vidar | ed3cd15b4d4e33402b935382d02902c91947fbe3f052deec0f48dce8e20d228f

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/04/2026, 00:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 19.4MB
Sample260430-azftcsdy2n
SHA256 ed3cd15b4d4e33402b935382d02902c91947fbe3f052deec0f48dce8e20d228f
MD5 4266e452688b90fd08d97c436c02fedc
SHA1 2075c3f258be292cf65f49522c56eafeacd2a186
SHA512 8bd84527e4504d02f422355d2dc72cefc547068409a7374a0ef82f6afbcead14f54d5f40f1ec150c2a0c6c7b5071fcda70f9b8b89589572ba14844998766795d
SSDEEP 393216:B9jiGkyHEiyVM+I+rg7pfrj8h8UdQQ6oTw23pRxf6HTlmOdTf4OhVvtWrQzmkKI:B9jiGkyk1ljE7pvU60P3p3qTlmmTfRiK
TLSH
T152273388F3A104A8CA0314B6D53D5737B2F1FCC80624673EF98DD75C2EA9E5E69AC905
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery vidar persistence spyware stealer

Malware Config

Signatures

Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detects Vidar Stealer 4 IoCs

stealer

resource	yara_rule
behavioral1/memory/4724-2-0x000002D3AAB00000-0x000002D3AAC04000-memory.dmp	family_vidar_v15
behavioral1/memory/4724-21-0x000002D3AAB00000-0x000002D3AAC04000-memory.dmp	family_vidar_v15
behavioral1/memory/4724-229-0x000002D3AAB00000-0x000002D3AAC04000-memory.dmp	family_vidar_v15
behavioral1/memory/4724-242-0x000002D3AAB00000-0x000002D3AAC04000-memory.dmp	family_vidar_v15

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Setup.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
137	4724	Setup.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Setup.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LunarNav.lnk	Neighbors.exe

Executes dropped EXE 3 IoCs

pid	Process
3652	2xSn5q2IyZ.exe
5196	Neighbors.exe
2488	Neighbors.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wine	Setup.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Setup.exe
Key opened	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Setup.exe
Key opened	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Setup.exe
Key opened	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Setup.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2xSn5q2IyZ.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5196 set thread context of 2488	5196	Neighbors.exe	129

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3892	chrome.exe
4048	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Setup.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2488	Neighbors.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
1368	chrome.exe
1368	chrome.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe
4724	Setup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1988	msedge.exe
1988	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1368	chrome.exe
Token: SeCreatePagefilePrivilege	1368	chrome.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1368	chrome.exe
1988	msedge.exe
5196	Neighbors.exe
5196	Neighbors.exe
5196	Neighbors.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5196	Neighbors.exe
5196	Neighbors.exe
5196	Neighbors.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 1368	4724	Setup.exe	98
PID 1368 wrote to memory of 1556	1368	chrome.exe	99
PID 4724 wrote to memory of 1368	4724	Setup.exe	98
PID 1368 wrote to memory of 4212	1368	chrome.exe	100
PID 1368 wrote to memory of 3892	1368	chrome.exe	101
PID 1368 wrote to memory of 4212	1368	chrome.exe	100
PID 1368 wrote to memory of 3036	1368	chrome.exe	102
PID 1368 wrote to memory of 3036	1368	chrome.exe	102
PID 1368 wrote to memory of 5068	1368	chrome.exe	104
PID 1368 wrote to memory of 5068	1368	chrome.exe	104
PID 1368 wrote to memory of 3400	1368	chrome.exe	105
PID 1368 wrote to memory of 3400	1368	chrome.exe	105
PID 1368 wrote to memory of 5796	1368	chrome.exe	106
PID 1368 wrote to memory of 5796	1368	chrome.exe	106
PID 1368 wrote to memory of 2152	1368	chrome.exe	107
PID 1368 wrote to memory of 2152	1368	chrome.exe	107
PID 4724 wrote to memory of 1988	4724	Setup.exe	110
PID 1988 wrote to memory of 1984	1988	msedge.exe	111
PID 4724 wrote to memory of 1988	4724	Setup.exe	110
PID 1988 wrote to memory of 4048	1988	msedge.exe	112
PID 1988 wrote to memory of 1428	1988	msedge.exe	113
PID 1988 wrote to memory of 1428	1988	msedge.exe	113
PID 1988 wrote to memory of 1428	1988	msedge.exe	113
PID 1988 wrote to memory of 2492	1988	msedge.exe	115
PID 1988 wrote to memory of 2492	1988	msedge.exe	115
PID 1988 wrote to memory of 3152	1988	msedge.exe	116
PID 1988 wrote to memory of 5804	1988	msedge.exe	117
PID 1988 wrote to memory of 3152	1988	msedge.exe	116
PID 1988 wrote to memory of 3152	1988	msedge.exe	116
PID 1988 wrote to memory of 5804	1988	msedge.exe	117
PID 1988 wrote to memory of 5804	1988	msedge.exe	117
PID 4724 wrote to memory of 2736	4724	Setup.exe	123
PID 2736 wrote to memory of 3652	2736	cmd.exe	125
PID 3652 wrote to memory of 5196	3652	2xSn5q2IyZ.exe	126
PID 5196 wrote to memory of 2488	5196	Neighbors.exe	129
PID 5196 wrote to memory of 2488	5196	Neighbors.exe	129

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Setup.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Setup.exe

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Downloads MZ/PE file
- Looks for VMWare Tools registry key
- Identifies Wine through registry keys
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8f2e7c728,0x7ff8f2e7c734,0x7ff8f2e7c740
    3⤵
    PID:1556
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,5274236867109038972,9978062900071926323,262144 --field-trial-handle=2020,i,2039127310315893032,11761159589393506662,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2016 /prefetch:2
    3⤵
    PID:4212
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2056,i,11365618850160649582,8107969055125411278,524288 --field-trial-handle=2020,i,2039127310315893032,11761159589393506662,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2108 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3892
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,8451574930966662178,5512631437065323884,524288 --field-trial-handle=2020,i,2039127310315893032,11761159589393506662,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2328 /prefetch:8
    3⤵
    PID:3036
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,15522323283149005824,7457694867705247923,2097152 --field-trial-handle=2020,i,2039127310315893032,11761159589393506662,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3244 /prefetch:1
    3⤵
    PID:5068
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,4766596857813259429,1131387260410718378,2097152 --field-trial-handle=2020,i,2039127310315893032,11761159589393506662,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:3400
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4244,i,4903605699710652474,11515030320397441647,2097152 --field-trial-handle=2020,i,2039127310315893032,11761159589393506662,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4256 /prefetch:2
    3⤵
    PID:5796
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4588,i,10004605917440633101,13943904321206975795,2097152 --field-trial-handle=2020,i,2039127310315893032,11761159589393506662,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4624 /prefetch:1
    3⤵
    PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ff8f2e5c188,0x7ff8f2e5c194,0x7ff8f2e5c1a0
    3⤵
    PID:1984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,17272126886285022691,9157297746064586933,524288 --field-trial-handle=2292,i,17099234377853686039,11939982937797841415,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,16922419460352617484,11338545252354729547,262144 --field-trial-handle=2292,i,17099234377853686039,11939982937797841415,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
    3⤵
    PID:1428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2092,i,1860306611585673425,554258015990098901,524288 --field-trial-handle=2292,i,17099234377853686039,11939982937797841415,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:8
    3⤵
    PID:2492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,13950940967792977164,13054575340603978163,2097152 --field-trial-handle=2292,i,17099234377853686039,11939982937797841415,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:3152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,8391253815657417245,16509038313386065914,2097152 --field-trial-handle=2292,i,17099234377853686039,11939982937797841415,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
    3⤵
    PID:5804
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c start "" "C:\Users\Admin\AppData\Local\Temp\2xSn5q2IyZ.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Users\Admin\AppData\Local\Temp\2xSn5q2IyZ.exe
    "C:\Users\Admin\AppData\Local\Temp\2xSn5q2IyZ.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3652
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Neighbors.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Neighbors.exe Tables
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Neighbors.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Neighbors.exe
        5⤵
        Executes dropped EXE
        Suspicious behavior: AddClipboardFormatListener
        
        PID:2488

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5312

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5048

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 44637e7eab50a568e79f591adffa159598c6c82f39b2204f38bc745cc1f0642b
MD5 0e48db21ce28400c2b4a7d65c3dd882c
SHA1 71b2740a4535004adfeedc615788fba93c30f39f
SHA512 6e1cfc12789b3e6c242b0e15617e824d1d46080be6a87ca94b9c03fc36d01ebf002d2c6e4f70e453ed2a880045785588a478766b8d660501af8c77e3114fe6d4
SSDEEP 1536:0cCWcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9Yj:0i3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T1EA9302BA9E2746E7957E468176AE780CCE13530D709FA9CC315C639C21D42C92B72E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8b1e4ba6890ec60cfe9f6942acc1937ba6fdde042b45c0a2e0b7e13ade701cfd
MD5 642961cbd4f67f82b3038bc1275d24c3
SHA1 f1df4ba11ac13409c392147b2a9da411bc9cd6eb
SHA512 4f7f98f2ebf15c98a7f379a7975f6dff1c7086a1e3cf81d3daec8c9be6212ba05fb4eefc5fa2c0486a277860dc8b2aecdded5e174409117a0736b1cd3b8443d0
TLSH
T1CCD0805C52B3BC75D4C7997045C53B47373ED493659187317C6274B90C534504D961C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d68b8059d1fdfd8541892ccb136bddd7ec7601b55110e2cdd4c0e5ace97d9da8
MD5 531be76c0b4d3ce6131509c7d95980da
SHA1 8d06c8ade4d281ea8e43a1dd0a469db76987e5cf
SHA512 3f61844b74b97a902b9307c088590e72b7ad0e95c0f14948ae3780aa3e04b871d8e5c5cb6ca5f5fdf524ad8258178623c85c528a35deec8559c2d1d114436d1f
TLSH
T125D0C05C12B3BC35D4CB987004C13B03323ED893659187307C2234B80C0304048960C3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9ee838dd-a441-435f-b78f-4a16a5581428\index-dir\the-real-index
Size 2KB
SHA256 d5beddab1ed52c4ee82ed911a3ff66fb625cca9f63e10190a30a880f90a86395
MD5 be6eca5d4ff3e75667d5513ea5de019c
SHA1 76eb76bb12791f4bb494427582b2908b407c4067
SHA512 998e840648fb3e4057ebc7e7c83d116ba80f88f7f903d11c58c7ebfde7e70df807bafdf9dcd20d68bb233a36e3e82d790f22ae9aa5b6b5d68d2ae6dfd79acf34
TLSH
T14251E84D9C4A5F17CA7D12F168BA046A33394CFE1A58470B29FD5A3C6C9725A2DD7208
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58de16.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9ee838dd-a441-435f-b78f-4a16a5581428\index-dir\the-real-index~RFe58de16.TMP
Size 2KB
SHA256 a561265233dad281ae292356c86d3df2fa6279a10b5ffb00ecc0e871eb9f9522
MD5 78d03719ecc47902996c4c1c83518a76
SHA1 8ea44bfe9a88e349ed35e044de3bda37dffa9f8c
SHA512 ce1a2935f91bb56da7b8a8104c88b80a01b987495aad460c4d4e10f4dd6fcc121f309fbc0bbc9a4935f434344a605ce3de87a12f40872aa6f504ebc42d04a121
TLSH
T1F551A59E9C420A22C99095B359CA6469333D68954A49AB0B35EC8A33ACC37AE3D57344
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 8b36e43232843fb1ca0a21c3344b07b38856ebf257f21ab46a9d549b0c3ebb3d
MD5 17f746a1e16b815f29f47fbfe1bd0e04
SHA1 70444643c16c033c890d0cf51b379e21ca230a63
SHA512 00c05a2bc0221ca19f81599bf311a4bab64f83d9dff7e36467b2313307a50a35175b7c5808b3b4c775c9c7c4ab148ded42c222ccd602d3db07d8cbc621cff13c
SSDEEP 192:P+x3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mx3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1C524640A7B787001EDE3D9725CB080771E3CA16DCF22A6915DB654694EB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 0c6d02ac2d48390ab9cad5fdc09a36afa8b4a28ecabd956356c3bdeb37052f75
MD5 e1281c129721b668a660e4999de0967d
SHA1 5dc0008760bda584f8d62d73bd66e6dcd174d403
SHA512 9ba157969ad96efe2b399cbfd2a543f0fab5316c3998bae6f6468f9e707958c471d1e6cf6f614ad31d5d31f273ccf514d5a23f6f1c1360ae5bfb22263a31aa21
SSDEEP 384:n0iFavqMg3sNKn8TUNTUlIm29JCVsvRvfYPLIPYK+hjdnS4mtmOirNlk+5vI+i:PFayv3xnwg+s6PLSY/jdS4smOi2
TLSH
T1E8C24B75EC98DABBECE78FC9A7497A07DEE041D795884AC4CAC82D0E00971DE134BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 fec2e9cd752ee83f7d51d9fb8c327fa3871de75641f3f89fa28c11006bae34e8
MD5 c07be49eb7c125b5ca3d722def9cf5ef
SHA1 1181d63f547c26b79f71abe2637875b633b6b5bd
SHA512 dc2f15232edc6c6ace47632aa33cd996637b82157335c2e07acdfd27623f3f1cdf639ce9c13ef6fe9bdc15a5575de0d5bb93f91cd675ed252d7ed85903305df9
SSDEEP 384:nHiFavqMg3sNh8TUNTUlIm29JhbsIRvfYPLIPYK+edcaudnS4mtmOirNlk+5vI+i:CFayv3KwgLsdPLSYhaudS4smOi2
TLSH
T14CC23A76E898DA6BBCE68BD9A7457A03DEF04197D58C4AC4CACC2D0E00DB1DE134BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2xSn5q2IyZ.exe

Path C:\Users\Admin\AppData\Local\Temp\2xSn5q2IyZ.exe
Size 3.3MB
SHA256 1d55cb2f45bf1cb3ab83d07a0b2dac47d6a6e850da29e82ea00961c727ef366b
MD5 e5294827b45e3105b043de228b722c9d
SHA1 1107c0ea7a2478c38cd26ba1b60beddc531da154
SHA512 bb842f02db238ec3a27276b860083b0b11e4e860cab7afcc00f51306abd58dd3d0a15937f4aadb9eee251eaf67eeb91c8f3cc4f1081e09370aa4b18b4960ba9d
SSDEEP 49152:Q3hh2vCgVrsVLLzwH1bFp1h6uG745g4jfIvIhzIbR6hleoUwnagCty8k:+hs3RsZL4BF7I/7YH7KR6hleo3naNy
TLSH
T110F52346A4D451E2C439D0BBD25E1E3B87237C5BCA23AB272288FD337D976934529F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Neighbors.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Neighbors.exe
Size 1.1MB
SHA256 5d69a932a077fee044b193c28e84564143f5c7e51079ab48e88fef74ab0b77b7
MD5 80cdd5f19d704a001589976bae277bab
SHA1 96bb030389ac938c5ebc6bd2e9fcc86a10e5f2fd
SHA512 03fbfd02d348c2b54af3eeb022ae2f1be4e4f9b30352ceb2c7589233275a914ec4fd81ff8c1544bebf96a87e28c75fd81811e658f092536367395048a82bf8fa
SSDEEP 24576:HsTBc4JYoji1a2gOI6fQJ77jkD1KV3wKct4frNFOB:MTC4a4p+E72SwRcrK
TLSH
T1DA356C0673A4419EFEA7F1329607C60BD6B17C4A07779A6F02646B626F337711A2E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tables

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tables
Size 2.2MB
SHA256 a82e857fe0a7d4f95da2fa4a1d04b92bcb9f07c7604da388e22dba9d73140ab1
MD5 4455bc85806d1ef1c21b7930f3f30522
SHA1 d9397e1713419d8c999977443c13763762ded2aa
SHA512 7224031563782024716c73ab9a9231c9a35d49fe424ff6330f78cae631192152fc435d8a551f3e555f5eb94f8acb68e3b8e3d9533365e5d1baabd52a3a16748b
SSDEEP 49152:muXY2oCg3ys8LO1tDwbBp1m9/us4KeYjfH9iKyZFk4jltfednK:lXjOis2ODGB78WsVXobk4jltfYnK
TLSH
T11AB5332CDA6D9372D726709BF3EF8931FB0C688315173C6305CDA53A4B876CE4598A26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bnfA6kbXfT8l

Path C:\Users\Admin\AppData\Local\Temp\bnfA6kbXfT8l
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2488-248-0x000001EDB2580000-0x000001EDB271B000-memory.dmp

Download

memory/2488-262-0x000001EDB2580000-0x000001EDB271B000-memory.dmp

Download

memory/2488-264-0x000001EDB2580000-0x000001EDB271B000-memory.dmp

Download

memory/2488-265-0x000001EDB2580000-0x000001EDB271B000-memory.dmp

Download

memory/2488-266-0x000001EDB2580000-0x000001EDB271B000-memory.dmp

Download

memory/2488-267-0x000001EDB2580000-0x000001EDB271B000-memory.dmp

Download

memory/2488-268-0x000001EDB2580000-0x000001EDB271B000-memory.dmp

Download

memory/2488-241-0x000001EDB2580000-0x000001EDB271B000-memory.dmp

Download

memory/2488-269-0x000001EDB2580000-0x000001EDB271B000-memory.dmp

Download

memory/2488-245-0x000001EDB2580000-0x000001EDB271B000-memory.dmp

Download

memory/2488-247-0x000001EDB2580000-0x000001EDB271B000-memory.dmp

Download

memory/2488-249-0x000001EDB2580000-0x000001EDB271B000-memory.dmp

Download

memory/2488-252-0x000001EDB2580000-0x000001EDB271B000-memory.dmp

Download

memory/2488-270-0x000001EDB2580000-0x000001EDB271B000-memory.dmp

Download

memory/2488-251-0x000001EDB2580000-0x000001EDB271B000-memory.dmp

Download

memory/2488-250-0x000001EDB2580000-0x000001EDB271B000-memory.dmp

Download

memory/2488-271-0x000001EDB2580000-0x000001EDB271B000-memory.dmp

Download

memory/2488-263-0x000001EDB2580000-0x000001EDB271B000-memory.dmp

Download

memory/2488-272-0x000001EDB2580000-0x000001EDB271B000-memory.dmp

Download

memory/2488-273-0x000001EDB2580000-0x000001EDB271B000-memory.dmp

Download

memory/4724-0-0x000002D3AAB00000-0x000002D3AAC04000-memory.dmp

Download

memory/4724-21-0x000002D3AAB00000-0x000002D3AAC04000-memory.dmp

Download

memory/4724-242-0x000002D3AAB00000-0x000002D3AAC04000-memory.dmp

Download

memory/4724-229-0x000002D3AAB00000-0x000002D3AAC04000-memory.dmp

Download

memory/4724-1-0x000002D3AAB00000-0x000002D3AAC04000-memory.dmp

Download

memory/4724-2-0x000002D3AAB00000-0x000002D3AAC04000-memory.dmp

Download

memory/4724-16-0x00007FF62F710000-0x00007FF62F770000-memory.dmp

Download

memory/4724-17-0x000002D3AAC40000-0x000002D3AAC57000-memory.dmp

Download