vidar | d0ebe35a902832fbd856e5a03d770c5cf1d7ba9c9418a51bda6d9b0698771841

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12-02-2025 21:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

pothjasefdj.exe
Size

120KB
MD5

c6ddc5c9dad56fd85bf6199b38c09120
SHA1

299bc508a4c1a603789b7c5aa166713b3428f2e0
SHA256

d0ebe35a902832fbd856e5a03d770c5cf1d7ba9c9418a51bda6d9b0698771841
SHA512

41668f9c2231769aa8c919166b964d0161b2cde4c0efd175b5f3bdb25906496ed045366fb1c25439663e98f483f43bc4e56fa4891abd3cd5abb3bbbfdcf69e40
SSDEEP

3072:FEFRh0auCcJVwDjwzTC2SCn/FtVQenIuxIGWsnRR9pLTfQvXeD:W3h0aMJ+Hw3Pgen79/IvO

Score

10^/10

vidar credential_access discovery spyware stealer

Malware Config

Extracted

Family

vidar

https://t.me/b4cha00

https://steamcommunity.com/profiles/76561199825403037

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:137.0) Gecko/20100101 Firefox/137.0

Signatures

Detect Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral1/memory/2044-0-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7
behavioral1/memory/2044-401-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Uses browser remote debugging 2 TTPs 4 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
520	chrome.exe
2056	chrome.exe
2388	chrome.exe
2108	chrome.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pothjasefdj.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	pothjasefdj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	pothjasefdj.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	pothjasefdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	pothjasefdj.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	pothjasefdj.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2044	pothjasefdj.exe
2044	pothjasefdj.exe
520	chrome.exe
520	chrome.exe
2044	pothjasefdj.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeShutdownPrivilege	520	chrome.exe
Token: SeShutdownPrivilege	520	chrome.exe
Token: SeShutdownPrivilege	520	chrome.exe
Token: SeShutdownPrivilege	520	chrome.exe
Token: SeShutdownPrivilege	520	chrome.exe
Token: SeShutdownPrivilege	520	chrome.exe
Token: SeShutdownPrivilege	520	chrome.exe
Token: SeShutdownPrivilege	520	chrome.exe
Token: SeShutdownPrivilege	520	chrome.exe
Token: SeShutdownPrivilege	520	chrome.exe
Token: SeShutdownPrivilege	520	chrome.exe
Token: SeShutdownPrivilege	520	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
520	chrome.exe
520	chrome.exe
520	chrome.exe
520	chrome.exe
520	chrome.exe
520	chrome.exe
520	chrome.exe
520	chrome.exe
520	chrome.exe
520	chrome.exe
520	chrome.exe
520	chrome.exe
520	chrome.exe
520	chrome.exe
520	chrome.exe
520	chrome.exe
520	chrome.exe
520	chrome.exe
520	chrome.exe
520	chrome.exe
520	chrome.exe
520	chrome.exe
520	chrome.exe
520	chrome.exe
520	chrome.exe
520	chrome.exe
520	chrome.exe
520	chrome.exe
520	chrome.exe
520	chrome.exe
520	chrome.exe
520	chrome.exe
520	chrome.exe
520	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 520	2044	pothjasefdj.exe	31
PID 2044 wrote to memory of 520	2044	pothjasefdj.exe	31
PID 2044 wrote to memory of 520	2044	pothjasefdj.exe	31
PID 2044 wrote to memory of 520	2044	pothjasefdj.exe	31
PID 520 wrote to memory of 2384	520	chrome.exe	32
PID 520 wrote to memory of 2384	520	chrome.exe	32
PID 520 wrote to memory of 2384	520	chrome.exe	32
PID 520 wrote to memory of 1992	520	chrome.exe	33
PID 520 wrote to memory of 1992	520	chrome.exe	33
PID 520 wrote to memory of 1992	520	chrome.exe	33
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 1420	520	chrome.exe	35
PID 520 wrote to memory of 960	520	chrome.exe	36
PID 520 wrote to memory of 960	520	chrome.exe	36
PID 520 wrote to memory of 960	520	chrome.exe	36
PID 520 wrote to memory of 1356	520	chrome.exe	37
PID 520 wrote to memory of 1356	520	chrome.exe	37
PID 520 wrote to memory of 1356	520	chrome.exe	37
PID 520 wrote to memory of 1356	520	chrome.exe	37
PID 520 wrote to memory of 1356	520	chrome.exe	37
PID 520 wrote to memory of 1356	520	chrome.exe	37
PID 520 wrote to memory of 1356	520	chrome.exe	37
PID 520 wrote to memory of 1356	520	chrome.exe	37
PID 520 wrote to memory of 1356	520	chrome.exe	37
PID 520 wrote to memory of 1356	520	chrome.exe	37
PID 520 wrote to memory of 1356	520	chrome.exe	37
PID 520 wrote to memory of 1356	520	chrome.exe	37

C:\Users\Admin\AppData\Local\Temp\pothjasefdj.exe
"C:\Users\Admin\AppData\Local\Temp\pothjasefdj.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:520
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fefb989758,0x7fefb989768,0x7fefb989778
    3⤵
    PID:2384
- - C:\Windows\system32\ctfmon.exe
    ctfmon.exe
    3⤵
    PID:1992
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1152 --field-trial-handle=1352,i,8128522817127868047,16210914615262330773,131072 /prefetch:2
    3⤵
    PID:1420
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1412 --field-trial-handle=1352,i,8128522817127868047,16210914615262330773,131072 /prefetch:8
    3⤵
    PID:960
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1552 --field-trial-handle=1352,i,8128522817127868047,16210914615262330773,131072 /prefetch:8
    3⤵
    PID:1356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2284 --field-trial-handle=1352,i,8128522817127868047,16210914615262330773,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2056
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2292 --field-trial-handle=1352,i,8128522817127868047,16210914615262330773,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2388
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1480 --field-trial-handle=1352,i,8128522817127868047,16210914615262330773,131072 /prefetch:2
    3⤵
    PID:2252
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 --field-trial-handle=1352,i,8128522817127868047,16210914615262330773,131072 /prefetch:2
    3⤵
    PID:2516
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1640 --field-trial-handle=1352,i,8128522817127868047,16210914615262330773,131072 /prefetch:2
    3⤵
    PID:264
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=1284 --field-trial-handle=1352,i,8128522817127868047,16210914615262330773,131072 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2108

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75b820ee15c149f586a980ba25f997f8

SHA1
35be2079ce4a59bf8c8ba98e43230ceb05d47ead

SHA256
4614723ad664340f3f32e424d083728020fdb1d3a9fe5617da92acab5ca78ee6

SHA512
0bf937e55042f767a8e4313d9c20a27e42c89cb5aa1f23b720b0caf48931b93d16e2b435219f8bae2ec9de3ec694c9796abb0ff4b3e6d93d406ecba8d3993713

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64250e3b0811d0ad62d1fdf8f07463da

SHA1
31ab5e80ebdec80c5c79128cca86b1098531540c

SHA256
32c6afb7ceea5c62febc91904f85f092a9c079c96af0b15f1e771d752ed6d0d3

SHA512
943a224ef6c871c181e96ccef81e266ea655f4ad00949231c52417de2c648bb2eea322aee18b530b590cb361ace19a79d6a726899518f8404811e4eb4afdfce7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d3efd3e191616404e3028e8b3d92b43

SHA1
eb9471104d7637d6118480d9b3155551ff1f0af5

SHA256
11ac13dafa21b4b23b81c79a5872f9d4aa9407bc22d79be8546f98436ee114bd

SHA512
9e52ddb387b33a158f1cf13d3294b24bf9e0c22dd653b7a919d82c90af39d583efb1c387dbe282278b2d2854265e6af48560253f638bc3633c7e74ccb99b8e96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98c6d15df8deb64ae451d45347bc27d6

SHA1
1ec253581cd7bc761e27af3e49e42e3a8348b9dd

SHA256
2e174e8531642c92bc8ef22d0cdde73ddeec426d8640d92ec815235caff4f64c

SHA512
e9f47e2d274293dc9022a986e7490f52da796cb96d095e0a4cb33d290248cc944cb92c580f92fbd80da5d7f5a74ad3f770e9b1a3db5f854b416b4a15166fa109

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33f6f4a8f8dce3941190097bddae280d

SHA1
9a946aa4481884df8c1ddd7108134691e3bcdbf2

SHA256
209a215fff080f7bba92f9919c300b5b470855acec16c55c599822d4bd007676

SHA512
ed433842d2260ad4ba38e49eea76efd6ffbab092dba047e3c23d1149ca228a795883a9f15c493c0974c62fe7b3e8959e2b16f8d0f0d46b0f9f96fa32b23512c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf29b36e42713710707ac243dee53fb6

SHA1
801d12e9d0bb8a17938a2dd63cd06389e8f77aa6

SHA256
c8987b36affe98180a905a4bd14399ca638cfb83ca73579bc33b81621b4b4391

SHA512
2706bf16901a177b7c9302ee51d92cc304b82b3784ae56219dd97b17f95eba45280898986b4a3132a81a4a938adb671e09e34d2b8cd3c4fd8b137f21a315af84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e6ac8b2a02808d2e9cd903b1272feaf

SHA1
1382119fd984ac8f8a549aca0b45a29e17d7048a

SHA256
009f5e5ac26036d7815bd84666aefd0ee953e97589b3453f3c4237d65cb05d3b

SHA512
e563ff14ccbec306ce246aecb28e56a3d2e3b74efeac6adf534aee55dd542dc88388b6b5b395cb2146d904b1dbe91cbf32e8626d4b24111f0b362c086d09987a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04fef9a1e9c1f48213046751dd7cabe3

SHA1
376a7759cffa5b52ed96b590c0d116fb5c622529

SHA256
767f315ade13b5c149f455bc8fd439bbb60ec0a59eb81ce835ccdb104050b147

SHA512
dfdb0dc573040787c7c366829dc7aa2e263ac4eb729730670847681f98c0fb851c95663f78c65338380d5aa094435a2efb4830e73e5246a5f3d96f0ef3b3e78e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a98203dcf95be21ab8b899ae87cb08ca

SHA1
058e9233b9b9e6986c2059a37a80bf0c23cb97d4

SHA256
c944e2ec9737f88b2b7fa6cb9edcd4a9d4075073b66d49d682b1ce2840cc3f9f

SHA512
9f52203efb5365d6913fb6a3885fb2ac7187ed09ce26eb380f0b4a58282f07efd61c31b041f2009853abfb559d43ca68663921da6e98368a375f42f12b48155b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB77F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB80E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/2044-401-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2044-0-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download