a86193e72dcea8fe3aa8c86c6117d13
TLSH
T1E371BF323375B0D4C9567F072A2819C063BF4396EA98AF4CB25C621ED92751B9B122F7
MD5 SHA1 SHA512 TLSH

Submit Download

48971a83-9e59-4fa1-9d2c-a108a04b67c6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\48971a83-9e59-4fa1-9d2c-a108a04b67c6.tmp
Size 8KB
SHA256 884b5b8999b2e7352b072a6ef76a2c67a9565cca18433553345727da23efe875
MD5 9c7510d78b6b5d6492e910cc11773cf6
SHA1 663d1174a3fb5662d6e5f845b17a2203e556895a
SHA512 178b76d3ac5293ffb56236730bb6081cec6c316aabaff907f044340f3defe56fcb85e3a1b451cecea905c08a0fdd786653e80bf5dc7ec38c0582f7ed2e8ca868
SSDEEP 192:aONk6iDnQmiUyusFq5u88PINuAPwonuZOqriU6:aONk6USFq5u8iI8AYoSCU6
TLSH
T106122B366878BC6B6DE2A965B58736038EA4422BD7897FC4D5EC161C05EF2DC1307613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94deeb88-a840-473b-9a62-91bb8ed179d5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\94deeb88-a840-473b-9a62-91bb8ed179d5.tmp
Size 8KB
SHA256 dc5214182b3ff25f43a3acd1ad393872420aaef618d63ecec042cfc3c1f819a7
MD5 8226c3503ab6ebef010aa5742ff832cb
SHA1 e4e467228659336762690886ae9b056010829f21
SHA512 84f863ded853a8c8898d7c3c26a77763577fc1283ef05cfe8870817436726c82fcc64034ea4b7cea30e4d61cf84aab9159dd3069bc27bcbab2ccf86e5f61f486
SSDEEP 96:PqONk/QsjpfwDISp5ih/cIPURHl8h4otop5NmDYBfPGxvw45RxmJm78lFDxv+Njo:SONX6iDCQmiUyGsHq5u88PINhSq21bU6
TLSH
T1AA020939AC787CAB9EF3AE15B5477B175F94012FE6952F84D9E81A1C00D729C1307523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f6c603c48bad8cf6fc5bfa1901589a53022a5c1315888da77b07a5c7516687a5
MD5 4fabfb1f7d070458e2895ffec233ff43
SHA1 98393503bad4d9db97f3ddfbb3e45d91868d9978
SHA512 8d103d2ec672aaef277a945b102deb58448c812a35ac148aeabfd0c6f3a0f02507510d1c81989a1842eaf658c9190a9493eb0148dbc239fa99fadbb1108ebe40
TLSH
T13ED0805474663DFCD16E71355415CD405744DF53E1021755160B4C15D5501C61CF1EDD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 87a6b56b3a47cfd9f58f49b21d0040033c8cfd80b50e49b434794cefa7e29583
MD5 74ef2da89fa243ea7d0030317efca192
SHA1 ceb38f6fe8b62f80d617114db8b4617467417ae3
SHA512 285847f78095225db6f446ab877593c3e8e9c642b3beec1b15e7b1eec59d6b2f61ada0e2fb96cf36a3046dbd5102c274473cea5f978ee83b010039a4dc00d05d
TLSH
T10DD024C471D0340CD40C31335015CD011744CD54F00317C7000D4C40C4400C40CF1C4D
MD5 SHA1 SHA512 TLSH

Submit Download

5228f383-f672-46a7-af83-eb6d4cecf4c3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5228f383-f672-46a7-af83-eb6d4cecf4c3.tmp
Size 10KB
SHA256 93854f966d2dacd1c424e704108ebf4f0d0b734beee7d2b50e7dfb724ae06319
MD5 accde1faa2b9e9ec89576053be194363
SHA1 a3b38b8f1e37646970f487fb53a047c693f20264
SHA512 71fb5bc3b03cfff6e4cd1de92b6bae0f8849f18bb22bd5530922b73dde592737533d2b0e52f12b9869f5509052843a0b2d66df34c910244afc86bae9b2efa5d4
SSDEEP 192:sxZSRQnO/fTsahiWpVdAfIdpLHW6+WNGYasy8lUIgbOJ:sxZScO/fTs5WvdAQLHbGbO
TLSH
T1E8329551AE38A97B8CC7E21DBB657F53E6F9103291911E88A6FC861C05E7ADE130740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55dc1050-c94c-4e8a-9fb5-01f75539b37c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\55dc1050-c94c-4e8a-9fb5-01f75539b37c.tmp
Size 10KB
SHA256 2e5ae3dac805fde109254e00a2f919c5076ecc7217b9cbbe2196fc2d3b977fc1
MD5 cec987cee1a31b765eadcfeb5dd769f9
SHA1 97250eb83a48b4eb40b016fc656550705201b795
SHA512 bef603538399282f0d50866ed632f2640a33dcf6336ccecbda30ec3ccdde16bafd619ab26e85bbff385e2e2b15ea971abde9ed301f4758c8ea529cbcecb4d92f
SSDEEP 192:sxZSRanO/fTsahlAfIdpLHW6+WNGYaWyTt2Ig5OJ:sxZSaO/fTsyAQLHbGms
TLSH
T1F422B852AE38A97B8CC7E20DBE557F53E6F9503251911E88A6FC861C05E7ADE130740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6be9a428-a34a-4828-8c7c-2a5aa71c99bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6be9a428-a34a-4828-8c7c-2a5aa71c99bd.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

76897d42-fb81-4f64-8191-6af02a11b29f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\76897d42-fb81-4f64-8191-6af02a11b29f.tmp
Size 27KB
SHA256 5f3bbc5c13c3121f87bcb2505c5cc535e45b5670f741bbc7ed98bfeef640acca
MD5 f25cf1e30c879e7d2a5fa193eddd7cf2
SHA1 0e993f01ea6bc8b5fd143140d65cff0bdafa21c5
SHA512 3eb67b99ecb54aec6a43423d43f6b814463e93ec126d1e6519f9c36559b512b823d499e0c87b6308060d4da0995b3c7ca6c7d17683a00f7efa3f561825fa31a9
SSDEEP 768:h6yQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3WroTZTFJ:h6yQRbrWvvlpZu1jaXKLf33tTZTFJ
TLSH
T179C2F92B640CCB7E4FC01E9DDC6A6F977EA802C766588D4447FA984C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 4a756bcb56620d82ca9208c02bf1a3d713eecc32b1ed5252c35fc1e247d2dbd1
MD5 512f6de1e2c3976d69a3ac1779ff4381
SHA1 5e641514a63c654ea8d3d34503007ac79cfbb439
SHA512 8d5c78c9c030a972a00da029ebee4a6f13be790fff3a7e25c2266ecf283a676d465ec132f0501bdd6412e6d661aec608c44c3f81713182a13ee2af62dba1de43
TLSH
T1D16193A954A00471DB996132B2F0A0873676F0B55FA7EE7200DCC8FFBF4A7599387260
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4088603e92b416177f8d5800dc9cabef0e3f4ab329f982dbdc2bc1588ebe0b99
MD5 4f95c40bf1fbb17889ac95a55917c249
SHA1 9209fe3f03371181ec5b2cadbbbc87b523a92993
SHA512 5a0acea716df72737cca40ca927c472e50c3ba880cc7b6ff351285cac75e7cd5c5433f1927f8638c581598011470a7fa104cabaef3dec1d5471c74b2b51c18c3
TLSH
T1F16193A955A00071DB986132B2F0A0873676F0B55FA7EE7200DCC8BFBF4A7599387220
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 56c653870985a1bdefbf838235dbd0ec2cfbaa485bbf59b158c36117b90e8438
MD5 afa52182d6d42d9b1462acf6bda9e57f
SHA1 8b8e3834cf29d32434e3894a0239104758c89a1a
SHA512 3aa90af75f8050e6c4dce2aeabd1260775adf69ec2267bb23a8e9d35134df64936116c5bcffa0ef037132d27367b280a9852c6c766fa6ce381fd84826d858f69
SSDEEP 3:MsEllllkEthXllkl2zE/lxrE:/M/xT02z
TLSH
T13644040C7FC00507CD5017304051D3501370DD5017535F433471C4335DC57400C10000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab2cc8be-e23b-4e0b-abd6-734b0c19be58.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\ab2cc8be-e23b-4e0b-abd6-734b0c19be58.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

43bdb182-2232-493f-a9fd-b095815bcc52.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\43bdb182-2232-493f-a9fd-b095815bcc52.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

c2b515df-2985-4709-ab12-d8afeeea19f4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c2b515df-2985-4709-ab12-d8afeeea19f4.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c50e0bec-7cbc-4ff4-ae6b-b60e5c65e911.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c50e0bec-7cbc-4ff4-ae6b-b60e5c65e911.tmp
Size 1KB
SHA256 3c0ff5789e10be3e8b75f8c614406a0e990e1b945b6a98823bac7f4a96241961
MD5 6887e1d6ec3f4c855784fca2103fbe82
SHA1 79182969f15a38bbfffef6dd4babc11e9d2f7dd2
SHA512 47a1afc47a39f43985cbb11952792834ee12da1eeeac9cfa312970fb9a98671528e0082aa4b3bf5d94689b8bcd924b9cfa28a5c810944815dd21fac9f57e99c7
TLSH
T17321BEB387E1856E8A015BF06A18AE2BDE2D0505931C7C1A85E4AF2793E3475E00295F
MD5 SHA1 SHA512 TLSH

Submit Download

d6da909f-c8d7-4791-9535-1f9dfed520a6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d6da909f-c8d7-4791-9535-1f9dfed520a6.tmp
Size 10KB
SHA256 3a1b3f5d1cd3ed370daf4bda5d152a238ac31ba2552645adacfdbeb02fc4dd37
MD5 c295347ced35e993dd53070de14b0187
SHA1 181c1160842445abf5bae6735cb29d98646b53d4
SHA512 c268a9b6c3797d35a2e4a8e194aa763c31da0a625a7f3c4b95406b3f3537c7432cbb2cbdb6a21fd83999bc773e998cc5ca027368ac8d2d5e2102b798029c49e9
SSDEEP 192:sxZSRanO/fTsahlAfIdpJHW6+WNGYaryEt2Ig5OJ:sxZSaO/fTsyAQJHbG4s
TLSH
T13122B611AE38A97B8CCBE20DBE157F53E6F9503291951E88A6FC861C05E7ADE130740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e1910144-a607-4585-b464-007637f8bbb2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e1910144-a607-4585-b464-007637f8bbb2.tmp
Size 9KB
SHA256 f1c91223c65bbd214e6e4cf9005155e8a61bf44f3c6c0bae83672f9d94dfe472
MD5 83a2ddc38f59e49a788777819b9cdc35
SHA1 434194e46e50b3bc52fc717ee3e96aaf0e7a8661
SHA512 401e4ac6f5da639818571ec450d6dd6cb15053c1ec7145d5ceb4653d70d6dc3fec1d1e74efea9f6a68be25110d52a68b7bec642c63c7b55da83bdd576a863bb8
SSDEEP 192:sxZSRanO/fTs9hSAfIdpJHW6+WNGYaNst2IgrJ:sxZSaO/fTs6AQJHbGj9
TLSH
T13A228651AE38A57B8CCBE20DBA257F53E6F9503291951E88AAFC861C05E6ADD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f01e24be-6d7c-4f25-b545-2ed28036d5a0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f01e24be-6d7c-4f25-b545-2ed28036d5a0.tmp
Size 9KB
SHA256 f0586943591d691360020d30e25c10a9f78c90400907ea70c4a7507266b4f962
MD5 b961faa72afa221bbffdcf2c520068eb
SHA1 50b3950a0f768a2ad073d1722e07fb92b7b4ac30
SHA512 044c879f7ab8ef9247b747c8ec6c1b47f6c7ed73ce19d0c8f419a3545b0960a462154792acdafe82ef013725d21114679449275efabb5a90bfad1554b872014a
SSDEEP 192:sxZSRanO/fTsahSAfIdpJHW6+WNGYaNst2Ig5cJ:sxZSaO/fTsFAQJHbGj+
TLSH
T11C22A711AE38A57B8CCBE20DBA55BF53E6F9503291D51E88A6FC861C05E7ADE130740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

232a9dda-e152-4be7-a217-1b7197d7b056.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\232a9dda-e152-4be7-a217-1b7197d7b056.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

e45a3eca-22b2-4a82-b3ba-e43b903f7f59.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e45a3eca-22b2-4a82-b3ba-e43b903f7f59.tmp
Size 18KB
SHA256 e103f476e6f1823ec8871aa45245ce96dba3b5a6b2e48404cd6f391b55508879
MD5 0c69b58bc4b640561ca04eb2efb329e3
SHA1 618f3a62c711c48d943043b1ef6963a9c8a9e0f5
SHA512 2ce44af25e21a731b95bd94040bf8f4648a49d0345bccfca1488a3e55650f8beec9aa8f801c9b981bf0e6f5417ad4cf0bd372d894a5778b52bd636e1948416cb
SSDEEP 384:/QkUSvSsNRP1+eLv3p5u8iI8AYolC2I0IIlE:BSuvkI59C50Lu
TLSH
T1CB826B365CB87C679DA3E560F54A36038EA4821BD7882FD8D9DD6B1C06DB2DC2307A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e598b907-4b42-400b-a634-cbd0fb5464b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e598b907-4b42-400b-a634-cbd0fb5464b7.tmp
Size 18KB
SHA256 b3d0308b44425f8a4706d4f4446adf3330785ffa4e4d2050cd7bc86bede1f2f4
MD5 0ff0ddd923faa800b3139926f632d5ed
SHA1 d524be88f55089bd9fe213fbade35033b704d1d1
SHA512 6cf9942aed42e0608f5a91f3f6abc2ff5acf0da3eccf58cb21dfb7adf44aa4a7ebd09d21dae977fe17b256f418dda122c2c5c84c14bbff5242cc8270e3476e4b
SSDEEP 384:oQkUSvSsNRe1+eLv3p5u8iI8AYolC2I0IIlE:gSBvkI59C50Lu
TLSH
T109826B365CB87C679DA2E560F64A36038EA4811BD7882FD4D9DD6B1C06DB2DC2307A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec03b80a-91bf-424e-a316-27f7eac62999.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ec03b80a-91bf-424e-a316-27f7eac62999.tmp
Size 21KB
SHA256 b0a1df2f9ca13786845c53a0427899454d681a250f3aa532a768b624e946fb30
MD5 44248cbd458c6c5915a36b209cdb59fd
SHA1 74dcb720d1fef1d1f107624d24b00d0155716985
SHA512 c320bbb621d988ebf498adb4d845744b7063a6bbf61a26a06f66afc71edc6d1e5c0bc7a845ce5c27ecf9c01414317a18e19cf9fb70c2f6fd47f27b1f52236d65
SSDEEP 384:tiFgQkUSv7VsNj8TUNTUlIle1+eXv3p5u8iI8AYoSC2I0IIlE:kFIBqwgQvkI5aC50Lu
TLSH
T108A25C375CA8A87B9EF69A50F64A3203CEB48167C685AFD4E6CC5A1C01DB1DC1307A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

220aa32a-47d8-4c17-8188-a3d48a5ed675.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\220aa32a-47d8-4c17-8188-a3d48a5ed675.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fab8b57d-f01b-448a-bf91-f0e16c36966e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fab8b57d-f01b-448a-bf91-f0e16c36966e.tmp
Size 25KB
SHA256 71f6ef23b1a76086635b1b673cef8a8c4de7e4d5b03a78c22af38f6cef122e0e
MD5 029e68e27ee4732731f5bac29c1abb46
SHA1 e678563158d48277f7c60b42fac8cb4f15c8ff60
SHA512 6362e257ed8fa94acd5d4292a470760d0dfc7c4ab8f0b89070c6572a8e8d9743aa27fd61fcdf14d2a1e6028ffeda7679a5cd0f0b2b6e8e0d91f5a69004e46a8c
SSDEEP 384:tiFqQkUSv7nsN08TUNTUlIle1+eGF3p5u8iI8AYoK6avFA8BvAdoCkLVC2I0IIlE:kFSrLwgHvkI5yl68lCkL050Lu
TLSH
T198C25C76CCA46CEB99B5EEC1B549F6039EA4417BC1986A9CD6F8B93820CF1FC0303911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 841a4ede53af54b29f3405240156a352b3fa83470fb4b6d8018ce59295eff33f
MD5 26487a8d2d24ea5d8ce63df4dd421ed4
SHA1 d3f8e2bd60fe6962fdde8851aac34d89dd36f36d
SHA512 a7a069f334cccea66b34c0f92ec0730d8992258d7d3c12264ae55e356649fac709d1a9fa23b83147fe79c0fa96d5765f4b8a87b62f0de3dcd13071d9f35c365e
TLSH
T12941096CBAFA114873B7BF5A9BFAB86D447E79371E06D45D10010E4E0627A00C872B37
MD5 SHA1 SHA512 TLSH

Submit Download