vidar | 15941200699cfce84fd9f6b2f63e66a498656399d71a8f69f2bb734c5015f578

Analysis

user interaction
yes
max time kernel
28s
max time network
28s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/05/2026, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ToolsUnlock_v2.1.exe
Size 3.4MB
Sample260508-vxsqcsbt4x
SHA256 15941200699cfce84fd9f6b2f63e66a498656399d71a8f69f2bb734c5015f578
MD5 815f338a43a97290af7a39bc9a97b854
SHA1 0f910fae9e39f749e05b643162ba735e4ff9088e
SHA512 9a531119a742c8ef3c69602f74ae0d6eba51154996b05c3592b12e256397b538e371c9dd47b905073e2353ca59d0a91f67f291b7aa446a3b10467df0ac0fa346
SSDEEP 49152:5oDZf/H6fKNoSTzK9Lh5O3jBHd3NpKjfoFX+6ErCIf2DbPOnoWcLp+B:5WqSC5QtHd3NpKjfcEP
TLSH
T1F5F57C23BE6256F5C0DA9330C43761416AACBC45637827C73AA1EEB62F713C45E39B91
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery vidar spyware stealer

Malware Config

Signatures

Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detects Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral1/memory/4180-1-0x0000000140000000-0x0000000140104000-memory.dmp	family_vidar_v15
behavioral1/memory/4180-32-0x0000000140000000-0x0000000140104000-memory.dmp	family_vidar_v15

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
396	chrome.exe
4828	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ToolsUnlock_v2.1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ToolsUnlock_v2.1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134227345848054960"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-721190819-434563495-2007910846-1000\{2E0FB2F9-76EF-46FF-B394-DE782934841B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
5920	chrome.exe
5920	chrome.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe
4180	ToolsUnlock_v2.1.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5920	chrome.exe
5920	chrome.exe
5920	chrome.exe
5920	chrome.exe
1636	msedge.exe
1636	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5920	chrome.exe
Token: SeCreatePagefilePrivilege	5920	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
5920	chrome.exe
5920	chrome.exe
5920	chrome.exe
5920	chrome.exe
5920	chrome.exe
5920	chrome.exe
5920	chrome.exe
5920	chrome.exe
5920	chrome.exe
5920	chrome.exe
5920	chrome.exe
5920	chrome.exe
5920	chrome.exe
5920	chrome.exe
5920	chrome.exe
5920	chrome.exe
5920	chrome.exe
5920	chrome.exe
5920	chrome.exe
5920	chrome.exe
5920	chrome.exe
5920	chrome.exe
5920	chrome.exe
5920	chrome.exe
5920	chrome.exe
5920	chrome.exe
5920	chrome.exe
5920	chrome.exe
5920	chrome.exe
5920	chrome.exe
5920	chrome.exe
5920	chrome.exe
5920	chrome.exe
5920	chrome.exe
1636	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 5920	4180	ToolsUnlock_v2.1.exe	84
PID 5920 wrote to memory of 3128	5920	chrome.exe	85
PID 4180 wrote to memory of 5920	4180	ToolsUnlock_v2.1.exe	84
PID 5920 wrote to memory of 396	5920	chrome.exe	87
PID 5920 wrote to memory of 2944	5920	chrome.exe	88
PID 5920 wrote to memory of 2944	5920	chrome.exe	88
PID 5920 wrote to memory of 4960	5920	chrome.exe	89
PID 5920 wrote to memory of 4960	5920	chrome.exe	89
PID 5920 wrote to memory of 3336	5920	chrome.exe	90
PID 5920 wrote to memory of 5640	5920	chrome.exe	91
PID 5920 wrote to memory of 3336	5920	chrome.exe	90
PID 5920 wrote to memory of 5640	5920	chrome.exe	91
PID 5920 wrote to memory of 5456	5920	chrome.exe	93
PID 5920 wrote to memory of 5456	5920	chrome.exe	93
PID 5920 wrote to memory of 1348	5920	chrome.exe	94
PID 5920 wrote to memory of 1348	5920	chrome.exe	94
PID 4180 wrote to memory of 1636	4180	ToolsUnlock_v2.1.exe	97
PID 1636 wrote to memory of 4796	1636	msedge.exe	98
PID 4180 wrote to memory of 1636	4180	ToolsUnlock_v2.1.exe	97
PID 1636 wrote to memory of 4828	1636	msedge.exe	99
PID 1636 wrote to memory of 2492	1636	msedge.exe	100
PID 1636 wrote to memory of 2492	1636	msedge.exe	100
PID 1636 wrote to memory of 2492	1636	msedge.exe	100
PID 1636 wrote to memory of 368	1636	msedge.exe	102
PID 1636 wrote to memory of 368	1636	msedge.exe	102
PID 1636 wrote to memory of 548	1636	msedge.exe	103
PID 1636 wrote to memory of 5360	1636	msedge.exe	104
PID 1636 wrote to memory of 548	1636	msedge.exe	103
PID 1636 wrote to memory of 548	1636	msedge.exe	103
PID 1636 wrote to memory of 5360	1636	msedge.exe	104
PID 1636 wrote to memory of 5360	1636	msedge.exe	104
PID 1636 wrote to memory of 5224	1636	msedge.exe	108
PID 1636 wrote to memory of 4904	1636	msedge.exe	109
PID 1636 wrote to memory of 5224	1636	msedge.exe	108
PID 1636 wrote to memory of 4904	1636	msedge.exe	109
PID 1636 wrote to memory of 2340	1636	msedge.exe	112

C:\Users\Admin\AppData\Local\Temp\ToolsUnlock_v2.1.exe
"C:\Users\Admin\AppData\Local\Temp\ToolsUnlock_v2.1.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5920
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff926d1c728,0x7ff926d1c734,0x7ff926d1c740
    3⤵
    PID:3128
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1580,i,3252721578744784370,2477790938717684251,524288 --field-trial-handle=2144,i,13297912262238184405,5031905254046259159,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2188 /prefetch:3
    3⤵
    - System Time Discovery
    PID:396
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,17917466626872364912,3462310093139874976,262144 --field-trial-handle=2144,i,13297912262238184405,5031905254046259159,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2136 /prefetch:2
    3⤵
    PID:2944
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=1840,i,18072819429808219552,14861151575070522998,524288 --field-trial-handle=2144,i,13297912262238184405,5031905254046259159,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2416 /prefetch:8
    3⤵
    PID:4960
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3192,i,9835336421882473857,13890859222370310532,2097152 --field-trial-handle=2144,i,13297912262238184405,5031905254046259159,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3208 /prefetch:1
    3⤵
    PID:3336
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3196,i,13784044406636813619,2102290079119488617,2097152 --field-trial-handle=2144,i,13297912262238184405,5031905254046259159,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3472 /prefetch:1
    3⤵
    PID:5640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4196,i,13374550042782773752,1332537028866851116,2097152 --field-trial-handle=2144,i,13297912262238184405,5031905254046259159,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4208 /prefetch:2
    3⤵
    PID:5456
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4460,i,17475883805706499994,14758385361670244129,2097152 --field-trial-handle=2144,i,13297912262238184405,5031905254046259159,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4624 /prefetch:1
    3⤵
    PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2f0,0x7ff92668c188,0x7ff92668c194,0x7ff92668c1a0
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,1132154001412912596,3335391000809104426,524288 --field-trial-handle=2324,i,2358990761751770248,3585600530386683111,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,16159736741517362731,3455145987893221308,262144 --field-trial-handle=2324,i,2358990761751770248,3585600530386683111,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
    3⤵
    PID:2492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,6200629023546344698,2722965493649512267,524288 --field-trial-handle=2324,i,2358990761751770248,3585600530386683111,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
    3⤵
    PID:368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,16985628961409522414,18125340031466242850,2097152 --field-trial-handle=2324,i,2358990761751770248,3585600530386683111,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,4706892814414292824,10422709301627389460,2097152 --field-trial-handle=2324,i,2358990761751770248,3585600530386683111,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:5360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,5830634521575355220,17074718112514508393,524288 --field-trial-handle=2324,i,2358990761751770248,3585600530386683111,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
    3⤵
    PID:5224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,3276995832758109207,16107986491150919275,524288 --field-trial-handle=2324,i,2358990761751770248,3585600530386683111,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
    3⤵
    PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,10648361425878018039,11909355061438998565,524288 --field-trial-handle=2324,i,2358990761751770248,3585600530386683111,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
    3⤵
    PID:4792
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,10648361425878018039,11909355061438998565,524288 --field-trial-handle=2324,i,2358990761751770248,3585600530386683111,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
    3⤵
    PID:2340

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5900

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2484

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2376

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5516

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 9c8e9990f10f250ed45486f560fee5f8337716ad05f77b7e5bc5943f2bf7e680
MD5 bfe19f2527da4f8dd5df01d5d1d5c7ae
SHA1 0f6858ec141166984227df597814deeb450cea3f
SHA512 bb8cc8f1a8444cda281329cdc341a9516c49833afe764babaeed630729c325db3321b4ab15e7164b7792723a83f17fe322d136831d1f4d21b912488823506aa1
SSDEEP 1536:0NGcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEB:IG3Qw/xLANk0mUW5GmRntSFCjEEN3
TLSH
T1249312BA4E1A46E7957E4AC176AD7808CE22130D70AFA9CC316C639D61941C92B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 030978901609c12837a9b1afdcd1ee9f12ef19339fd94725f17a7cdb1e945f36
MD5 35e76198d1c2c61d3c2a49119ba65747
SHA1 a5ae8329c9e762bed0a3d6bc5584e8faf6d26a77
SHA512 8b21ab6c5e29ab0ea7652b7adadb04a05eb734a52faa779252fbec4acd45079c7ad3f83f36227a419f0a59fc94eb1cf408bcd782459cf4691b6eb727be746fd3
TLSH
T136D0800925B7DC74D059847018977B4D7555CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 827caedd6ba67a465e2378da508ebf9f7e5dc38b9ff3d1086fe8a0b10ad23634
MD5 6a7649ad8529021b8a0bf012adb69564
SHA1 bc6cb8e64c0f5c84a887a19005280de2e2ff95dd
SHA512 316ecd29696eeae0002f91778818c1c4166e5bbf8440eddea3560a6ea0fb49f25e4e33c48c2d7c73eb08507c015f5aa7eb4187e6558ebdc4cd44c5bd980d8c3a
TLSH
T133D0800529B3DC74D055847018D77B4D7665CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 96ba37677d9f1b0f408bcdd23d9634fa9277577d43b8af7c542e9b8ba90db909
MD5 0d4985e7fe19813649243229c5b865f1
SHA1 94e53fedd50d87baf7b7bb12fbce19a61667779c
SHA512 ae3e2e0a14acde2d2321c3688178c15bf2ee1170c5e1884566ae3c9bba36fe4bc0b978ce49682783be3f10b8ae18872f9698abc4f9765a071057f919a1c91267
TLSH
T154E02BA6C872EC2708FD171861645646E74423572781888F3A3C870C8FB5977459685C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 bd3c60c94ffa5b3091d14d536b4a15c35310f905b09701837c440f3b5a40edec
MD5 460bd0236311bed39db0560f6b2995fb
SHA1 17607cd11c43a55c509729869b13df7820ce7cc5
SHA512 6e24151bd936c54ed8173d090b6890ec03ad8167f750fd12d411c761ef7d442e3cc594a84a0f297d92208de47835e0552c82578871a8f8cd360df9bfdc712966
SSDEEP 384:sxZIn/Vc//fRs3eZQihz/OiJk8+gMHbP/2mbnjk:s6/u//feeZ/hLOiJk8gHb32mbI
TLSH
T1B282F706A938597BCDDBD219F9167BA3D7F92123D5804E49A5FC8E0C04E6BDD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 15cec3e0421768b032e5a02a44506ba012a3bdf45c8f394251ddb7fea730ce66
MD5 98fa9d170b16946d2758a66ab3ca90c9
SHA1 f7bb3305eab658f46482bec95b7ae43ffd210e6e
SHA512 f2ba0c2fd83bb5ff170205db83f0c4fad17e7b71b8114213592293985046d59e9041eafa5bdb8360db86dd9a77b97f8e2ac38dcff201c710c609c920f69914ca
SSDEEP 768:DcgLiAo7pLuL/aeWvaShq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVAMKJLlhzCpUroS:DcgLiAUE/aeWvaShqu1jaVMKJLDOp/S
TLSH
T143F20C3B2C0CCB7E4F844A9CDC2ABE8E6DE4028B9698895447FA445C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 ce8c4ca160ee7c27cfb7b971f7cdc9fc24cdd3a3700291ece1f95ed998780e43
MD5 8e3d021d8ffef085cb4051c8456c27c9
SHA1 ec0196f400b8c3fba6749f8abead1947e55cde7a
SHA512 3d9c77bd6586269038202f4118aa9f406548b291e18ab5907f3d9a65de6d478d2da204196dcd3eb004cecbf90535ad735cfbca9e88efc61505a816a86550edee
SSDEEP 192:kBhNHfIVfhRXF4B6W4KqV2j6Ok4pYLQobOyzcp/KLNz3B0INOyYiWhOLyqweDMHY:krN/INhx+kcxKBzxLpf
TLSH
T1DFB23B11727A02813A7E399EC595B42F26C230633098B53B7BB914A60F6BE20DDFD5DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3ef2b79337ac1672ec63c5a958a25c550f0daa3fb63779b2a412b32539ddeb3f
MD5 f7a178541c03e27376cfc1a61b62bbeb
SHA1 9c96d86ea96243f8e381e1521182370f123700be
SHA512 8001aa5d27b99f4a626cedc178d2a5555a7822f6c9453be7c130cc1edb9d9701496cd61e8795804c41fddf96d8472da5c21a7c3e15987092838ab0b431de3000
SSDEEP 768:lFccps3/wgApJ5GYnTPjI+0uwLaArXc8Y:Bs3OpJ3PE+twLJcH
TLSH
T139C24A32E8A8D9ABEDDA9ED5F71A3617DEE00163868C9AD4D5CD1E0D008B1DD130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1cd783ce75cb04c6ddd763612d4378b97adb78402fd3dfdbdfb5a4168a18d565
MD5 c7bc7ff18d96de46c429333eba1e5adf
SHA1 7c606fbfd1f50568eece9364a5f60341497fc028
SHA512 832cce6c1011c71dd15c578d94b29d2fff7d6915fef7eb5deb2b8dfe51befe82555aa9a3b4c43d0a16a491b2ca3eb733d921682a4aead79c5f9e15aaedd2fd36
SSDEEP 384:nyiFavqMg3sNi8TUNTUlIm2ZTPo1zOwfjYYQTPwYob+0KuRYV/Vw1mRWCe0srN1k:5Fayv3PwgHe5YnTPjI+TuRYk1mk/0Ik
TLSH
T1C9C23A72E894DDABEDEB9FD5E70A7603DEE042A7C68C4AD4D6C81E1D00971AD530BC06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 2eb3bd6b38b3e42f50456c0912047285d169926bbeb54f73286a417a5c1875f8
MD5 933be99ea2b80a07f09ab1abdae59382
SHA1 23efb2987224bcf5d3d1c83fd022859cf22aa6b5
SHA512 db2d85bb5c9e9c663ec10772daf173a095adb499f509c0c79037023cfd410dcae979d90423a498421d6476d38470b736dc92be9f965da821b21b991cca57504b
SSDEEP 384:nEiFavqMg3sNF8TUNTUlIm2ZTPENx6OwfjYYQTPwYob+A54RYV/Vw1mRWCe0srNa:fFayv3UwgHeuYnTPjI+AuRYk1mk/0Ik
TLSH
T145C24A35E894DDBBEDEA9FC9E7497A03EEE001A7C59C49D4DAC80E1E009719D230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 479a70a7e6922d4095e6c5e592b124c4022edd6d995406c086e0efda33462c5e
MD5 8aca38728480f79befc5de58bc39dd3d
SHA1 f98f8b70f87fa6b8f0f4c420fe901c480363f134
SHA512 2b76ca31628b8f5d5f2c860b7a7a673f70d1bce8c249e742477d6865529dad05f7c4ac8f437bbaeb62a1a5ff49d015317d022e9e591bfa8023f41a25be1c21f5
TLSH
T15C412798BAF92148B3776F5AABF6A86D487FB9772F06D45D10110D4E0B23B00C862737
MD5 SHA1 SHA512 TLSH

Submit Download

cXZHNhR1F7OW

Path C:\Users\Admin\AppData\Local\Temp\cXZHNhR1F7OW
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2376-72-0x000001F5AC950000-0x000001F5AC9EB000-memory.dmp

Download

memory/4180-0-0x0000000140000000-0x0000000140104000-memory.dmp

Download

memory/4180-31-0x000001A748330000-0x000001A74833C000-memory.dmp

Download

memory/4180-32-0x0000000140000000-0x0000000140104000-memory.dmp

Download

memory/4180-30-0x000001A747F30000-0x000001A747FCB000-memory.dmp

Download

memory/4180-1-0x0000000140000000-0x0000000140104000-memory.dmp

Download