Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
126s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
08/02/2025, 15:20
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10ltsc2021-20250207-en
Behavioral task
behavioral3
Sample
Setup.exe
Resource
win11-20250207-en
General
-
Target
Setup.exe
-
Size
360KB
-
MD5
216340f456c7adb3db07da2b551e1066
-
SHA1
a9623a90d83ac30a74f52ff9042647d4dad473ec
-
SHA256
aa226ab5c6754cbbf77de7e20a0bf76529cd7a7b1066df846c15aa89f6cbd0a1
-
SHA512
8625016bf03fb6b1cedf18371eb2fafa77f10df33ebf09ffa74ca0d79616dbf5544c72ab85317e06d8a8a97980b23681dddf88ce3df06f8df4f3ba68b15c3cbb
-
SSDEEP
6144:O/a19BSfmQl2G0GI++lx19BSfmQl2G0GI++lM:P19inIT19inIe
Malware Config
Extracted
vidar
https://t.me/sok33tn
https://steamcommunity.com/profiles/76561199824159981
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0
Signatures
-
Detect Vidar Stealer 26 IoCs
resource yara_rule behavioral1/memory/2616-8-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral1/memory/2616-12-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral1/memory/2616-9-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral1/memory/2616-7-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral1/memory/2616-14-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral1/memory/2616-16-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral1/memory/2616-18-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral1/memory/2616-152-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral1/memory/2616-171-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral1/memory/2616-181-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral1/memory/2616-193-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral1/memory/2616-248-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral1/memory/2616-270-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral1/memory/2616-273-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral1/memory/2616-277-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral1/memory/2616-317-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral1/memory/2616-318-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral1/memory/2616-319-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral1/memory/2616-323-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral1/memory/2616-362-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral1/memory/2616-363-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral1/memory/2616-382-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral1/memory/2616-383-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral1/memory/2616-388-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral1/memory/2616-446-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral1/memory/2616-465-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 -
Vidar family
-
Uses browser remote debugging 2 TTPs 4 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 3016 chrome.exe 940 chrome.exe 2444 chrome.exe 2452 chrome.exe -
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule behavioral1/memory/2240-1-0x0000000001080000-0x00000000010E4000-memory.dmp net_reactor -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2240 set thread context of 2616 2240 Setup.exe 30 -
Program crash 1 IoCs
pid pid_target Process procid_target 2584 2240 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Setup.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies system certificate store 2 TTPs 3 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a Setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 Setup.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2616 Setup.exe 2616 Setup.exe 940 chrome.exe 940 chrome.exe 2616 Setup.exe 2616 Setup.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeShutdownPrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe Token: SeShutdownPrivilege 940 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe 940 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2616 2240 Setup.exe 30 PID 2240 wrote to memory of 2616 2240 Setup.exe 30 PID 2240 wrote to memory of 2616 2240 Setup.exe 30 PID 2240 wrote to memory of 2616 2240 Setup.exe 30 PID 2240 wrote to memory of 2616 2240 Setup.exe 30 PID 2240 wrote to memory of 2616 2240 Setup.exe 30 PID 2240 wrote to memory of 2616 2240 Setup.exe 30 PID 2240 wrote to memory of 2616 2240 Setup.exe 30 PID 2240 wrote to memory of 2616 2240 Setup.exe 30 PID 2240 wrote to memory of 2616 2240 Setup.exe 30 PID 2240 wrote to memory of 2616 2240 Setup.exe 30 PID 2240 wrote to memory of 2616 2240 Setup.exe 30 PID 2240 wrote to memory of 2616 2240 Setup.exe 30 PID 2240 wrote to memory of 2616 2240 Setup.exe 30 PID 2240 wrote to memory of 2616 2240 Setup.exe 30 PID 2240 wrote to memory of 2584 2240 Setup.exe 31 PID 2240 wrote to memory of 2584 2240 Setup.exe 31 PID 2240 wrote to memory of 2584 2240 Setup.exe 31 PID 2240 wrote to memory of 2584 2240 Setup.exe 31 PID 2616 wrote to memory of 940 2616 Setup.exe 34 PID 2616 wrote to memory of 940 2616 Setup.exe 34 PID 2616 wrote to memory of 940 2616 Setup.exe 34 PID 2616 wrote to memory of 940 2616 Setup.exe 34 PID 940 wrote to memory of 1752 940 chrome.exe 35 PID 940 wrote to memory of 1752 940 chrome.exe 35 PID 940 wrote to memory of 1752 940 chrome.exe 35 PID 940 wrote to memory of 908 940 chrome.exe 36 PID 940 wrote to memory of 908 940 chrome.exe 36 PID 940 wrote to memory of 908 940 chrome.exe 36 PID 940 wrote to memory of 2564 940 chrome.exe 38 PID 940 wrote to memory of 2564 940 chrome.exe 38 PID 940 wrote to memory of 2564 940 chrome.exe 38 PID 940 wrote to memory of 2564 940 chrome.exe 38 PID 940 wrote to memory of 2564 940 chrome.exe 38 PID 940 wrote to memory of 2564 940 chrome.exe 38 PID 940 wrote to memory of 2564 940 chrome.exe 38 PID 940 wrote to memory of 2564 940 chrome.exe 38 PID 940 wrote to memory of 2564 940 chrome.exe 38 PID 940 wrote to memory of 2564 940 chrome.exe 38 PID 940 wrote to memory of 2564 940 chrome.exe 38 PID 940 wrote to memory of 2564 940 chrome.exe 38 PID 940 wrote to memory of 2564 940 chrome.exe 38 PID 940 wrote to memory of 2564 940 chrome.exe 38 PID 940 wrote to memory of 2564 940 chrome.exe 38 PID 940 wrote to memory of 2564 940 chrome.exe 38 PID 940 wrote to memory of 2564 940 chrome.exe 38 PID 940 wrote to memory of 2564 940 chrome.exe 38 PID 940 wrote to memory of 2564 940 chrome.exe 38 PID 940 wrote to memory of 2564 940 chrome.exe 38 PID 940 wrote to memory of 2564 940 chrome.exe 38 PID 940 wrote to memory of 2564 940 chrome.exe 38 PID 940 wrote to memory of 2564 940 chrome.exe 38 PID 940 wrote to memory of 2564 940 chrome.exe 38 PID 940 wrote to memory of 2564 940 chrome.exe 38 PID 940 wrote to memory of 2564 940 chrome.exe 38 PID 940 wrote to memory of 2564 940 chrome.exe 38 PID 940 wrote to memory of 2564 940 chrome.exe 38 PID 940 wrote to memory of 2564 940 chrome.exe 38 PID 940 wrote to memory of 2564 940 chrome.exe 38 PID 940 wrote to memory of 2564 940 chrome.exe 38 PID 940 wrote to memory of 2564 940 chrome.exe 38 PID 940 wrote to memory of 2564 940 chrome.exe 38 PID 940 wrote to memory of 2564 940 chrome.exe 38 PID 940 wrote to memory of 2564 940 chrome.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"3⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7039758,0x7fef7039768,0x7fef70397784⤵PID:1752
-
-
C:\Windows\system32\ctfmon.exectfmon.exe4⤵PID:908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1136 --field-trial-handle=1280,i,4868949272211440855,3542539000615156037,131072 /prefetch:24⤵PID:2564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1412 --field-trial-handle=1280,i,4868949272211440855,3542539000615156037,131072 /prefetch:84⤵PID:3060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1604 --field-trial-handle=1280,i,4868949272211440855,3542539000615156037,131072 /prefetch:84⤵PID:552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1404 --field-trial-handle=1280,i,4868949272211440855,3542539000615156037,131072 /prefetch:14⤵
- Uses browser remote debugging
PID:2452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2272 --field-trial-handle=1280,i,4868949272211440855,3542539000615156037,131072 /prefetch:14⤵
- Uses browser remote debugging
PID:2444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1588 --field-trial-handle=1280,i,4868949272211440855,3542539000615156037,131072 /prefetch:24⤵PID:2204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1332 --field-trial-handle=1280,i,4868949272211440855,3542539000615156037,131072 /prefetch:14⤵
- Uses browser remote debugging
PID:3016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3540 --field-trial-handle=1280,i,4868949272211440855,3542539000615156037,131072 /prefetch:84⤵PID:1152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3148 --field-trial-handle=1280,i,4868949272211440855,3542539000615156037,131072 /prefetch:84⤵PID:2332
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 6402⤵
- Program crash
PID:2584
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2468
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Authentication Process
1Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51aa9b8f0aed413e74c6cbb15f27342bb
SHA17a222ef8ab82bb53c65a6b8d757a154492e51af3
SHA256c24740b98ff554c8c199c65d61fd79717c8a397b329bfc2145064ad39473d2d1
SHA512f69b0a8eb9b23b9277fa32c7c671269817401a7abaad18f6c73615257e29bcde9ab10d5ae3a00010b572c60210d14d6f3d0c910872c84cb8c2c7b78845d58c25
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b