vidar | 44b6943b892a5d5268857efa67cd5a2afe60852bd321aceba607ada1fed0d2cd

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20250207-en
resource tags

arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
submitted
08-02-2025 16:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa226ab5c6754cbbf77de7e20a0bf76529cd7a7b1066df846c15aa89f6cbd0a1.exe
Size

360KB
MD5

216340f456c7adb3db07da2b551e1066
SHA1

a9623a90d83ac30a74f52ff9042647d4dad473ec
SHA256

aa226ab5c6754cbbf77de7e20a0bf76529cd7a7b1066df846c15aa89f6cbd0a1
SHA512

8625016bf03fb6b1cedf18371eb2fafa77f10df33ebf09ffa74ca0d79616dbf5544c72ab85317e06d8a8a97980b23681dddf88ce3df06f8df4f3ba68b15c3cbb
SSDEEP

6144:O/a19BSfmQl2G0GI++lx19BSfmQl2G0GI++lM:P19inIT19inIe

Score

10^/10

vidar credential_access discovery spyware stealer

Malware Config

Extracted

Family

vidar

https://t.me/sok33tn

https://steamcommunity.com/profiles/76561199824159981

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0

Signatures

Detect Vidar Stealer 25 IoCs

stealer

resource	yara_rule
behavioral1/memory/2252-4-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7
behavioral1/memory/2252-5-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7
behavioral1/memory/2252-6-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7
behavioral1/memory/2252-8-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7
behavioral1/memory/2252-16-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7
behavioral1/memory/2252-17-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7
behavioral1/memory/2252-18-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7
behavioral1/memory/2252-19-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7
behavioral1/memory/2252-57-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7
behavioral1/memory/2252-58-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7
behavioral1/memory/2252-61-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7
behavioral1/memory/2252-65-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7
behavioral1/memory/2252-69-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7
behavioral1/memory/2252-70-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7
behavioral1/memory/2252-72-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7
behavioral1/memory/2252-73-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7
behavioral1/memory/2252-148-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7
behavioral1/memory/2252-149-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7
behavioral1/memory/2252-152-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7
behavioral1/memory/2252-153-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7
behavioral1/memory/2252-157-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7
behavioral1/memory/2252-158-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7
behavioral1/memory/2252-162-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7
behavioral1/memory/2252-163-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7
behavioral1/memory/2252-168-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Downloads MZ/PE file 1 IoCs

flow	pid	Process
34	4024	Process not Found

Uses browser remote debugging 2 TTPs 9 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
1968	chrome.exe
772	msedge.exe
4244	msedge.exe
2916	msedge.exe
3612	chrome.exe
3148	chrome.exe
464	chrome.exe
2064	msedge.exe
64	msedge.exe

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/memory/2860-1-0x00000000000B0000-0x0000000000114000-memory.dmp	net_reactor

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2860 set thread context of 2252	2860	aa226ab5c6754cbbf77de7e20a0bf76529cd7a7b1066df846c15aa89f6cbd0a1.exe	89

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1228	2860	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aa226ab5c6754cbbf77de7e20a0bf76529cd7a7b1066df846c15aa89f6cbd0a1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aa226ab5c6754cbbf77de7e20a0bf76529cd7a7b1066df846c15aa89f6cbd0a1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1624	MicrosoftEdgeUpdate.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	aa226ab5c6754cbbf77de7e20a0bf76529cd7a7b1066df846c15aa89f6cbd0a1.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	aa226ab5c6754cbbf77de7e20a0bf76529cd7a7b1066df846c15aa89f6cbd0a1.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133835725165352347"	chrome.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
2252	aa226ab5c6754cbbf77de7e20a0bf76529cd7a7b1066df846c15aa89f6cbd0a1.exe
2252	aa226ab5c6754cbbf77de7e20a0bf76529cd7a7b1066df846c15aa89f6cbd0a1.exe
2252	aa226ab5c6754cbbf77de7e20a0bf76529cd7a7b1066df846c15aa89f6cbd0a1.exe
2252	aa226ab5c6754cbbf77de7e20a0bf76529cd7a7b1066df846c15aa89f6cbd0a1.exe
1968	chrome.exe
1968	chrome.exe
2252	aa226ab5c6754cbbf77de7e20a0bf76529cd7a7b1066df846c15aa89f6cbd0a1.exe
2252	aa226ab5c6754cbbf77de7e20a0bf76529cd7a7b1066df846c15aa89f6cbd0a1.exe
2252	aa226ab5c6754cbbf77de7e20a0bf76529cd7a7b1066df846c15aa89f6cbd0a1.exe
2252	aa226ab5c6754cbbf77de7e20a0bf76529cd7a7b1066df846c15aa89f6cbd0a1.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
520	msedge.exe
520	msedge.exe
772	msedge.exe
772	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2252	aa226ab5c6754cbbf77de7e20a0bf76529cd7a7b1066df846c15aa89f6cbd0a1.exe
2252	aa226ab5c6754cbbf77de7e20a0bf76529cd7a7b1066df846c15aa89f6cbd0a1.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe
Token: SeShutdownPrivilege	1968	chrome.exe
Token: SeCreatePagefilePrivilege	1968	chrome.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2252	2860	aa226ab5c6754cbbf77de7e20a0bf76529cd7a7b1066df846c15aa89f6cbd0a1.exe	89
PID 2860 wrote to memory of 2252	2860	aa226ab5c6754cbbf77de7e20a0bf76529cd7a7b1066df846c15aa89f6cbd0a1.exe	89
PID 2860 wrote to memory of 2252	2860	aa226ab5c6754cbbf77de7e20a0bf76529cd7a7b1066df846c15aa89f6cbd0a1.exe	89
PID 2860 wrote to memory of 2252	2860	aa226ab5c6754cbbf77de7e20a0bf76529cd7a7b1066df846c15aa89f6cbd0a1.exe	89
PID 2860 wrote to memory of 2252	2860	aa226ab5c6754cbbf77de7e20a0bf76529cd7a7b1066df846c15aa89f6cbd0a1.exe	89
PID 2860 wrote to memory of 2252	2860	aa226ab5c6754cbbf77de7e20a0bf76529cd7a7b1066df846c15aa89f6cbd0a1.exe	89
PID 2860 wrote to memory of 2252	2860	aa226ab5c6754cbbf77de7e20a0bf76529cd7a7b1066df846c15aa89f6cbd0a1.exe	89
PID 2860 wrote to memory of 2252	2860	aa226ab5c6754cbbf77de7e20a0bf76529cd7a7b1066df846c15aa89f6cbd0a1.exe	89
PID 2860 wrote to memory of 2252	2860	aa226ab5c6754cbbf77de7e20a0bf76529cd7a7b1066df846c15aa89f6cbd0a1.exe	89
PID 2860 wrote to memory of 2252	2860	aa226ab5c6754cbbf77de7e20a0bf76529cd7a7b1066df846c15aa89f6cbd0a1.exe	89
PID 2860 wrote to memory of 2252	2860	aa226ab5c6754cbbf77de7e20a0bf76529cd7a7b1066df846c15aa89f6cbd0a1.exe	89
PID 2252 wrote to memory of 1968	2252	aa226ab5c6754cbbf77de7e20a0bf76529cd7a7b1066df846c15aa89f6cbd0a1.exe	98
PID 2252 wrote to memory of 1968	2252	aa226ab5c6754cbbf77de7e20a0bf76529cd7a7b1066df846c15aa89f6cbd0a1.exe	98
PID 1968 wrote to memory of 3236	1968	chrome.exe	99
PID 1968 wrote to memory of 3236	1968	chrome.exe	99
PID 1968 wrote to memory of 3212	1968	chrome.exe	100
PID 1968 wrote to memory of 3212	1968	chrome.exe	100
PID 1968 wrote to memory of 3212	1968	chrome.exe	100
PID 1968 wrote to memory of 3212	1968	chrome.exe	100
PID 1968 wrote to memory of 3212	1968	chrome.exe	100
PID 1968 wrote to memory of 3212	1968	chrome.exe	100
PID 1968 wrote to memory of 3212	1968	chrome.exe	100
PID 1968 wrote to memory of 3212	1968	chrome.exe	100
PID 1968 wrote to memory of 3212	1968	chrome.exe	100
PID 1968 wrote to memory of 3212	1968	chrome.exe	100
PID 1968 wrote to memory of 3212	1968	chrome.exe	100
PID 1968 wrote to memory of 3212	1968	chrome.exe	100
PID 1968 wrote to memory of 3212	1968	chrome.exe	100
PID 1968 wrote to memory of 3212	1968	chrome.exe	100
PID 1968 wrote to memory of 3212	1968	chrome.exe	100
PID 1968 wrote to memory of 3212	1968	chrome.exe	100
PID 1968 wrote to memory of 3212	1968	chrome.exe	100
PID 1968 wrote to memory of 3212	1968	chrome.exe	100
PID 1968 wrote to memory of 3212	1968	chrome.exe	100
PID 1968 wrote to memory of 3212	1968	chrome.exe	100
PID 1968 wrote to memory of 3212	1968	chrome.exe	100
PID 1968 wrote to memory of 3212	1968	chrome.exe	100
PID 1968 wrote to memory of 3212	1968	chrome.exe	100
PID 1968 wrote to memory of 3212	1968	chrome.exe	100
PID 1968 wrote to memory of 3212	1968	chrome.exe	100
PID 1968 wrote to memory of 3212	1968	chrome.exe	100
PID 1968 wrote to memory of 3212	1968	chrome.exe	100
PID 1968 wrote to memory of 3212	1968	chrome.exe	100
PID 1968 wrote to memory of 3212	1968	chrome.exe	100
PID 1968 wrote to memory of 3212	1968	chrome.exe	100
PID 1968 wrote to memory of 4468	1968	chrome.exe	101
PID 1968 wrote to memory of 4468	1968	chrome.exe	101
PID 1968 wrote to memory of 3892	1968	chrome.exe	102
PID 1968 wrote to memory of 3892	1968	chrome.exe	102
PID 1968 wrote to memory of 3892	1968	chrome.exe	102
PID 1968 wrote to memory of 3892	1968	chrome.exe	102
PID 1968 wrote to memory of 3892	1968	chrome.exe	102
PID 1968 wrote to memory of 3892	1968	chrome.exe	102
PID 1968 wrote to memory of 3892	1968	chrome.exe	102
PID 1968 wrote to memory of 3892	1968	chrome.exe	102
PID 1968 wrote to memory of 3892	1968	chrome.exe	102
PID 1968 wrote to memory of 3892	1968	chrome.exe	102
PID 1968 wrote to memory of 3892	1968	chrome.exe	102
PID 1968 wrote to memory of 3892	1968	chrome.exe	102
PID 1968 wrote to memory of 3892	1968	chrome.exe	102
PID 1968 wrote to memory of 3892	1968	chrome.exe	102
PID 1968 wrote to memory of 3892	1968	chrome.exe	102
PID 1968 wrote to memory of 3892	1968	chrome.exe	102
PID 1968 wrote to memory of 3892	1968	chrome.exe	102

C:\Users\Admin\AppData\Local\Temp\aa226ab5c6754cbbf77de7e20a0bf76529cd7a7b1066df846c15aa89f6cbd0a1.exe
"C:\Users\Admin\AppData\Local\Temp\aa226ab5c6754cbbf77de7e20a0bf76529cd7a7b1066df846c15aa89f6cbd0a1.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Users\Admin\AppData\Local\Temp\aa226ab5c6754cbbf77de7e20a0bf76529cd7a7b1066df846c15aa89f6cbd0a1.exe
  "C:\Users\Admin\AppData\Local\Temp\aa226ab5c6754cbbf77de7e20a0bf76529cd7a7b1066df846c15aa89f6cbd0a1.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1968
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd02dfcc40,0x7ffd02dfcc4c,0x7ffd02dfcc58
      4⤵
      PID:3236
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1968,i,3485685430556941121,17760273353744330479,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=1964 /prefetch:2
      4⤵
      PID:3212
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1528,i,3485685430556941121,17760273353744330479,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=2040 /prefetch:3
      4⤵
      PID:4468
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2300,i,3485685430556941121,17760273353744330479,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=2492 /prefetch:8
      4⤵
      PID:3892
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3172,i,3485685430556941121,17760273353744330479,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=3192 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3612
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3200,i,3485685430556941121,17760273353744330479,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=3232 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3148
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4424,i,3485685430556941121,17760273353744330479,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=4168 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:464
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4720,i,3485685430556941121,17760273353744330479,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=4484 /prefetch:8
      4⤵
      PID:4448
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4768,i,3485685430556941121,17760273353744330479,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=4760 /prefetch:8
      4⤵
      PID:904
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4476,i,3485685430556941121,17760273353744330479,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=4708 /prefetch:8
      4⤵
      PID:4420
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4716,i,3485685430556941121,17760273353744330479,262144 --variations-seed-version=20250207-050113.109000 --mojo-platform-channel-handle=4764 /prefetch:8
      4⤵
      PID:3416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd02e046f8,0x7ffd02e04708,0x7ffd02e04718
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      PID:2840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,10545604145028546924,14773824898638539665,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
      4⤵
      PID:2592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,10545604145028546924,14773824898638539665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,10545604145028546924,14773824898638539665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
      4⤵
      PID:1852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2180,10545604145028546924,14773824898638539665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2180,10545604145028546924,14773824898638539665,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2180,10545604145028546924,14773824898638539665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2180,10545604145028546924,14773824898638539665,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:64
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,10545604145028546924,14773824898638539665,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
      4⤵
      PID:2056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 812
  2⤵
  - Program crash
  PID:1228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2860 -ip 2860
1⤵
PID:1760

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MjhBODNEREQtMzU2Ni00M0FBLUJFQUUtOUFGRUU2MTE3RDM4fSIgdXNlcmlkPSJ7RjQ4MUNCQzUtRTRENS00QzEyLTg4QzUtQzJFMjk0REM2NkU5fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QTc1MDlCOUMtNjdGQS00NkZGLTkwMzgtQzUzOTkwOTQ4RkQyfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDY0MzMiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODc1OTU2NTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MDMzODIxNDk5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:1624

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
126KB

MD5
55dc11a475868c5844f1d886927e62e3

SHA1
22d47615ba64dc6832e14932a840cf5caebe8f0b

SHA256
e41628bceb1b1b1f0fb90f648bbc8fe89fd2b3de422e888648dbd73c71e2992c

SHA512
81fadd9ad2550e86351375e15b9a53a31e7c5521b06ca84d34a3218a8f25c4d8227b0ad03e5df741a5c43c1b108c2227b88a2910ed246ac69cc92256c2d4a82a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\9fd3d141-72a4-454b-ade6-b07e2209a9f4.dmp

Filesize
826KB

MD5
0ef9c907d3c4ee3b0c552272e6a1bdb4

SHA1
9a352d925ba0b0bb5ea9895be808f5e2caad1c0e

SHA256
f8863974175dbb910fbc9a9f599f7ef1e8ee4f263c42dab189659ec05dae2e7f

SHA512
ba543487f59758aa872d1779ff006e2f7044aec7eb7102c5de43763fc57d96567869f72ad42b4b6ff2f80c352024ba74bceeba621081f28a5935c899a410a0c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1669bda2faa102829d67a654a8113ee2

SHA1
eabfd9b6485c27455e6a676e8efa300a6efbc261

SHA256
4215ebbc7f659c2dbaa36c3c9b0316263b16243d2e213146f9e12d6335c83d62

SHA512
c2d5a8c54d597815ec47634de0a583f3dcf1fc510ec4a39b6d7455f39f36949f02d40acf7fb962865c63ee68ddaa9ff4e7e5b885a2926d339a2ffc5d5867125c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
295568b858cc6dd30e8eced3638eec7d

SHA1
c0b59c5bf28be1a6b9ae90708caa52ffd564838e

SHA256
3791807df84354d4c60d3c614eb059992321fc86375561dbd35e11def84c6a81

SHA512
38bb32014edfd0e417f7a2bec8a782420d558a1dcd5adfc9732ab1b89272bf43ce9fd64110b7d541e24666a2afca4a8a836706af7805a39b0b4de015849a370b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fcf94d924e300004c62e049d61583507

SHA1
8766787aaa4da97473871889984cef4d7f766400

SHA256
473cd69192e6702bccf48922210fe7a989dff989c9560094823e408d51327901

SHA512
6cba5f48d335d3bc9ebc25d1ecfd68a3dad77c084c940e69ee05081cf88605f68951b6daacbdc2ca7388a306132419be1c13e1b4a18b1402a7bff6381cc626b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1ad5b9f5ab3af68f86f59162e2fb9e49

SHA1
0e134761ca20382c2e9c8e94029245c6b1ca87f2

SHA256
040e6672c0191e42d95d9a8e68870f41962f2a6c6e9ae65a0c548c6be08c4fd6

SHA512
e599f945330ca79cbfd28a338c9a0329e8099c82f18037b457c64be48a7de039918bde2d2aba353903b07b92f79f3b506428ec711afaf1d765c468de24d20571

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a142ef5429f9e8a3d4ab5c2c656f9e29

SHA1
db94952e6ae3de60a4a4071a20152ef4150dc0a6

SHA256
3b4704b0abeaceb41c5589f1df385981570e1f73230362d06745608e436b4141

SHA512
110222b7302f03525f7c4bfde8deceda7a9ff1c90b5aa7fe1316c8d49ef45bfdbc8af82322800af1d13d881476897e5815494470eba5856fb3356ef7d3db66ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
01895751b692a93709f89d73aa81091e

SHA1
0f23e375fff82edc8e7dfa85ac61348145bb70f9

SHA256
25820839a15e50683d3b6067e7b54e2cf881c38cf83728246bcff7078e7c0d85

SHA512
4d157f4dec32d062bed1df79e2107c1d7cdf4ad251922ffc6cc4d177b0f458c66a9ca73c4116c36f022086e9309520396647b98b3640185395714e86ae165b3a

Download Submit
memory/2252-17-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2252-6-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2252-18-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2252-168-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2252-16-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2252-57-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2252-58-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2252-61-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2252-65-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2252-69-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2252-70-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2252-72-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2252-73-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2252-8-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2252-163-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2252-19-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2252-5-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2252-4-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2252-162-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2252-158-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2252-148-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2252-149-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2252-152-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2252-153-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2252-157-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2860-1-0x00000000000B0000-0x0000000000114000-memory.dmp

Filesize
400KB

Download
memory/2860-2-0x0000000004F10000-0x00000000054B4000-memory.dmp

Filesize
5.6MB

Download
memory/2860-7-0x00000000744D0000-0x0000000074C80000-memory.dmp

Filesize
7.7MB

Download
memory/2860-0-0x00000000744DE000-0x00000000744DF000-memory.dmp

Filesize
4KB

Download