vidar | 6b08010bf6a5148ea64abdea3edfac0ed11a27137def1f8f6e6c7a996870a8e8

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20251016-en
resource tags

arch:x64arch:x86image:win10v2004-20251016-enlocale:en-usos:windows10-2004-x64system
submitted
11/12/2025, 13:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 2.7MB
Sample251211-qfmesscs6d
SHA256 6b08010bf6a5148ea64abdea3edfac0ed11a27137def1f8f6e6c7a996870a8e8
MD5 109451d265aae647565d10eb9e591569
SHA1 89a64a719da47d46cdd0248d940751b1283f6032
SHA512 4928238db947ad661c49c726e9ca21aff43fd1847b68247e17f647e84901af2677917702e4fb711a6c9b92a869696eaa0d1e9860442cf85a08e1cd0ac17b043b
SSDEEP 49152:xExyflRqOwPvVev+/BsSzw75N0o2EqMXDn6mZQMaBlSl:OxQlRD7v+/qSzwtN0EqMXDn6mZ1WSl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

105d327c1b536779a1b39be53053b37c discovery vidar persistence spyware stealer

Malware Config

Extracted

Family

vidar

Botnet

105d327c1b536779a1b39be53053b37c

https://steamcommunity.com/profiles/76561198761022496

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0

Signatures

Detects Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral1/memory/1480-60-0x0000000140000000-0x0000000140189000-memory.dmp	family_vidar_v15
behavioral1/memory/1480-205-0x0000000140000000-0x0000000140189000-memory.dmp	family_vidar_v15

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Executes dropped EXE 2 IoCs

pid	Process
3648	Elizabeth.exe
1480	Elizabeth.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3648 set thread context of 1480	3648	Elizabeth.exe	96

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Elizabeth.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Elizabeth.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3648	Elizabeth.exe
3648	Elizabeth.exe
3648	Elizabeth.exe
3648	Elizabeth.exe
3648	Elizabeth.exe
3648	Elizabeth.exe
3648	Elizabeth.exe
3648	Elizabeth.exe
3648	Elizabeth.exe
3648	Elizabeth.exe
3648	Elizabeth.exe
3648	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
2168	chrome.exe
2168	chrome.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe
1480	Elizabeth.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
5684	msedge.exe
5684	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe

Suspicious use of FindShellTrayWindow 30 IoCs

pid	Process
3648	Elizabeth.exe
3648	Elizabeth.exe
3648	Elizabeth.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
5684	msedge.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3648	Elizabeth.exe
3648	Elizabeth.exe
3648	Elizabeth.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 4820	2628	file.exe	83
PID 2628 wrote to memory of 4872	2628	file.exe	85
PID 4872 wrote to memory of 5652	4872	cmd.exe	87
PID 5652 wrote to memory of 5552	5652	cmd.exe	88
PID 5652 wrote to memory of 3648	5652	cmd.exe	90
PID 3648 wrote to memory of 1480	3648	Elizabeth.exe	96
PID 3648 wrote to memory of 1480	3648	Elizabeth.exe	96
PID 1480 wrote to memory of 2168	1480	Elizabeth.exe	101
PID 2168 wrote to memory of 4260	2168	chrome.exe	102
PID 1480 wrote to memory of 2168	1480	Elizabeth.exe	101
PID 2168 wrote to memory of 2944	2168	chrome.exe	103
PID 2168 wrote to memory of 4844	2168	chrome.exe	104
PID 2168 wrote to memory of 2944	2168	chrome.exe	103
PID 2168 wrote to memory of 5796	2168	chrome.exe	106
PID 2168 wrote to memory of 5796	2168	chrome.exe	106
PID 2168 wrote to memory of 4044	2168	chrome.exe	107
PID 2168 wrote to memory of 4044	2168	chrome.exe	107
PID 2168 wrote to memory of 4024	2168	chrome.exe	108
PID 2168 wrote to memory of 4024	2168	chrome.exe	108
PID 2168 wrote to memory of 1356	2168	chrome.exe	109
PID 2168 wrote to memory of 1356	2168	chrome.exe	109
PID 2168 wrote to memory of 1544	2168	chrome.exe	110
PID 2168 wrote to memory of 1544	2168	chrome.exe	110
PID 2168 wrote to memory of 1776	2168	chrome.exe	112
PID 2168 wrote to memory of 1776	2168	chrome.exe	112
PID 2168 wrote to memory of 2264	2168	chrome.exe	113
PID 2168 wrote to memory of 2264	2168	chrome.exe	113
PID 1480 wrote to memory of 5684	1480	Elizabeth.exe	114
PID 5684 wrote to memory of 5812	5684	msedge.exe	115
PID 1480 wrote to memory of 5684	1480	Elizabeth.exe	114
PID 5684 wrote to memory of 2604	5684	msedge.exe	116
PID 5684 wrote to memory of 3816	5684	msedge.exe	117
PID 5684 wrote to memory of 2604	5684	msedge.exe	116
PID 5684 wrote to memory of 2604	5684	msedge.exe	116
PID 5684 wrote to memory of 2452	5684	msedge.exe	118
PID 5684 wrote to memory of 2452	5684	msedge.exe	118
PID 5684 wrote to memory of 4624	5684	msedge.exe	119
PID 5684 wrote to memory of 4624	5684	msedge.exe	119
PID 5684 wrote to memory of 4488	5684	msedge.exe	120
PID 5684 wrote to memory of 4624	5684	msedge.exe	119
PID 5684 wrote to memory of 4488	5684	msedge.exe	120
PID 5684 wrote to memory of 4488	5684	msedge.exe	120

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\SYSTEM32\makecab.exe
  makecab.exe /jkdhfihu3478yr983834803
  2⤵
  PID:4820
- C:\Windows\SYSTEM32\cmd.exe
  cmd /v /c Set wDveSp=cmd & !wDveSp! < Crap.aac
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5652
  - - C:\Windows\system32\findstr.exe
      findstr /V "Tits" Iowa
      4⤵
      PID:5552
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\403018\Elizabeth.exe
      Elizabeth.exe E
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3648
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\403018\Elizabeth.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\403018\Elizabeth.exe
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1480
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"
        6⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:2168
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8f773dcf8,0x7ff8f773dd04,0x7ff8f773dd10
        7⤵
        
        PID:4260
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2004,i,14483140162924631730,776165875269566289,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=2000 /prefetch:2
        7⤵
        
        PID:2944
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2156,i,14483140162924631730,776165875269566289,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=2180 /prefetch:3
        7⤵
        
        PID:4844
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=1604,i,14483140162924631730,776165875269566289,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=2520 /prefetch:8
        7⤵
        
        PID:5796
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3044,i,14483140162924631730,776165875269566289,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=3116 /prefetch:1
        7⤵
        
        PID:4044
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3036,i,14483140162924631730,776165875269566289,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=3096 /prefetch:1
        7⤵
        
        PID:4024
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4220,i,14483140162924631730,776165875269566289,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=4236 /prefetch:2
        7⤵
        
        PID:1356
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4612,i,14483140162924631730,776165875269566289,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=4580 /prefetch:1
        7⤵
        
        PID:1544
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=4616,i,14483140162924631730,776165875269566289,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=4600 /prefetch:8
        7⤵
        
        PID:1776
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=4936,i,14483140162924631730,776165875269566289,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=4952 /prefetch:8
        7⤵
        
        PID:2264
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
        6⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:5684
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x338,0x7ff8f771f208,0x7ff8f771f214,0x7ff8f771f220
        7⤵
        
        PID:5812
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2228,i,18348755145828559583,5126399964815349079,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
        7⤵
        
        PID:2604
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1944,i,18348755145828559583,5126399964815349079,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
        7⤵
        
        PID:3816
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2580,i,18348755145828559583,5126399964815349079,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
        7⤵
        
        PID:2452
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3440,i,18348755145828559583,5126399964815349079,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
        7⤵
        
        PID:4624
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3460,i,18348755145828559583,5126399964815349079,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
        7⤵
        
        PID:4488

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:3320

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1384

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4720

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 0478bd0683941787f53d0aaa8963afe50bc4ceb25e50f4f135c14eb518944b44
MD5 c8685e73bd99393876e7f67f918108da
SHA1 03979783576b104860eadc6b1fe996c07e614519
SHA512 819b1ae613b5f0c1ea12c48a34b22ef089308021876c4015c2f8a7b469e6de058f8d003d828d91d093ca4eb2e5950934e529798f8da9285543f71e1994b2198b
SSDEEP 3072:rZW79BZS0lwR6BsmXWqqbx8TPgS5yCY0VLJbdYvjIBr:s7pS0lVUbxOgY00VLJbu7IBr
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e6ac06e045f2ce34830984e5bd7af5f1d21bd0387a050553881c215891b3289e
MD5 23351c429cb84321b2fd18becd5c0184
SHA1 d7c1740a1bb351a60cc5936ec901e823e778af0b
SHA512 36107666e19fb3f467e30ad15c4323eebc1a78b3657f54d86234e4e2242a3c3a0438778003deff38261c64e6ec6d3fa8f9e80a5d08ff1ee27527a1005474a73e
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ffcce7727445385bbbdfb165cafe5c964c5d50cef3e02e500433634e5b125b6c
MD5 3895a30f672f062f123659826728ae84
SHA1 7148001f8e9b0583862be1fcfa8c4f32b3621a22
SHA512 58b2f9c2802a15cebfccf05368173b0f2200bb2ee8b28685a42694de27321b1d5c39440db3093372f3a4116c5c55fbaf684a2780a1b0f198f7852b234c1da45a
SSDEEP 768:fF5BLv7I5wCPFdV6Zi63rCgDaX2DAsG/aOmsaOxjL:XJUV6ZL3tORmxajL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 1f04fff25b5a4e652ffb5ecf47b70973a7a5be2b63fec5a8a1051c9fafaf1880
MD5 195cf05b2c2263938bc9eeefc8abbd88
SHA1 27ab23429c94fdeb77acbe5a118aebdddcfbce0b
SHA512 c0e50a18e97df08c047595feca40014238efb10c3801cf4eedf2cecbed4d6faee42fcdff5c85b2465955bcdfed75f72feee1dd63ecf5eb3837e38e0064fbb8aa
SSDEEP 768:JF5BLv7I5wCPFdV6Zi63rCgDe32DAsG/ki5XOImsaOxjL:BJUV6ZL3ZOk+7mxajL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\403018\E
Size 2.0MB
SHA256 e8df0394e172bc4f7109daa787bd50b705494d365a0579ae0eddb0ee5e5364fb
MD5 b3525b39c593cbb16dd739ab1469a6e7
SHA1 290f42c0df9d644246f2a67451cfd179625a58f3
SHA512 8509fc228028420dc88224f18febbf969e3594d0c1dd468c3be92bc43fcec546eda50fa37b7c0bca87f822fc49858ab3811bf0b794cd1a39797a6d412b8f1471
SSDEEP 49152:qmIPMMD5rjUwezNp5YYrXCpzmVPYDEgEM32:qmIEMD5rjUwezNzXzCpzwYDuM32
MD5 SHA1 SHA512 SSDEEP

Submit Download

Elizabeth.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\403018\Elizabeth.exe
Size 1.1MB
SHA256 881619a47b62b52305d92640cc4d4845a279c23a5a749413785fc8fcb0fdf7fb
MD5 7ac9278876c83c9b597fae68acb6fbf9
SHA1 18150c9b96bffd20c8203ff98a4fc153929bc2c9
SHA512 ddcedf90c53c148d85e36e039fc25712e242e9256ea8791d6cc15bb862b6b85a19a5583b5554f1afda9406affc4e953c4f8a2ddad6fe4d959a9fd5395dc870ee
SSDEEP 24576:r2XJHqX/Rr2YU9EPqYlsgSsJbD1tiP4+kUrp5B:yZql2nuxlRV1t1YrP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Acquire.aac

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Acquire.aac
Size 267KB
SHA256 2dc674516f342561f930d046aa7286a83af0eefb89e6a8e312fd08c5276b337e
MD5 50841040a158068470ad45c867e87df5
SHA1 9ccd763431941255cd5d59f5d892d563466589d7
SHA512 2b87414b2afbe38c476e46f8191f922d264b0854595104988fd2d5f05dd87527ba9f7246067c84628bbbdea17abfea49dacc88f7af84d6989d27a0f80f9f206a
SSDEEP 6144:n1FyWSu3v0aDoVSJyuopbSWrxCW2Rts3zulXaflISaECN38kHMp:nbyI38asVGHoSdsjMXafGy638ke
MD5 SHA1 SHA512 SSDEEP

Submit Download

Alto.aac

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Alto.aac
Size 236KB
SHA256 808bd39e27bd5a1578d4c2a2cd4e500a0e630808e24ba4da50e3b8564afa1cce
MD5 3150be877fc510ab39703ae32cae20cd
SHA1 09768cd334feb4ecdfde2546214d7663bf883570
SHA512 7ce26077715e4e271a3cf72a52d4a1226d7422ba2f0f0717c8f08dd883aedaf0eb1476135a6d426a85c6e83e2171f4dd18b2fe4082d56bc4302296c4285857ab
SSDEEP 6144:kMZ+zy5wBRKUi9zchGG85JfIgiVgX1qmEQX4paMRb:v4WwfKUi5WGZfIZglNoMM1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Citizenship

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Citizenship
Size 187KB
SHA256 b15e4f7648ed026fa899e0dba39f65769e334c7fff48d60ceb5ea270e812136c
MD5 d9622ebcc81e18ecbee78350d90176a0
SHA1 01739811298ca883b6239c316fdcbf0b357560b5
SHA512 74ff5d71ac7bfd5013bed414f17818e59fdbd61469b28e80a670a2a79156553345b26280266f427d0064ab70b6282cbccc520012a8c3c71cc716caea9582be39
SSDEEP 3072:Mw6uId1bvhOYSQurhrRIb+c2oZxr6DWy4ZNo4TSQ:D6DPbvVGrRz3o+aBZ24
MD5 SHA1 SHA512 SSDEEP

Submit Download

Clip.aac

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Clip.aac
Size 134KB
SHA256 c41c4e7a0d8d245f46440ebbb0e86148b8dd941b9c00fa8b89a95e8b2316480b
MD5 9a915ce28a4525ea0dac7fe97910273c
SHA1 5a39b585ce441abd7a1bbbe9ad926e6da2568468
SHA512 6aa29e3280113524445e9b5c73071a723893018205a4d9482191b84c7b3e41f61c6c70eebaeef0ecda41b691857474e2cbb3b7f5759424331f88685d0dbfd799
SSDEEP 3072:lgKlbV7O9Be++GratHR/gG4MkZAcJVCyU/upSbxKHkd3ol8c1:2KlbdOrKHUfjJTRUUkE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Crap.aac

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Crap.aac
Size 6KB
SHA256 b003e19484c0c9351dae2672f146603cc22649849b257d9c45111ef6e3af0f23
MD5 d791e18b676331e76612b00f56499617
SHA1 74789dd0ecc71d6a1c39ff9952480a9c904d8c63
SHA512 e4278c783c4b6253d7e06813aef1c9508a33001acd1055520f741befcf04056254af0a9789a40c6086577f534cb50d11941ef5ad619d32a0a7e0f2916c49a545
SSDEEP 96:2HWGjQLf0LTMTfkETAbqoQ5ynoD2kiuzjiT2k7xMu3p2hWqtEWY2Le/XCRhxsq+W:23MRPTAbvIwoDPleT37Wwfqm7dC2+K3O
MD5 SHA1 SHA512 SSDEEP

Submit Download

Finite.aac

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Finite.aac
Size 10KB
SHA256 4e567fd0abc00a66f77fb37b9fbc02b51fbce56017ec47c04add6dc36123fec3
MD5 ee92c5e9923662a56a7277fa89844d00
SHA1 b243785ba1c5250a85e4559105070a9d8bd2a8c7
SHA512 7ee67a555db695fefde8dc365e3cfa833570acbaf89d1d894a717315dd07cb3c7644c142d65aa826c1aa4b1e08d0b73d560df3230034a45e584d43c8a3737c74
SSDEEP 192:gIM7B78Z9D2xTF2UJLEldF8yJiUOMfGmvoWu0mfTO8d8lKKjgZLKKPv287N:SNCSTFp+FTJiUmpWSrOaXp7N
MD5 SHA1 SHA512 SSDEEP

Submit Download

Flat.aac

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Flat.aac
Size 296KB
SHA256 ee5b185826a6dc5cd3d420ec3407c46a9766a59e044ef0bd1abae0f0eb2146a4
MD5 584d69e6a255b38c594056d182364965
SHA1 92c0a09f5a0a65ab19657b04f50774c4f21dd9dd
SHA512 ca8b146777db9ff53177dc1e90e60ac0d9ff9d968a23b89a0e972779d2187cd473c5ac2e6e0939a065fc64717642a8e570fd4a87d3f22e62102f62b5558f7106
SSDEEP 6144:RECMO1sGc6e69iSg0zcHA+l5raOjq0gnWfEGBOxkkVgVlF/QkS4:q6sG7e2nHdOjZ11AxkkwF/pS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fraction.aac

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Fraction.aac
Size 291KB
SHA256 be09b892ad168b0c5f945dfc843b7135fd941d0ddb10680b82e4aea518038e08
MD5 2b7b6f0fa68ce0e8c7ff43929a423791
SHA1 333ba03aa4772eecad9c553941a26c8b6a25ef1e
SHA512 2d98e384ab1966fe17d6908c81db893f3754d6ba36c7ca3965b48d2e9f584574b5c4c2f6e9b988ad937880f8afae467cf07b69427aa22a29912f49bb2d5e297b
SSDEEP 6144:qlpPFVPWDkvx2oX/NZtD13tVlLsWbK1n8FPAD+BisPivEglO64qZt:SF15XVZtD5jlYWu1n8+SBisPisglO6fv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Funding.aac

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Funding.aac
Size 161KB
SHA256 fff73d707b614575706481ab6c6da90cc12914acae6d0dd45c875189d6c67cad
MD5 938ed71c25f968161e6a5c03937515c6
SHA1 0a9005e1e37ed4ea19481a10675cdb6446ead38f
SHA512 14f0e6f71407ba056b095df796ae76d4332a650d45b3529e309cb8e2db7e3e202fd13c798f2bce479a3bec749209a1bd0da1be11ca48a39387c38a7808e96ba1
SSDEEP 3072:ahJFp7rwb2EhcXEAuYfuhXVUvswG76qS8o/sEFJRKI9r+b:a/rri2sw7edwG+38oUYgb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gba.aac

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Gba.aac
Size 219KB
SHA256 ccc629ea9e7924050dcef08a981aa74760bae14db33fd35990068ed81cda3907
MD5 4ed7a31b40c21757445fd11bb925a806
SHA1 bba8adc36131a6faaf68ffa4ee36e4461e5f744b
SHA512 9fa77e522d628f9007a64143da3fe9fd609b411a9ae24107ba2e39265ae5e5a3780d570cae5b129580ad7f60510d922e0cc69d9e38f3ea49dafe3717d648c550
SSDEEP 6144:q3DG+QPrcUN7NKaS05xLmi5klutQEnByyG:qzONK+Lm1lpEQyG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Intended.aac

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Intended.aac
Size 191KB
SHA256 8213b14b304c75a46786a76682d54fe5ffe2de64fbe5360b9a50f46ee7a00b1b
MD5 7db202c3d234506298b5ce61ffee97f0
SHA1 43631dbd5645ff77a707eea68e6aa389668db5bd
SHA512 180ae2a7cf6812536f958407b467b490e1f1aada936b5d1dd2c148ca15174a0c8a48f5ceba1b9727e9593e072884595e706d395a836f2b2656a8d4850ca3b2fa
SSDEEP 3072:skAcTDY5yOmE/n5KgCHUmODvVET6cUKLSBxuTrn+NV2IEQFwyKPd/LJ8dGon7huS:skVTDY5yJE/m0zDvaG4S2n3IEGD8d/CT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Iowa

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Iowa
Size 1KB
SHA256 20fcf7b397759989eb067a08699591e57677c2705df897f15a1f4e2b6b1e19e3
MD5 8829bd9fd5b42d0ab5319bf40866b22d
SHA1 4058666492b9910abfebe684ad09d2f01dc8cf75
SHA512 2bcd322eaa183cc91a47746af2719d11a643adafa663f8faf62ee4cb30cc5ae2384d2cb6549b0d04b97361b2d692b666068d9bd496f54f725d6390dece66047d
MD5 SHA1 SHA512

Submit Download

Knights.aac

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Knights.aac
Size 271KB
SHA256 1330a4ee5ffaeec16d61279e6846aeeffff7dba8d2aa875d746edc662de4a698
MD5 dfc9714ca9d15d18dc2d2c9523e55dc8
SHA1 704de3ff282bc3df4fb958246f7ecf14da8722d2
SHA512 b89008ded95448c028a23632a4a089b126122356b5687a0fc01426f1da974debfb5a60798fc6d587dabd155e11d17e2487da9d6d0677f67a4eafb8310a1215cd
SSDEEP 6144:6vKVX4gRFTaYgNEU9c0jFBZ0k9I1X8kURCBhOF:sKV7JNgNED0jFBuX8/RC2F
MD5 SHA1 SHA512 SSDEEP

Submit Download

Plastic

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Plastic
Size 466KB
SHA256 e1c9cf6e9d426b640e63c274942fd2e1fa121473a214798f73d392d47612d83d
MD5 2cb702ec04611073ae591075c6001c45
SHA1 af239dd1bb83ee1bf902945e34c13dec97b721c9
SHA512 2eea55610751e85d5a7aec4e006188de5bfa0bc7b273d8617692b829ac8b4fe7ea356ca1e25647e3fab4c639af28ba35a52104cd3042d4cfe71e6316348c7085
SSDEEP 12288:Rn4wYV/FfEPqG+sCilsgSyzJbD1kyLviPYow+oVHddg:G9EPqYlsgSsJbD1tiP4+kg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tremendous

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tremendous
Size 427KB
SHA256 248289c83b5c550bcbb1ceb721bfa3f59fe2ea2bebb156509defa468dfb4b4ff
MD5 bf5f9a957b5a863da29cd6d33072d629
SHA1 763afe1006a2db52971034a9ac45be869cbdf379
SHA512 e6eedd2873202f763f48c7e1bc7fe40653a76fd11dc4af9c43adbe6e51d7087ec364fcea942ef00e446b31f07bdbd8e38d33881ae178d49b881db2832ff8c330
SSDEEP 6144:g1vRBHPoonCJXJrq/hoVqkSXFsczqkC7aVUaUviTRS505EXoiNy8xciSZ:4ZKFJXJH4zXGaVDUaTRr5EXoi/aZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1480-55-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/1480-56-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/1480-58-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/1480-60-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/1480-205-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/3648-53-0x000001AE48A50000-0x000001AE48A51000-memory.dmp

Download