acrstealer | b038b23220a6948af729f5fe9243481ab0a16e8a27378c08e1bc6eb51c7398ac

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/08/2026, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ALE123.exe
Size 4.9MB
Sample260811-pn69haek21
SHA256 b038b23220a6948af729f5fe9243481ab0a16e8a27378c08e1bc6eb51c7398ac
MD5 56b09b7356441f70f08737347734f13d
SHA1 cfae11ef7a6a46d3cc47f8455afc49c02a726c66
SHA512 a8b214de916d86969f379651356ff392d8d5ff22f92cf3631afa88cbb57d744785692aa28f740cdaf4a85a120eab8a065d249f0a532b51dcd1eaf6f31539eb8a
SSDEEP 49152:Wli+6vJ4EXAy+2uH5HqTmr8xFO+kvYJMvg4oXHhyHPyF1xSCehG1D3DR855NxhEf:QoJ4OlSAxVD60lVEIv1IDxBaWC
TLSH
T18B362A01EFCA44F6D5031B3060EB632F6339A9190B7D9B93EE503A6AFE673511C36649
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery acrstealer spyware stealer

Malware Config

Extracted

Family

acrstealer

Version

4.3.2-alpha3

wss.infrastructurecore.cc

Decoy

keycdn.com

Attributes

guids
a6cdcc0b-6b38-49d6-9672-20be114d9eba

019fddb7-f955-741d-9654-974f603f741d
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer

Detects ACRStealer V4.x 13 IoCs

resource	yara_rule
behavioral1/memory/6080-0-0x0000000000400000-0x00000000004BC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/6080-2-0x0000000000400000-0x00000000004BC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/6080-5-0x0000000000400000-0x00000000004BC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/6080-37-0x0000000000400000-0x00000000004BC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/6080-43-0x0000000000400000-0x00000000004BC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/6080-84-0x0000000000400000-0x00000000004BC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/6080-85-0x0000000000400000-0x00000000004BC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/6080-91-0x0000000000400000-0x00000000004BC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/6080-334-0x0000000000400000-0x00000000004BC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/6080-335-0x0000000000400000-0x00000000004BC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/6080-333-0x0000000000400000-0x00000000004BC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/6080-338-0x0000000000400000-0x00000000004BC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/6080-412-0x0000000000400000-0x00000000004BC000-memory.dmp	family_acrstealer_v3

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 6080 created 3272	6080	ALE123.exe	56

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
6080	ALE123.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ALE123.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1912	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134309249839582263"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe
6080	ALE123.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 6080 wrote to memory of 2684	6080	ALE123.exe	85
PID 2684 wrote to memory of 4148	2684	chrome.exe	86
PID 2684 wrote to memory of 1724	2684	chrome.exe	87
PID 2684 wrote to memory of 1724	2684	chrome.exe	87
PID 2684 wrote to memory of 1912	2684	chrome.exe	88
PID 2684 wrote to memory of 4756	2684	chrome.exe	89
PID 2684 wrote to memory of 4756	2684	chrome.exe	89
PID 2684 wrote to memory of 5236	2684	chrome.exe	90
PID 2684 wrote to memory of 5668	2684	chrome.exe	91
PID 2684 wrote to memory of 5236	2684	chrome.exe	90
PID 2684 wrote to memory of 5668	2684	chrome.exe	91
PID 2684 wrote to memory of 5828	2684	chrome.exe	92
PID 2684 wrote to memory of 5828	2684	chrome.exe	92
PID 2684 wrote to memory of 4408	2684	chrome.exe	94
PID 2684 wrote to memory of 4408	2684	chrome.exe	94
PID 2684 wrote to memory of 5512	2684	chrome.exe	96
PID 2684 wrote to memory of 3864	2684	chrome.exe	101
PID 2684 wrote to memory of 860	2684	chrome.exe	102
PID 2684 wrote to memory of 1856	2684	chrome.exe	103
PID 2684 wrote to memory of 4044	2684	chrome.exe	112

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3272
- C:\Users\Admin\AppData\Local\Temp\ALE123.exe
  "C:\Users\Admin\AppData\Local\Temp\ALE123.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbc85fc728,0x7ffbc85fc734,0x7ffbc85fc740
    3⤵
    PID:4148
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1792,i,7921936245054476337,6686151012822232405,262144 --field-trial-handle=2072,i,15732505686267153226,5342250322223684704,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2060 /prefetch:2
    3⤵
    PID:1724
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2300,i,6992056868822399302,764880732649477453,524288 --field-trial-handle=2072,i,15732505686267153226,5342250322223684704,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1628 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1912
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2456,i,17336864821869439606,4762482359313963121,524288 --field-trial-handle=2072,i,15732505686267153226,5342250322223684704,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2616 /prefetch:8
    3⤵
    PID:4756
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,10770070925689460982,16182893745890425278,2097152 --field-trial-handle=2072,i,15732505686267153226,5342250322223684704,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3312 /prefetch:1
    3⤵
    PID:5236
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,11851915446817590764,1859565470372202482,2097152 --field-trial-handle=2072,i,15732505686267153226,5342250322223684704,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3332 /prefetch:1
    3⤵
    PID:5668
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4268,i,8541940181026360424,16706675622203472162,2097152 --field-trial-handle=2072,i,15732505686267153226,5342250322223684704,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4100 /prefetch:2
    3⤵
    PID:5828
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4644,i,10129196137872134121,5708185284412798002,2097152 --field-trial-handle=2072,i,15732505686267153226,5342250322223684704,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4656 /prefetch:1
    3⤵
    PID:4408
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,543899244865370379,4939817258204610010,524288 --field-trial-handle=2072,i,15732505686267153226,5342250322223684704,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5392 /prefetch:8
    3⤵
    PID:5512
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5388,i,17905240258933191297,9943841498383370785,524288 --field-trial-handle=2072,i,15732505686267153226,5342250322223684704,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5400 /prefetch:8
    3⤵
    PID:3864
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5632,i,4306397667439511726,10549434919316749476,524288 --field-trial-handle=2072,i,15732505686267153226,5342250322223684704,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5656 /prefetch:8
    3⤵
    PID:860
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5648,i,13973898113101571461,10560556136938311769,524288 --field-trial-handle=2072,i,15732505686267153226,5342250322223684704,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5380 /prefetch:8
    3⤵
    PID:1856
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4624,i,14072134747316437682,11240327174852269949,262144 --field-trial-handle=2072,i,15732505686267153226,5342250322223684704,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5400 /prefetch:8
    3⤵
    PID:4044

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c69035de31d32444ab373aefcc90c7bb22cb839ec23a9d68720de77edfbb6c48
MD5 01352b7c8f3646ead7b75bd4432c5b32
SHA1 99974d18ba1fcac238b5e4cea0346f328b28ef24
SHA512 57742dc7f7801eee7de076c58fedac5dee734519f27d9b24c813b3e336bb76fa1b7f365aab5b8e08a64c66c9d2ba9ccf2a372875dfaa31dc3d419af6c3a7cb7d
TLSH
T1CFE0ABAFC921ECB708FC0B1C50000705E64453473A40848B3A3C881D4F7123B0746C4C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5b818f0de545836e5c4fb62dd6849ab75ac5250a6e74d8301b4ad0e895575fe8
MD5 2399f8bfeb1c389c1147cf34a5ad244c
SHA1 f7079b30e1f8e163994f94160b9dc10a8c898e1f
SHA512 0d3048a6466cdcb4f91bb618999dbded5eb0f271ac98ea55c34c0abf898fb7e3a0dc20af9a404dc99c52ab1341b5f074bf732c50de12d1478cf7c1e155e30db4
TLSH
T186417DF7C3E4897E895156F4EB156F2FCE6A0A18131C3C66C9D4AE1B53E2872D20078E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0156319966ce41b337fc57c0562b89d236f5c617b4c5badbf1a5955e06db2b1f
MD5 a9df1a7ab68a4c227788b6fbe2e7ad87
SHA1 f0c55ff20705d89973e5f412e6521be732f4d630
SHA512 7a15c4c30dcb88a4fb1a59487b0b101dbcc3a3a76ff2117c2bca43cb2ce9178103ed2657bdb14e3fd39a6b0b3d603baee394eb888df93e1fe30cfc72241f8a5c
SSDEEP 192:0rRuBXG/C0v+3ov71hpAPRp2g92Hsb+WNn/c02Oe80OaYP/VyIsnAUgtaJ:0rRuBW/+30BhUXDQwE0COa88
TLSH
T1C942F82EA910797B6CDBD22AFE627753D7F5102531E42E80EAFC896C14D76CC222740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
MD5 97aacfb3977979cfbf9d8a6c4d36d689
SHA1 28c462804fa985bea43aac67e658ae60025ec226
SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
TLSH
T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 8de294260e2168161b36c18b243ccd83bbfa7e1795697c9f3f1d7b1bf891c250
MD5 6f7a2661c2408cb153ab4b1786a7bd25
SHA1 d69c814ccc018a20c1274fcb698ecf8082666a76
SHA512 31b7ba23955455d70c991470a612001ea49b1b20acfc81fe883c478a11e2ce5b587545358b694e5bf98e7c77a06ea85d1e17560c47e9461438032c62f35ba7b3
TLSH
T1D9B0124280025901C44206B41282148871645F20D70E170283F07D66C8391618015091
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe583f56.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe583f56.TMP
Size 96B
SHA256 4c7402f367d8cb9b89ed45feee682003f7e754472a8258808c0aea45901be160
MD5 0db3039d05736c57620374662475bb78
SHA1 e6da8ee78e2ab4753785357b2c87b2865e5a459b
SHA512 b03deb6162952fdf29b4085d89c45d2af769d37c10fed29f487a841e4e975a6ba158aaf0d43cdace563d118fa2b67cf81de2c25fe582814aaece025ce03dcbb3
TLSH
T1E3B002A5C503AE1BC06203F135E5ADEC7270DF25CA13126292F11EE7EC256716B36170
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 dc387b3c5fffedee4cdf20891785023f123abd9220f2f24a9594f0a953e5e89c
MD5 237d9b59a5fe208fc43a6daf262c2fff
SHA1 32f7ba19fcee1b245aea3bf6b4969472fa1cb7a3
SHA512 d0a17722c39dba6726edb843c00d694792ac4939f2d36bef81bd9c7ab19a65c8510cecc5e97eb0e81ab6eb64bba000ad7c8d6ae11cf11c4aa37f1ed77ea5a10b
SSDEEP 3072:KGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:Nm7Rkm1tYpBeh2BAo3
TLSH
T1DAC312275D71A9375D79A74EB08E0B1F1EF14AA6C930DE92C8D85A0437EA7CC0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 1b8ab3ac9a077a7455b74442da109804111e4fbafc396937e578c918991905b5
MD5 32cbc926fbbf9fd839f3bb6c0bc8c4d0
SHA1 e51fc94b86b8be89798c47a74f6f3646862794d9
SHA512 b3d4837c87babd6fb391529869459c4c232770f44a278839c606e35cb52dbdee3c57816f03559943ea746174a51d989ded4b6d104c59bf0cc7523dddc46d23fb
SSDEEP 6144:AAJFcQt732W7tplHc9VTex/u8m7Rkm1tYpBeh2BAoJ:/3z5L89dex/uP9oBGcAoJ
TLSH
T10134127BADA58A771DB49F0D904E2F5E0EF11D9BCDB89AA2C4D47B0026696CC4E49C30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 4cffa24b52718f10f9cdcc3d21435033739aa8bc3dbf406fe1309069bafcfe87
MD5 d72b3fd7ac9a49f3f79f841752d4a512
SHA1 0befcfff8f3ae62b9fdd8d7ba389cdf9d111b11e
SHA512 3958769d2f663d13a25270c16f81f972ac4fa86f173389072a5a7855736dd2ab0a02c86e0937dcb37b847ea7926302ca8922a73eb70ad6a54ebeb159e6ffb216
SSDEEP 6144:iJFcQt732W7tplHc9VTex/u8m7Rkm1tYpBeh2BAoJ:i3z5L89dex/uP9oBGcAoJ
TLSH
T1A234127BEEB58A771DB49B09604F1F5E0FF10C9AC9B89BE2C4E0B70416696CC4A49D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 c64ad70066c9e6b0203bbbf0d2a8d48e707e4fab850a806257b32cdd54f3eefe
MD5 a7d3e5a31f1ed90bdc852112f1c93c5b
SHA1 cda3bc649366402845179e216d747865b4d97331
SHA512 c65d4b3a32b06647ee775b063a9f7098c54c51037c52fe4849b0c5434157ee10b5228dd4a44339fb6a538969b069125df53fd6de83f7d4f4488827bd4941e9bf
SSDEEP 6144:PJFcQt732W7tplHc9VTex/u8m7Rkm1tYpBeh2BAoJ:P3z5L89dex/uP9oBGcAoJ
TLSH
T11634127BEEB58A771DB49B09604F1F5E0FF10C9AC9B89BE2C4E0B70416696CC4A49D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6080-43-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/6080-334-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/6080-91-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/6080-85-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/6080-0-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/6080-84-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/6080-335-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/6080-412-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/6080-37-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/6080-5-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/6080-338-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/6080-333-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/6080-2-0x0000000000400000-0x00000000004BC000-memory.dmp

Download