Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20250207-en -
resource tags
arch:x64arch:x86image:win11-20250207-enlocale:en-usos:windows11-21h2-x64system -
submitted
08/02/2025, 15:20
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10ltsc2021-20250207-en
Behavioral task
behavioral3
Sample
Setup.exe
Resource
win11-20250207-en
General
-
Target
Setup.exe
-
Size
360KB
-
MD5
216340f456c7adb3db07da2b551e1066
-
SHA1
a9623a90d83ac30a74f52ff9042647d4dad473ec
-
SHA256
aa226ab5c6754cbbf77de7e20a0bf76529cd7a7b1066df846c15aa89f6cbd0a1
-
SHA512
8625016bf03fb6b1cedf18371eb2fafa77f10df33ebf09ffa74ca0d79616dbf5544c72ab85317e06d8a8a97980b23681dddf88ce3df06f8df4f3ba68b15c3cbb
-
SSDEEP
6144:O/a19BSfmQl2G0GI++lx19BSfmQl2G0GI++lM:P19inIT19inIe
Malware Config
Extracted
vidar
https://t.me/sok33tn
https://steamcommunity.com/profiles/76561199824159981
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0
Signatures
-
Detect Vidar Stealer 41 IoCs
resource yara_rule behavioral3/memory/3132-4-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/3132-5-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/3132-6-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/4536-10-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/4536-11-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/3132-9-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/3132-14-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/3132-15-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/3132-16-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/3132-17-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/3132-46-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/4536-47-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/3132-59-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/4536-60-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/3132-63-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/3132-64-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/4536-65-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/4536-66-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/3132-70-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/4536-72-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/3132-76-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/3132-77-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/3132-78-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/3132-80-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/3132-87-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/3132-99-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/3132-157-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/3132-158-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/3132-162-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/3132-166-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/3132-167-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/3132-168-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/3132-172-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/3132-173-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/3132-178-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/3132-179-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/3132-180-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/3132-181-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/3132-186-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/3132-187-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 behavioral3/memory/3132-188-0x0000000000400000-0x0000000000422000-memory.dmp family_vidar_v7 -
Vidar family
-
Downloads MZ/PE file 1 IoCs
flow pid Process 44 3768 Process not Found -
Uses browser remote debugging 2 TTPs 9 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 4472 chrome.exe 3872 chrome.exe 5040 msedge.exe 3872 msedge.exe 2808 msedge.exe 4308 chrome.exe 2832 chrome.exe 1920 msedge.exe 4300 msedge.exe -
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule behavioral3/memory/1812-1-0x0000000000490000-0x00000000004F4000-memory.dmp net_reactor -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1812 set thread context of 3132 1812 Setup.exe 81 PID 1812 set thread context of 4536 1812 Setup.exe 83 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 5016 1812 WerFault.exe 80 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3740 MicrosoftEdgeUpdate.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Setup.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Setup.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Setup.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 3132 Setup.exe 3132 Setup.exe 3132 Setup.exe 3132 Setup.exe 4472 chrome.exe 4472 chrome.exe 4536 Setup.exe 4536 Setup.exe 3132 Setup.exe 3132 Setup.exe 3132 Setup.exe 3132 Setup.exe 4824 msedge.exe 4824 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 3764 identity_helper.exe 3764 identity_helper.exe 3132 Setup.exe 3132 Setup.exe 3132 Setup.exe 3132 Setup.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4472 chrome.exe 4472 chrome.exe 4472 chrome.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeShutdownPrivilege 4472 chrome.exe Token: SeCreatePagefilePrivilege 4472 chrome.exe Token: SeShutdownPrivilege 4472 chrome.exe Token: SeCreatePagefilePrivilege 4472 chrome.exe Token: SeShutdownPrivilege 4472 chrome.exe Token: SeCreatePagefilePrivilege 4472 chrome.exe Token: SeShutdownPrivilege 4472 chrome.exe Token: SeCreatePagefilePrivilege 4472 chrome.exe Token: SeShutdownPrivilege 4472 chrome.exe Token: SeCreatePagefilePrivilege 4472 chrome.exe Token: SeShutdownPrivilege 4472 chrome.exe Token: SeCreatePagefilePrivilege 4472 chrome.exe Token: SeShutdownPrivilege 4472 chrome.exe Token: SeCreatePagefilePrivilege 4472 chrome.exe -
Suspicious use of FindShellTrayWindow 51 IoCs
pid Process 4472 chrome.exe 4472 chrome.exe 4472 chrome.exe 4472 chrome.exe 4472 chrome.exe 4472 chrome.exe 4472 chrome.exe 4472 chrome.exe 4472 chrome.exe 4472 chrome.exe 4472 chrome.exe 4472 chrome.exe 4472 chrome.exe 4472 chrome.exe 4472 chrome.exe 4472 chrome.exe 4472 chrome.exe 4472 chrome.exe 4472 chrome.exe 4472 chrome.exe 4472 chrome.exe 4472 chrome.exe 4472 chrome.exe 4472 chrome.exe 4472 chrome.exe 4472 chrome.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1812 wrote to memory of 3132 1812 Setup.exe 81 PID 1812 wrote to memory of 3132 1812 Setup.exe 81 PID 1812 wrote to memory of 3132 1812 Setup.exe 81 PID 1812 wrote to memory of 3132 1812 Setup.exe 81 PID 1812 wrote to memory of 3132 1812 Setup.exe 81 PID 1812 wrote to memory of 3132 1812 Setup.exe 81 PID 1812 wrote to memory of 3132 1812 Setup.exe 81 PID 1812 wrote to memory of 3132 1812 Setup.exe 81 PID 1812 wrote to memory of 3132 1812 Setup.exe 81 PID 1812 wrote to memory of 3132 1812 Setup.exe 81 PID 1812 wrote to memory of 3132 1812 Setup.exe 81 PID 1812 wrote to memory of 444 1812 Setup.exe 82 PID 1812 wrote to memory of 444 1812 Setup.exe 82 PID 1812 wrote to memory of 444 1812 Setup.exe 82 PID 1812 wrote to memory of 4536 1812 Setup.exe 83 PID 1812 wrote to memory of 4536 1812 Setup.exe 83 PID 1812 wrote to memory of 4536 1812 Setup.exe 83 PID 1812 wrote to memory of 4536 1812 Setup.exe 83 PID 1812 wrote to memory of 4536 1812 Setup.exe 83 PID 1812 wrote to memory of 4536 1812 Setup.exe 83 PID 1812 wrote to memory of 4536 1812 Setup.exe 83 PID 1812 wrote to memory of 4536 1812 Setup.exe 83 PID 1812 wrote to memory of 4536 1812 Setup.exe 83 PID 1812 wrote to memory of 4536 1812 Setup.exe 83 PID 1812 wrote to memory of 4536 1812 Setup.exe 83 PID 3132 wrote to memory of 4472 3132 Setup.exe 87 PID 3132 wrote to memory of 4472 3132 Setup.exe 87 PID 4472 wrote to memory of 3088 4472 chrome.exe 88 PID 4472 wrote to memory of 3088 4472 chrome.exe 88 PID 4472 wrote to memory of 3312 4472 chrome.exe 90 PID 4472 wrote to memory of 3312 4472 chrome.exe 90 PID 4472 wrote to memory of 3312 4472 chrome.exe 90 PID 4472 wrote to memory of 3312 4472 chrome.exe 90 PID 4472 wrote to memory of 3312 4472 chrome.exe 90 PID 4472 wrote to memory of 3312 4472 chrome.exe 90 PID 4472 wrote to memory of 3312 4472 chrome.exe 90 PID 4472 wrote to memory of 3312 4472 chrome.exe 90 PID 4472 wrote to memory of 3312 4472 chrome.exe 90 PID 4472 wrote to memory of 3312 4472 chrome.exe 90 PID 4472 wrote to memory of 3312 4472 chrome.exe 90 PID 4472 wrote to memory of 3312 4472 chrome.exe 90 PID 4472 wrote to memory of 3312 4472 chrome.exe 90 PID 4472 wrote to memory of 3312 4472 chrome.exe 90 PID 4472 wrote to memory of 3312 4472 chrome.exe 90 PID 4472 wrote to memory of 3312 4472 chrome.exe 90 PID 4472 wrote to memory of 3312 4472 chrome.exe 90 PID 4472 wrote to memory of 3312 4472 chrome.exe 90 PID 4472 wrote to memory of 3312 4472 chrome.exe 90 PID 4472 wrote to memory of 3312 4472 chrome.exe 90 PID 4472 wrote to memory of 3312 4472 chrome.exe 90 PID 4472 wrote to memory of 3312 4472 chrome.exe 90 PID 4472 wrote to memory of 3312 4472 chrome.exe 90 PID 4472 wrote to memory of 3312 4472 chrome.exe 90 PID 4472 wrote to memory of 3312 4472 chrome.exe 90 PID 4472 wrote to memory of 3312 4472 chrome.exe 90 PID 4472 wrote to memory of 3312 4472 chrome.exe 90 PID 4472 wrote to memory of 3312 4472 chrome.exe 90 PID 4472 wrote to memory of 3312 4472 chrome.exe 90 PID 4472 wrote to memory of 3312 4472 chrome.exe 90 PID 4472 wrote to memory of 2452 4472 chrome.exe 91 PID 4472 wrote to memory of 2452 4472 chrome.exe 91 PID 4472 wrote to memory of 2808 4472 chrome.exe 130 PID 4472 wrote to memory of 2808 4472 chrome.exe 130 PID 4472 wrote to memory of 2808 4472 chrome.exe 130
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"3⤵
- Uses browser remote debugging
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8449acc40,0x7ff8449acc4c,0x7ff8449acc584⤵PID:3088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1808,i,2340286858960727819,17081268168552061879,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=1804 /prefetch:24⤵PID:3312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2088,i,2340286858960727819,17081268168552061879,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=2104 /prefetch:34⤵PID:2452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2180,i,2340286858960727819,17081268168552061879,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=2296 /prefetch:84⤵PID:2808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3124,i,2340286858960727819,17081268168552061879,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=3144 /prefetch:14⤵
- Uses browser remote debugging
PID:4308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3164,i,2340286858960727819,17081268168552061879,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=3328 /prefetch:14⤵
- Uses browser remote debugging
PID:3872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4208,i,2340286858960727819,17081268168552061879,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=4408 /prefetch:14⤵
- Uses browser remote debugging
PID:2832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4448,i,2340286858960727819,17081268168552061879,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=4568 /prefetch:84⤵PID:416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4608,i,2340286858960727819,17081268168552061879,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=4820 /prefetch:84⤵PID:3524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4928,i,2340286858960727819,17081268168552061879,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=4744 /prefetch:84⤵PID:4728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4812,i,2340286858960727819,17081268168552061879,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=4956 /prefetch:84⤵PID:1344
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"3⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:1920 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8449b3cb8,0x7ff8449b3cc8,0x7ff8449b3cd84⤵PID:1180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1828,13346458812502416625,11663654713554279460,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1836 /prefetch:24⤵PID:4052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1828,13346458812502416625,11663654713554279460,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:4824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1828,13346458812502416625,11663654713554279460,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:84⤵PID:4596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1828,13346458812502416625,11663654713554279460,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:14⤵
- Uses browser remote debugging
PID:4300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1828,13346458812502416625,11663654713554279460,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:14⤵
- Uses browser remote debugging
PID:5040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1828,13346458812502416625,11663654713554279460,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1764 /prefetch:24⤵PID:1684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1828,13346458812502416625,11663654713554279460,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2560 /prefetch:24⤵PID:4496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1828,13346458812502416625,11663654713554279460,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=4448 /prefetch:24⤵PID:4708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1828,13346458812502416625,11663654713554279460,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=4800 /prefetch:24⤵PID:240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1828,13346458812502416625,11663654713554279460,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=5008 /prefetch:24⤵PID:1156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1828,13346458812502416625,11663654713554279460,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:14⤵
- Uses browser remote debugging
PID:2808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1828,13346458812502416625,11663654713554279460,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2272 /prefetch:14⤵
- Uses browser remote debugging
PID:3872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1828,13346458812502416625,11663654713554279460,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3540 /prefetch:84⤵PID:3456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1828,13346458812502416625,11663654713554279460,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3540 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
PID:3764
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵PID:444
-
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4536
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 10402⤵
- Program crash
PID:5016
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1812 -ip 18121⤵PID:3016
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:4520
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTUxQzE1MkEtMDI2QS00NDEyLTg1QjgtODYwNjc5NTgzQThFfSIgdXNlcmlkPSJ7QkFFQ0I2QzAtNDg3Qi00MjA1LTg0NjgtQzkwRjZDMjBDMDRFfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7Q0VCRTVCRkMtN0MwOS00M0UxLTk2NkQtN0E0RTFBNjQ4NzVDfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RSt4YkF6Nlk2c1UxMjg5YlM2cWw0VlJMYmtqZkJVR1RNSnNqckhyNDRpST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjAiIGluc3RhbGxkYXRldGltZT0iMTczODk1Njc0OSIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzgzNDI5MTcwNDQ2MDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxNzk4NjIiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ3MjU0NDQ1MTgiLz48L2FwcD48L3JlcXVlc3Q-1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:3740
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:464
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
152B
MD54628ce823b680e8bd4c0f6e8a7e4f594
SHA1732b8562e98ecd61d7fa6b65c96f693ad11bddce
SHA2567d0e4d992d4de273ea0382d74f0866e797f82190bc3ea9e1da6db8b4c787a6c8
SHA51223b524b9bf613cc80e7c1fa88fb34b84f8685f05f6166d38f8f0db2293df38aafd66f53d49b25cfc1e6e9ddcb5db32a4091aeb66469643071821cd70377dd715
-
Filesize
152B
MD53311a2e01e7e24dba4d8c8708e7dcf79
SHA1c946b74b4ec406d294ae27c44bc9271682eb7325
SHA256bcd13e4489dab8dae8eaf9ff625dde07fac3adc5122e0e29a56f153f8042f487
SHA512967b425a03eaece19a8f90414183ec02a9362ce1c962b2a0faf6079e986f21f560ebe86b3674d2ec96f207bd21e050a5de45b9b7a6e57da6a2b1b47584af05d3
-
Filesize
5KB
MD5d3ae732d06a1135655348dc0bd53e301
SHA110daabbbe8c753a24aebcfd400d68dba476714ee
SHA256c4697f37b4050caa7efa0b9eac3df35007d0af4263b29be053ce5d7de82d11fd
SHA51206d18215018f244fe518a25603115104df90750b6562db6c9ee6ceff348ccde4e1155ad4b2a0d7b871256fcc147a79ae4af280f1bcb87810e43bb9b88c39cb26
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58