vidar | fd39a100de7ae6efc732edeab31a89313d0be7e0540acffc04f6ed707c48c48d

Analysis

max time kernel
138s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20250410-en
resource tags

arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2025, 09:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Win64.MalwareX-gen.18755.16201.exe
Size

799KB
MD5

9d8735f3616aa80144974a74ddeb99fa
SHA1

70414ba52fbfe2606e8fb08d43afbab4488628eb
SHA256

fd39a100de7ae6efc732edeab31a89313d0be7e0540acffc04f6ed707c48c48d
SHA512

231c202bfa703e3c0740b990344ee2903eceba15abb79add30a0690089eb12ec64a264301fd20c46f97eb6092e80b3dbc2227c1b447844a03a422689eb34c315
SSDEEP

12288:dbGU3fK+OmAeJWcl28vZ2CYizu+9LKLdEEo4Edka+9LKLdEEo4Edk:ZGU3bNkAuaKLdjRaaKLdjR

Score

10^/10

vidar c466785b3a34d7b3c4d6db04a068b664 credential_access discovery spyware stealer

Malware Config

Extracted

Family

vidar

Version

13.5

Botnet

c466785b3a34d7b3c4d6db04a068b664

https://t.me/v00rd

https://steamcommunity.com/profiles/76561199846773220

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0

Signatures

Detect Vidar Stealer 37 IoCs

stealer

resource	yara_rule
behavioral1/memory/4384-1-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/4384-2-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/4384-0-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/4384-9-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/4384-10-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/4384-15-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/4384-16-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/4384-19-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/4384-23-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/4384-24-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/4384-25-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/4384-29-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/4384-33-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/4384-74-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/4384-75-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/4384-76-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/4384-79-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/4384-83-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/4384-84-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/4384-88-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/4384-89-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/4384-254-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/4384-255-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/4384-256-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/4384-259-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/4384-261-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/4384-265-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/4384-266-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/4384-267-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/4384-268-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/4384-269-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/4384-273-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/4384-274-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/4384-275-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/4384-276-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/4384-277-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/4384-281-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Uses browser remote debugging 2 TTPs 8 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
4564	msedge.exe
4936	chrome.exe
860	chrome.exe
3388	chrome.exe
1300	chrome.exe
1356	chrome.exe
900	msedge.exe
3828	msedge.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5152 set thread context of 4384	5152	SecuriteInfo.com.Win64.MalwareX-gen.18755.16201.exe	93

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
6088	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133896147368538267"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2362875047-775336530-2205312478-1000\{3AE66D8E-2C4E-4E0A-B840-2C13FEF46B56}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4384	MSBuild.exe
4384	MSBuild.exe
4384	MSBuild.exe
4384	MSBuild.exe
4936	chrome.exe
4936	chrome.exe
4384	MSBuild.exe
4384	MSBuild.exe
4384	MSBuild.exe
4384	MSBuild.exe
4384	MSBuild.exe
4384	MSBuild.exe
4384	MSBuild.exe
4384	MSBuild.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
900	msedge.exe
900	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
900	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5152 wrote to memory of 5380	5152	SecuriteInfo.com.Win64.MalwareX-gen.18755.16201.exe	92
PID 5152 wrote to memory of 5380	5152	SecuriteInfo.com.Win64.MalwareX-gen.18755.16201.exe	92
PID 5152 wrote to memory of 5380	5152	SecuriteInfo.com.Win64.MalwareX-gen.18755.16201.exe	92
PID 5152 wrote to memory of 4384	5152	SecuriteInfo.com.Win64.MalwareX-gen.18755.16201.exe	93
PID 5152 wrote to memory of 4384	5152	SecuriteInfo.com.Win64.MalwareX-gen.18755.16201.exe	93
PID 5152 wrote to memory of 4384	5152	SecuriteInfo.com.Win64.MalwareX-gen.18755.16201.exe	93
PID 5152 wrote to memory of 4384	5152	SecuriteInfo.com.Win64.MalwareX-gen.18755.16201.exe	93
PID 5152 wrote to memory of 4384	5152	SecuriteInfo.com.Win64.MalwareX-gen.18755.16201.exe	93
PID 5152 wrote to memory of 4384	5152	SecuriteInfo.com.Win64.MalwareX-gen.18755.16201.exe	93
PID 5152 wrote to memory of 4384	5152	SecuriteInfo.com.Win64.MalwareX-gen.18755.16201.exe	93
PID 5152 wrote to memory of 4384	5152	SecuriteInfo.com.Win64.MalwareX-gen.18755.16201.exe	93
PID 5152 wrote to memory of 4384	5152	SecuriteInfo.com.Win64.MalwareX-gen.18755.16201.exe	93
PID 5152 wrote to memory of 4384	5152	SecuriteInfo.com.Win64.MalwareX-gen.18755.16201.exe	93
PID 5152 wrote to memory of 4384	5152	SecuriteInfo.com.Win64.MalwareX-gen.18755.16201.exe	93
PID 5152 wrote to memory of 4384	5152	SecuriteInfo.com.Win64.MalwareX-gen.18755.16201.exe	93
PID 4384 wrote to memory of 4936	4384	MSBuild.exe	97
PID 4384 wrote to memory of 4936	4384	MSBuild.exe	97
PID 4936 wrote to memory of 4748	4936	chrome.exe	98
PID 4936 wrote to memory of 4748	4936	chrome.exe	98
PID 4936 wrote to memory of 1632	4936	chrome.exe	99
PID 4936 wrote to memory of 1632	4936	chrome.exe	99
PID 4936 wrote to memory of 2140	4936	chrome.exe	100
PID 4936 wrote to memory of 2140	4936	chrome.exe	100
PID 4936 wrote to memory of 2140	4936	chrome.exe	100
PID 4936 wrote to memory of 2140	4936	chrome.exe	100
PID 4936 wrote to memory of 2140	4936	chrome.exe	100
PID 4936 wrote to memory of 2140	4936	chrome.exe	100
PID 4936 wrote to memory of 2140	4936	chrome.exe	100
PID 4936 wrote to memory of 2140	4936	chrome.exe	100
PID 4936 wrote to memory of 2140	4936	chrome.exe	100
PID 4936 wrote to memory of 2140	4936	chrome.exe	100
PID 4936 wrote to memory of 2140	4936	chrome.exe	100
PID 4936 wrote to memory of 2140	4936	chrome.exe	100
PID 4936 wrote to memory of 2140	4936	chrome.exe	100
PID 4936 wrote to memory of 2140	4936	chrome.exe	100
PID 4936 wrote to memory of 2140	4936	chrome.exe	100
PID 4936 wrote to memory of 2140	4936	chrome.exe	100
PID 4936 wrote to memory of 2140	4936	chrome.exe	100
PID 4936 wrote to memory of 2140	4936	chrome.exe	100
PID 4936 wrote to memory of 2140	4936	chrome.exe	100
PID 4936 wrote to memory of 2140	4936	chrome.exe	100
PID 4936 wrote to memory of 2140	4936	chrome.exe	100
PID 4936 wrote to memory of 2140	4936	chrome.exe	100
PID 4936 wrote to memory of 2140	4936	chrome.exe	100
PID 4936 wrote to memory of 2140	4936	chrome.exe	100
PID 4936 wrote to memory of 2140	4936	chrome.exe	100
PID 4936 wrote to memory of 2140	4936	chrome.exe	100
PID 4936 wrote to memory of 2140	4936	chrome.exe	100
PID 4936 wrote to memory of 2140	4936	chrome.exe	100
PID 4936 wrote to memory of 2140	4936	chrome.exe	100
PID 4936 wrote to memory of 2140	4936	chrome.exe	100
PID 4936 wrote to memory of 4864	4936	chrome.exe	102
PID 4936 wrote to memory of 4864	4936	chrome.exe	102
PID 4936 wrote to memory of 4864	4936	chrome.exe	102
PID 4936 wrote to memory of 4864	4936	chrome.exe	102
PID 4936 wrote to memory of 4864	4936	chrome.exe	102
PID 4936 wrote to memory of 4864	4936	chrome.exe	102
PID 4936 wrote to memory of 4864	4936	chrome.exe	102
PID 4936 wrote to memory of 4864	4936	chrome.exe	102
PID 4936 wrote to memory of 4864	4936	chrome.exe	102
PID 4936 wrote to memory of 4864	4936	chrome.exe	102
PID 4936 wrote to memory of 4864	4936	chrome.exe	102
PID 4936 wrote to memory of 4864	4936	chrome.exe	102
PID 4936 wrote to memory of 4864	4936	chrome.exe	102

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.MalwareX-gen.18755.16201.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.MalwareX-gen.18755.16201.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5152
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:5380
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4936
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8d1e0dcf8,0x7ff8d1e0dd04,0x7ff8d1e0dd10
      4⤵
      PID:4748
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1876,i,2918809183513026863,6098633387509049461,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=1992 /prefetch:3
      4⤵
      PID:1632
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1964,i,2918809183513026863,6098633387509049461,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=1960 /prefetch:2
      4⤵
      PID:2140
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2388,i,2918809183513026863,6098633387509049461,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=2404 /prefetch:8
      4⤵
      PID:4864
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3260,i,2918809183513026863,6098633387509049461,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3276 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3388
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3284,i,2918809183513026863,6098633387509049461,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3304 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:860
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4280,i,2918809183513026863,6098633387509049461,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=4308 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:1300
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4584,i,2918809183513026863,6098633387509049461,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=4612 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1356
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5360,i,2918809183513026863,6098633387509049461,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=5100 /prefetch:8
      4⤵
      PID:2224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ff8c277f208,0x7ff8c277f214,0x7ff8c277f220
      4⤵
      PID:872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1888,i,12179234988241108574,9814767185162038618,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:3
      4⤵
      PID:5156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2252,i,12179234988241108574,9814767185162038618,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:8
      4⤵
      PID:5904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2240,i,12179234988241108574,9814767185162038618,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
      4⤵
      PID:5684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3508,i,12179234988241108574,9814767185162038618,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3520,i,12179234988241108574,9814767185162038618,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3488,i,12179234988241108574,9814767185162038618,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
      4⤵
      PID:5892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4904,i,12179234988241108574,9814767185162038618,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
      4⤵
      PID:516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5412,i,12179234988241108574,9814767185162038618,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
      4⤵
      PID:1016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6000,i,12179234988241108574,9814767185162038618,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
      4⤵
      PID:4796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6000,i,12179234988241108574,9814767185162038618,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
      4⤵
      PID:5532
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\bas0z" & exit
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2984
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 11
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:6088

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:2884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5084

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
cdf46f798fd91d63573a7bc03c111c51

SHA1
a0012a72901e2726f9e7b83b0c031f83c44c64d2

SHA256
fd9b3496e58949d2836ae1e170ecd27fbd808a90b3cc1f55d612471de843d70f

SHA512
235c80cdd4881be3fdd76c557180aae2bf58b17fefd54dbee911d76514be305cc4ff7088f8fe1937f3e265ce5899b4faa61a65b04ba1c95cf7a1c3b9538fced0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
78KB

MD5
3ac0feda5a9b37f74a4daaa7abe63663

SHA1
f8b7e974abd30304173a837022b7e9d0f9edd99d

SHA256
39117fa61438c6d10b69d0b36c19085708f4611eb823bcf540312492b1887109

SHA512
c66972547d5e65f09d4f869a0ed9ea8e7631b39af00fda93cce1e2dfc529470af23f08e987d0e8bd09ae13700080280371ccb89f91b078073b4dfe160374aa4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
6ec80650bb87997281d6b2c490e5939e

SHA1
40faef4ca4833df8dd17c4a05cae8e4fdea72b89

SHA256
025280e5fdfd02d49c42c93e14cbc699b80eb10e21d31bd0aaa8a9b1067a80b5

SHA512
be947097b9fd14a716388b25cf4c253ee4d074a8b13370873b575ce5beb3843f1961df08e94eb07958657c64ae27bfb9f75ba9b2e19ac29985a5fc6813d500fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
6531543fad3f23ca5b5907a17543baef

SHA1
bba9c28d8a27d25e2f81e51dfe6a4b9c9e9dd738

SHA256
672bc8d424b99e500c67b4fd695b5e036381caa3477ff752a1cba9475c01f272

SHA512
b7a8f24504552e11e4c30fc1185ff87ae8c437e4d06bc5dc583077883e4912cac1babbc77289d326209ae57cd740e47bee9b4f77355ad2b79fc3c87f2c0b0fad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
e1cae9a12686866038ac06900721ba08

SHA1
9bb28b27b6316b2887ed788874b7f8a835d8ebbf

SHA256
37e473de4408dd72f0cb2142d2857fc9054fd1b27aa6429fcd0b81a6159bb40c

SHA512
195ee6935e6de08f5ff7ec34b0e8c393fba7a267f01d13d6b40117ba29833e09b46b1c907830b665ae53d19fb9e2fff32458a11254a055e07faebfd7ead9b344

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
b27746412b88dad99f4b1b8058754efe

SHA1
66b4716335cb0371966442778c991b1e5ba9d6a2

SHA256
6b79a9a5635a07d87d6489a1a2ac8c90504128a8a990404f742bcfb0b493f865

SHA512
1f69b44560d644001f82b22e66c46c8d7a5d7edf8c8ba7fa4c0648ec96b1b181188b4cfaa9d479cd956dcbeb0bca736f50ee5b859dd938f26aba321cb66cd172

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
cd856c2ede715f9a2e48089abe290573

SHA1
0293573deec7bd49ecfbb15126687c9756f98044

SHA256
512a2413ca460dd5a88279ddf1b247c55a9acfab174eb982be5e729130806fc1

SHA512
390588c2bca1608961f108e0e973cfd3914170e0b3616c103368fff3701d4757833a62242dba2ffb032ad6a93f4335489e9a8495bcbec06403295debe34113d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
fb813e5ce30794efdc1500e41ff46ee0

SHA1
67fbb85b50e65dc6799bbd4e12f8e79ac6f9cdea

SHA256
e68fa57dd6b4bb73fc326c1f7c62154826d46f77c6cccc99e67a5dbd039ffa84

SHA512
e7dabbe1f1232fa52c7f2ff02295dbccaafa8b8452a54285bd68a8b6154e3a4cfb41360ffd635cc51518cea1918e5ce833fc648ff3e58b03157a049786aa154d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
31d05f3e44cec01ddd202b588d6292ea

SHA1
f6ba9a27b9d46fe49d8726df43ec5019f37bf079

SHA256
487905cc2c8735bdf2f1420aacfd0678e9e633d77a62019aa6e49fad886015d2

SHA512
a23e129c555f3eeccf71d81b070bf1069550f012ec6452c9739688ddebc4fb4161a15ad9dad8cce62e03a419e5d75f0479f3245ba89f4bf9fd00fa10983b038b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
b914a7dca069fded6dd69090e07db926

SHA1
1826b46ba705e64a0749664e4c3ca300be534573

SHA256
063a0ab1102cd0ce5beac1d87d2cc5fc49cdb9b1f8c677b87887d5468f3df341

SHA512
7940211ca7fa630e04b313cb21ef401acabc055d9daf8eeefe228231fa3ab55dde8fb2f6a480b6c840175ceef5d9df7b034a31719957a7331e7271ff25ddf97e

Download Submit
memory/4384-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-74-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-75-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-76-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-83-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-84-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-88-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-89-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-29-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-24-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-23-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-19-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-16-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-10-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-33-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-79-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-254-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-255-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-256-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-259-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-261-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-265-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-266-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-267-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-268-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-269-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-273-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-274-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-275-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-276-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-277-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4384-281-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download