vidar | d28bc1b8975df8985c266826dc2111d6c50989fce391f72327171df965231166

Analysis

max time kernel
139s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20250410-en
resource tags

arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2025, 08:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Win64.MalwareX-gen.11143.6531.exe
Size

556KB
MD5

d510396277a666720627f5df62bd53eb
SHA1

7acf176af54493aac227097b01a38242c069c28b
SHA256

d28bc1b8975df8985c266826dc2111d6c50989fce391f72327171df965231166
SHA512

e459a1212969aecd935bcf1182ad887b7cc5319ebf1b489ae9bc3a18e2855994de46ab7ff8a7d6f968ff844b8beac243bd3b4b2fd6a572bfc1ad0a689c960154
SSDEEP

12288:sgSCNzaLuvMRXdxQBXZqEvRXJQNf+9LKLdEEo4Edka+9LKLdEEo4Edk:sgvFaKQdEOaKLdjRaaKLdjR

Score

10^/10

vidar c466785b3a34d7b3c4d6db04a068b664 credential_access discovery spyware stealer

Malware Config

Extracted

Family

vidar

Version

13.5

Botnet

c466785b3a34d7b3c4d6db04a068b664

https://t.me/v00rd

https://steamcommunity.com/profiles/76561199846773220

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0

Signatures

Detect Vidar Stealer 35 IoCs

stealer

resource	yara_rule
behavioral1/memory/212-0-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/212-1-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/212-2-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/212-9-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/212-10-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/212-15-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/212-16-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/212-19-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/212-23-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/212-24-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/212-25-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/212-29-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/212-31-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/212-70-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/212-76-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/212-77-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/212-78-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/212-81-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/212-85-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/212-86-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/212-87-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/212-91-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/212-94-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/212-294-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/212-381-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/212-384-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/212-387-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/212-388-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/212-389-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/212-394-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/212-395-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/212-396-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/212-397-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/212-398-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/212-402-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Uses browser remote debugging 2 TTPs 8 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
1612	msedge.exe
3188	msedge.exe
2680	msedge.exe
3272	chrome.exe
3680	chrome.exe
4280	chrome.exe
1532	chrome.exe
5744	chrome.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5984 set thread context of 212	5984	SecuriteInfo.com.Win64.MalwareX-gen.11143.6531.exe	91

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2452	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133896118617445373"	chrome.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
212	MSBuild.exe
212	MSBuild.exe
212	MSBuild.exe
212	MSBuild.exe
3272	chrome.exe
3272	chrome.exe
212	MSBuild.exe
212	MSBuild.exe
212	MSBuild.exe
212	MSBuild.exe
212	MSBuild.exe
212	MSBuild.exe
212	MSBuild.exe
212	MSBuild.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
1612	msedge.exe
1612	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
1612	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5984 wrote to memory of 212	5984	SecuriteInfo.com.Win64.MalwareX-gen.11143.6531.exe	91
PID 5984 wrote to memory of 212	5984	SecuriteInfo.com.Win64.MalwareX-gen.11143.6531.exe	91
PID 5984 wrote to memory of 212	5984	SecuriteInfo.com.Win64.MalwareX-gen.11143.6531.exe	91
PID 5984 wrote to memory of 212	5984	SecuriteInfo.com.Win64.MalwareX-gen.11143.6531.exe	91
PID 5984 wrote to memory of 212	5984	SecuriteInfo.com.Win64.MalwareX-gen.11143.6531.exe	91
PID 5984 wrote to memory of 212	5984	SecuriteInfo.com.Win64.MalwareX-gen.11143.6531.exe	91
PID 5984 wrote to memory of 212	5984	SecuriteInfo.com.Win64.MalwareX-gen.11143.6531.exe	91
PID 5984 wrote to memory of 212	5984	SecuriteInfo.com.Win64.MalwareX-gen.11143.6531.exe	91
PID 5984 wrote to memory of 212	5984	SecuriteInfo.com.Win64.MalwareX-gen.11143.6531.exe	91
PID 5984 wrote to memory of 212	5984	SecuriteInfo.com.Win64.MalwareX-gen.11143.6531.exe	91
PID 5984 wrote to memory of 212	5984	SecuriteInfo.com.Win64.MalwareX-gen.11143.6531.exe	91
PID 5984 wrote to memory of 212	5984	SecuriteInfo.com.Win64.MalwareX-gen.11143.6531.exe	91
PID 212 wrote to memory of 3272	212	MSBuild.exe	97
PID 212 wrote to memory of 3272	212	MSBuild.exe	97
PID 3272 wrote to memory of 3972	3272	chrome.exe	98
PID 3272 wrote to memory of 3972	3272	chrome.exe	98
PID 3272 wrote to memory of 4976	3272	chrome.exe	99
PID 3272 wrote to memory of 4976	3272	chrome.exe	99
PID 3272 wrote to memory of 4976	3272	chrome.exe	99
PID 3272 wrote to memory of 4976	3272	chrome.exe	99
PID 3272 wrote to memory of 4976	3272	chrome.exe	99
PID 3272 wrote to memory of 4976	3272	chrome.exe	99
PID 3272 wrote to memory of 4976	3272	chrome.exe	99
PID 3272 wrote to memory of 4976	3272	chrome.exe	99
PID 3272 wrote to memory of 4976	3272	chrome.exe	99
PID 3272 wrote to memory of 4976	3272	chrome.exe	99
PID 3272 wrote to memory of 4976	3272	chrome.exe	99
PID 3272 wrote to memory of 4976	3272	chrome.exe	99
PID 3272 wrote to memory of 4976	3272	chrome.exe	99
PID 3272 wrote to memory of 4976	3272	chrome.exe	99
PID 3272 wrote to memory of 4976	3272	chrome.exe	99
PID 3272 wrote to memory of 4976	3272	chrome.exe	99
PID 3272 wrote to memory of 4976	3272	chrome.exe	99
PID 3272 wrote to memory of 4976	3272	chrome.exe	99
PID 3272 wrote to memory of 4976	3272	chrome.exe	99
PID 3272 wrote to memory of 4976	3272	chrome.exe	99
PID 3272 wrote to memory of 4976	3272	chrome.exe	99
PID 3272 wrote to memory of 4976	3272	chrome.exe	99
PID 3272 wrote to memory of 4976	3272	chrome.exe	99
PID 3272 wrote to memory of 4976	3272	chrome.exe	99
PID 3272 wrote to memory of 4976	3272	chrome.exe	99
PID 3272 wrote to memory of 4976	3272	chrome.exe	99
PID 3272 wrote to memory of 4976	3272	chrome.exe	99
PID 3272 wrote to memory of 4976	3272	chrome.exe	99
PID 3272 wrote to memory of 4976	3272	chrome.exe	99
PID 3272 wrote to memory of 4976	3272	chrome.exe	99
PID 3272 wrote to memory of 4016	3272	chrome.exe	100
PID 3272 wrote to memory of 4016	3272	chrome.exe	100
PID 3272 wrote to memory of 5228	3272	chrome.exe	101
PID 3272 wrote to memory of 5228	3272	chrome.exe	101
PID 3272 wrote to memory of 5228	3272	chrome.exe	101
PID 3272 wrote to memory of 5228	3272	chrome.exe	101
PID 3272 wrote to memory of 5228	3272	chrome.exe	101
PID 3272 wrote to memory of 5228	3272	chrome.exe	101
PID 3272 wrote to memory of 5228	3272	chrome.exe	101
PID 3272 wrote to memory of 5228	3272	chrome.exe	101
PID 3272 wrote to memory of 5228	3272	chrome.exe	101
PID 3272 wrote to memory of 5228	3272	chrome.exe	101
PID 3272 wrote to memory of 5228	3272	chrome.exe	101
PID 3272 wrote to memory of 5228	3272	chrome.exe	101
PID 3272 wrote to memory of 5228	3272	chrome.exe	101
PID 3272 wrote to memory of 5228	3272	chrome.exe	101
PID 3272 wrote to memory of 5228	3272	chrome.exe	101
PID 3272 wrote to memory of 5228	3272	chrome.exe	101

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.MalwareX-gen.11143.6531.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.MalwareX-gen.11143.6531.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5984
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:212
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3272
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe3956dcf8,0x7ffe3956dd04,0x7ffe3956dd10
      4⤵
      PID:3972
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2012,i,7403814741509405119,10105130133782904922,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=2008 /prefetch:2
      4⤵
      PID:4976
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2244,i,7403814741509405119,10105130133782904922,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=2268 /prefetch:3
      4⤵
      PID:4016
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2360,i,7403814741509405119,10105130133782904922,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=2292 /prefetch:8
      4⤵
      PID:5228
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3232,i,7403814741509405119,10105130133782904922,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3288 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4280
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3224,i,7403814741509405119,10105130133782904922,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3324 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3680
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4336,i,7403814741509405119,10105130133782904922,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=4328 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:1532
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4640,i,7403814741509405119,10105130133782904922,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=4704 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5744
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5292,i,7403814741509405119,10105130133782904922,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=5288 /prefetch:8
      4⤵
      PID:764
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5476,i,7403814741509405119,10105130133782904922,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=5492 /prefetch:8
      4⤵
      PID:5860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:1612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffe3954f208,0x7ffe3954f214,0x7ffe3954f220
      4⤵
      PID:2896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1960,i,4380012238955342728,4587077307499730489,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:3
      4⤵
      PID:4432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2192,i,4380012238955342728,4587077307499730489,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
      4⤵
      PID:2836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2520,i,4380012238955342728,4587077307499730489,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:8
      4⤵
      PID:4452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3568,i,4380012238955342728,4587077307499730489,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3584,i,4380012238955342728,4587077307499730489,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2680
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\00000" & exit
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2596
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 11
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2452

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:5852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1036

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
d0e5213b130ca574e7492c9773903ec3

SHA1
680d700de6e5625604a6c9f8a804fb2fd8776d1c

SHA256
c240da8f5f6397f19828566cfa75277f3dfdf17bc466c30827f30e2938b3839c

SHA512
c688c1d9287ba0e53b92e603b4a14967de31d4d8cfb4df440a702ba6c1b79187b71faade4d9bd868fc62917e8708b267c74486eea1d14a7db94a55e139989f02

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
78KB

MD5
a2a6453bb64ad66430eaafe1de51e1c3

SHA1
a90e03bab14920cc6280f59be35db390ffed6089

SHA256
8cc1fdeded2b668c4530bab64199d8e14cc2a0f6c9b46edadfa0aa3fa85ced6e

SHA512
f8db34bb77c6db48054eb2ff8068eaf6c06c749769e560d819ec2ec56d7a2c16f02536cd600f1b96865edaa8f8d7454c3d878d3852d447fb012e0e8778fd6ae3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
cf3da7267cb6a35a74a4dceb3097a615

SHA1
a1b06c52d03147a6adbad9d32436b3b497115584

SHA256
18a6d652dd17544c9feb2e01621ed64b958b1a26bcee81e29ab29d5a409dc222

SHA512
6238eb406a42dfdf3faf7b62c92c6c0993974617f2ff403f6cd0a23dd2d53893bd96e92e78bbe6ba35ff191cdbcb8ecd69318c76547df76341ce9f2d43aae71f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8eb518b8-0d69-4be0-8146-80caaac45029\index-dir\the-real-index

Filesize
960B

MD5
46707c874cd29121cb4ab2138643b9bd

SHA1
0235caa47d61ff8c9be4d9ea4db12e6e809092b2

SHA256
1c9707b9d6f352c180c3bd0bcad68bb94598feb855edcc90c4d9e1b38dc036bf

SHA512
de0cf4ecacdb0649c8fc166c72ecac18f07cbd3d5df368f1201d35ca8f92d28ad1103d671a39aa2a58a67c571844c98b0ace44e96bd5e6e555115778e200408c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8eb518b8-0d69-4be0-8146-80caaac45029\index-dir\the-real-index~RFe57bd16.TMP

Filesize
960B

MD5
b47356f3487c0babbdb4f2d889b3b48d

SHA1
e42107fac4beef193f5adc0b6ad3521f3cbe86f6

SHA256
df02269e00362b7ea87f9daf88e0dfe379c900facfa571afab525e0cedda0f82

SHA512
75435d46a228893db00c5bd265abed45655503458594b21e59dbdc2ef12ab6fe72724b07fa7ba348f9e3eb60281b058dac802669fa6e5f2469e9c75524052f63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
39KB

MD5
14e79e5c3d4136f72a8bd67d81dd3435

SHA1
367cc8af056b86cd5bbe7a1fcd43e3ebf68dbf1a

SHA256
eb02bc9c8a53b56264042202c2dcc81f482a0511adca3153cfa5a80825497f70

SHA512
03b3ea8f44c1ae6936378cd1f9af7130e69c24a007e4eebfb9e0999aa1e4162e4779f4bedc17e7643c0e6fdf9fb0e09bbaccba2f4688a27fd4a220fb561c9518

Download Submit
memory/212-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/212-91-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/212-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/212-29-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/212-31-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/212-23-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/212-19-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/212-16-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/212-70-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/212-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/212-76-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/212-77-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/212-78-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/212-81-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/212-85-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/212-86-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/212-87-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/212-24-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/212-94-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/212-10-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/212-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/212-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/212-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/212-294-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/212-381-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/212-384-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/212-387-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/212-388-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/212-389-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/212-394-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/212-395-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/212-396-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/212-397-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/212-398-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/212-402-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download