Vidar/wingo loader VM-artifact evasion checks followed by rapid process exit

Ibrahim Saud@tektrix

•updated Jul 3, 2026•0•0•1

Detects behavior consistent with the Vidar/Wingo loader, part of Operation Turb00, where a process probes for VM/sandbox artifacts, specifically the VMware Tools daemon path and WMI ETW restrictions registry keys, followed by a rapid process termination characteristic of sandbox evasion.