asyncrat | hxxp://195[.]177[.]94[.]227/myfiles/coinbase[.]exe

Analysis

max time kernel
191s
max time network
195s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
27/02/2025, 03:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://195.177.94.227/myfiles/coinbase.exe

Score

10^/10

asyncrat default defense_evasion discovery execution rat

Malware Config

Extracted

Family

asyncrat

Version

Esco Private rat

Botnet

Default

196.251.88.53:4449

Mutex

voodynqjploelta

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/1772-373-0x0000000002890000-0x00000000028A8000-memory.dmp	family_asyncrat

Downloads MZ/PE file 1 IoCs

flow	pid	Process
2	1688	chrome.exe

Executes dropped EXE 4 IoCs

pid	Process
4572	coinbase.exe
1376	coinbase.tmp
1792	coinbase.exe
2452	coinbase.tmp

Loads dropped DLL 7 IoCs

pid	Process
1376	coinbase.tmp
1376	coinbase.tmp
2452	coinbase.tmp
2452	coinbase.tmp
1772	regsvr32.exe
748	regsvr32.exe
4320	regsvr32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to execute payload.

execution

PowerShell

T1059.001

pid	Process
1184	powershell.exe
4656	powershell.exe
4720	powershell.exe
4840	powershell.exe
228	PowerShell.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\coinbase.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	coinbase.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PowerShell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	coinbase.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	coinbase.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	coinbase.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133850993089007605"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298619118-249045975-4264763259-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\coinbase.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2656	chrome.exe
2656	chrome.exe
2452	coinbase.tmp
2452	coinbase.tmp
1772	regsvr32.exe
1772	regsvr32.exe
4720	powershell.exe
4720	powershell.exe
228	PowerShell.exe
228	PowerShell.exe
228	PowerShell.exe
1772	regsvr32.exe
1772	regsvr32.exe
4840	powershell.exe
4840	powershell.exe
4840	powershell.exe
1772	regsvr32.exe
1772	regsvr32.exe
1772	regsvr32.exe
1772	regsvr32.exe
748	regsvr32.exe
748	regsvr32.exe
1184	powershell.exe
1184	powershell.exe
1184	powershell.exe
748	regsvr32.exe
748	regsvr32.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1548	chrome.exe
1772	regsvr32.exe
1772	regsvr32.exe
1772	regsvr32.exe
1772	regsvr32.exe
1772	regsvr32.exe
1772	regsvr32.exe
1772	regsvr32.exe
1772	regsvr32.exe
1772	regsvr32.exe
1772	regsvr32.exe
1772	regsvr32.exe
1772	regsvr32.exe
1772	regsvr32.exe
1772	regsvr32.exe
1772	regsvr32.exe
1772	regsvr32.exe
1772	regsvr32.exe
1772	regsvr32.exe
1772	regsvr32.exe
1772	regsvr32.exe
1772	regsvr32.exe
1772	regsvr32.exe
1772	regsvr32.exe
1772	regsvr32.exe
1772	regsvr32.exe
1772	regsvr32.exe
1772	regsvr32.exe
1772	regsvr32.exe
1772	regsvr32.exe
1772	regsvr32.exe
1772	regsvr32.exe
1772	regsvr32.exe
1772	regsvr32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2656	chrome.exe
Token: SeCreatePagefilePrivilege	2656	chrome.exe
Token: SeShutdownPrivilege	2656	chrome.exe
Token: SeCreatePagefilePrivilege	2656	chrome.exe
Token: SeShutdownPrivilege	2656	chrome.exe
Token: SeCreatePagefilePrivilege	2656	chrome.exe
Token: SeShutdownPrivilege	2656	chrome.exe
Token: SeCreatePagefilePrivilege	2656	chrome.exe
Token: SeShutdownPrivilege	2656	chrome.exe
Token: SeCreatePagefilePrivilege	2656	chrome.exe
Token: SeShutdownPrivilege	2656	chrome.exe
Token: SeCreatePagefilePrivilege	2656	chrome.exe
Token: SeShutdownPrivilege	2656	chrome.exe
Token: SeCreatePagefilePrivilege	2656	chrome.exe
Token: SeShutdownPrivilege	2656	chrome.exe
Token: SeCreatePagefilePrivilege	2656	chrome.exe
Token: SeShutdownPrivilege	2656	chrome.exe
Token: SeCreatePagefilePrivilege	2656	chrome.exe
Token: SeShutdownPrivilege	2656	chrome.exe
Token: SeCreatePagefilePrivilege	2656	chrome.exe
Token: SeShutdownPrivilege	2656	chrome.exe
Token: SeCreatePagefilePrivilege	2656	chrome.exe
Token: SeShutdownPrivilege	2656	chrome.exe
Token: SeCreatePagefilePrivilege	2656	chrome.exe
Token: SeShutdownPrivilege	2656	chrome.exe
Token: SeCreatePagefilePrivilege	2656	chrome.exe
Token: SeShutdownPrivilege	2656	chrome.exe
Token: SeCreatePagefilePrivilege	2656	chrome.exe
Token: SeShutdownPrivilege	2656	chrome.exe
Token: SeCreatePagefilePrivilege	2656	chrome.exe
Token: SeShutdownPrivilege	2656	chrome.exe
Token: SeCreatePagefilePrivilege	2656	chrome.exe
Token: SeShutdownPrivilege	2656	chrome.exe
Token: SeCreatePagefilePrivilege	2656	chrome.exe
Token: SeShutdownPrivilege	2656	chrome.exe
Token: SeCreatePagefilePrivilege	2656	chrome.exe
Token: SeShutdownPrivilege	2656	chrome.exe
Token: SeCreatePagefilePrivilege	2656	chrome.exe
Token: SeShutdownPrivilege	2656	chrome.exe
Token: SeCreatePagefilePrivilege	2656	chrome.exe
Token: SeShutdownPrivilege	2656	chrome.exe
Token: SeCreatePagefilePrivilege	2656	chrome.exe
Token: SeShutdownPrivilege	2656	chrome.exe
Token: SeCreatePagefilePrivilege	2656	chrome.exe
Token: SeShutdownPrivilege	2656	chrome.exe
Token: SeCreatePagefilePrivilege	2656	chrome.exe
Token: SeShutdownPrivilege	2656	chrome.exe
Token: SeCreatePagefilePrivilege	2656	chrome.exe
Token: SeShutdownPrivilege	2656	chrome.exe
Token: SeCreatePagefilePrivilege	2656	chrome.exe
Token: SeShutdownPrivilege	2656	chrome.exe
Token: SeCreatePagefilePrivilege	2656	chrome.exe
Token: SeShutdownPrivilege	2656	chrome.exe
Token: SeCreatePagefilePrivilege	2656	chrome.exe
Token: SeShutdownPrivilege	2656	chrome.exe
Token: SeCreatePagefilePrivilege	2656	chrome.exe
Token: SeShutdownPrivilege	2656	chrome.exe
Token: SeCreatePagefilePrivilege	2656	chrome.exe
Token: SeShutdownPrivilege	2656	chrome.exe
Token: SeCreatePagefilePrivilege	2656	chrome.exe
Token: SeShutdownPrivilege	2656	chrome.exe
Token: SeCreatePagefilePrivilege	2656	chrome.exe
Token: SeShutdownPrivilege	2656	chrome.exe
Token: SeCreatePagefilePrivilege	2656	chrome.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2452	coinbase.tmp
2656	chrome.exe
2656	chrome.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe
2656	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1772	regsvr32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2836	2656	chrome.exe	80
PID 2656 wrote to memory of 2836	2656	chrome.exe	80
PID 2656 wrote to memory of 1320	2656	chrome.exe	82
PID 2656 wrote to memory of 1320	2656	chrome.exe	82
PID 2656 wrote to memory of 1320	2656	chrome.exe	82
PID 2656 wrote to memory of 1320	2656	chrome.exe	82
PID 2656 wrote to memory of 1320	2656	chrome.exe	82
PID 2656 wrote to memory of 1320	2656	chrome.exe	82
PID 2656 wrote to memory of 1320	2656	chrome.exe	82
PID 2656 wrote to memory of 1320	2656	chrome.exe	82
PID 2656 wrote to memory of 1320	2656	chrome.exe	82
PID 2656 wrote to memory of 1320	2656	chrome.exe	82
PID 2656 wrote to memory of 1320	2656	chrome.exe	82
PID 2656 wrote to memory of 1320	2656	chrome.exe	82
PID 2656 wrote to memory of 1320	2656	chrome.exe	82
PID 2656 wrote to memory of 1320	2656	chrome.exe	82
PID 2656 wrote to memory of 1320	2656	chrome.exe	82
PID 2656 wrote to memory of 1320	2656	chrome.exe	82
PID 2656 wrote to memory of 1320	2656	chrome.exe	82
PID 2656 wrote to memory of 1320	2656	chrome.exe	82
PID 2656 wrote to memory of 1320	2656	chrome.exe	82
PID 2656 wrote to memory of 1320	2656	chrome.exe	82
PID 2656 wrote to memory of 1320	2656	chrome.exe	82
PID 2656 wrote to memory of 1320	2656	chrome.exe	82
PID 2656 wrote to memory of 1320	2656	chrome.exe	82
PID 2656 wrote to memory of 1320	2656	chrome.exe	82
PID 2656 wrote to memory of 1320	2656	chrome.exe	82
PID 2656 wrote to memory of 1320	2656	chrome.exe	82
PID 2656 wrote to memory of 1320	2656	chrome.exe	82
PID 2656 wrote to memory of 1320	2656	chrome.exe	82
PID 2656 wrote to memory of 1320	2656	chrome.exe	82
PID 2656 wrote to memory of 1320	2656	chrome.exe	82
PID 2656 wrote to memory of 1688	2656	chrome.exe	83
PID 2656 wrote to memory of 1688	2656	chrome.exe	83
PID 2656 wrote to memory of 4784	2656	chrome.exe	84
PID 2656 wrote to memory of 4784	2656	chrome.exe	84
PID 2656 wrote to memory of 4784	2656	chrome.exe	84
PID 2656 wrote to memory of 4784	2656	chrome.exe	84
PID 2656 wrote to memory of 4784	2656	chrome.exe	84
PID 2656 wrote to memory of 4784	2656	chrome.exe	84
PID 2656 wrote to memory of 4784	2656	chrome.exe	84
PID 2656 wrote to memory of 4784	2656	chrome.exe	84
PID 2656 wrote to memory of 4784	2656	chrome.exe	84
PID 2656 wrote to memory of 4784	2656	chrome.exe	84
PID 2656 wrote to memory of 4784	2656	chrome.exe	84
PID 2656 wrote to memory of 4784	2656	chrome.exe	84
PID 2656 wrote to memory of 4784	2656	chrome.exe	84
PID 2656 wrote to memory of 4784	2656	chrome.exe	84
PID 2656 wrote to memory of 4784	2656	chrome.exe	84
PID 2656 wrote to memory of 4784	2656	chrome.exe	84
PID 2656 wrote to memory of 4784	2656	chrome.exe	84
PID 2656 wrote to memory of 4784	2656	chrome.exe	84
PID 2656 wrote to memory of 4784	2656	chrome.exe	84
PID 2656 wrote to memory of 4784	2656	chrome.exe	84
PID 2656 wrote to memory of 4784	2656	chrome.exe	84
PID 2656 wrote to memory of 4784	2656	chrome.exe	84
PID 2656 wrote to memory of 4784	2656	chrome.exe	84
PID 2656 wrote to memory of 4784	2656	chrome.exe	84
PID 2656 wrote to memory of 4784	2656	chrome.exe	84
PID 2656 wrote to memory of 4784	2656	chrome.exe	84
PID 2656 wrote to memory of 4784	2656	chrome.exe	84
PID 2656 wrote to memory of 4784	2656	chrome.exe	84
PID 2656 wrote to memory of 4784	2656	chrome.exe	84
PID 2656 wrote to memory of 4784	2656	chrome.exe	84

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://195.177.94.227/myfiles/coinbase.exe
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ff9e099cc40,0x7ff9e099cc4c,0x7ff9e099cc58
  2⤵
  PID:2836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1908,i,9553012071220991947,18254400936432225545,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:1320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1800,i,9553012071220991947,18254400936432225545,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1944 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2112,i,9553012071220991947,18254400936432225545,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2084 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2976,i,9553012071220991947,18254400936432225545,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3064 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2980,i,9553012071220991947,18254400936432225545,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4808,i,9553012071220991947,18254400936432225545,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4828 /prefetch:8
  2⤵
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4844,i,9553012071220991947,18254400936432225545,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5176,i,9553012071220991947,18254400936432225545,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4056,i,9553012071220991947,18254400936432225545,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:1444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5012,i,9553012071220991947,18254400936432225545,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4896,i,9553012071220991947,18254400936432225545,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5536,i,9553012071220991947,18254400936432225545,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:1012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5520,i,9553012071220991947,18254400936432225545,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5412,i,9553012071220991947,18254400936432225545,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1040,i,9553012071220991947,18254400936432225545,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5400,i,9553012071220991947,18254400936432225545,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4180,i,9553012071220991947,18254400936432225545,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4248 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1548

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2384

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4820

C:\Users\Admin\Downloads\coinbase.exe
"C:\Users\Admin\Downloads\coinbase.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4572
- C:\Users\Admin\AppData\Local\Temp\is-RI2VB.tmp\coinbase.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-RI2VB.tmp\coinbase.tmp" /SL5="$70068,721126,73216,C:\Users\Admin\Downloads\coinbase.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1376
- - C:\Users\Admin\Downloads\coinbase.exe
    "C:\Users\Admin\Downloads\coinbase.exe" /VERYSILENT
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1792
  - - C:\Users\Admin\AppData\Local\Temp\is-3I9I0.tmp\coinbase.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-3I9I0.tmp\coinbase.tmp" /SL5="$80044,721126,73216,C:\Users\Admin\Downloads\coinbase.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      PID:2452
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        "regsvr32.exe" /s /i:INSTALL "C:\Users\Admin\AppData\Roaming\\netapi32_2.ocx"
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1772
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:INSTALL C:\Users\Admin\AppData\Roaming\netapi32_2.ocx' }) { exit 0 } else { exit 1 }"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4720
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell.exe
        
        "PowerShell.exe" -NoProfile -NonInteractive -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:228
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:INSTALL C:\Users\Admin\AppData\Roaming\netapi32_2.ocx' }) { exit 0 } else { exit 1 }"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4840

C:\Windows\system32\regsvr32.EXE
C:\Windows\system32\regsvr32.EXE /s /i:INSTALL C:\Users\Admin\AppData\Roaming\netapi32_2.ocx
1⤵
PID:4372
- C:\Windows\SysWOW64\regsvr32.exe
  /s /i:INSTALL C:\Users\Admin\AppData\Roaming\netapi32_2.ocx
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:748
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:INSTALL C:\Users\Admin\AppData\Roaming\netapi32_2.ocx' }) { exit 0 } else { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1184

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:5116

C:\Windows\system32\regsvr32.EXE
C:\Windows\system32\regsvr32.EXE /s /i:INSTALL C:\Users\Admin\AppData\Roaming\netapi32_2.ocx
1⤵
PID:1568
- C:\Windows\SysWOW64\regsvr32.exe
  /s /i:INSTALL C:\Users\Admin\AppData\Roaming\netapi32_2.ocx
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4320
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:INSTALL C:\Users\Admin\AppData\Roaming\netapi32_2.ocx' }) { exit 0 } else { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    PID:4656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
b5ad5caaaee00cb8cf445427975ae66c

SHA1
dcde6527290a326e048f9c3a85280d3fa71e1e22

SHA256
b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

SHA512
92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
1008B

MD5
d222b77a61527f2c177b0869e7babc24

SHA1
3f23acb984307a4aeba41ebbb70439c97ad1f268

SHA256
80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

SHA512
d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
69f385bc2cbec81143117b4a6b247582

SHA1
41e5f0dd9986030d74ec9f65e6553df946862997

SHA256
4744a26ad17e7ff7470d73bc746bc7e16bc66300d727b0a8d565f0912e55a91b

SHA512
728fdcc78b0095816e4c0078804e6c3c3e0af10d96be7a46d1988f8bab68996b4867275389a1b835b353480ca4aa80f9cae8acc358e0d0e7c3314eab529237ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013

Filesize
214KB

MD5
d20fef07db1e8a9290802e00d1d65064

SHA1
71befda9256ed5b8cd8889f0eeab41c50d66e64e

SHA256
f9cb4624d03224bfce50c4c0e484418acd462c249f38b4684e72b27a1f30144d

SHA512
ad5b2c8df60027c6dd5104bb8c2357b04eb24d69245c607ff99a6f2a887f929428252ad793d9aaa8c903c7b1e1bf9653cd35f79747d5281e7e3d2c21fa828537

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
fa48eb9f37724874d0ac8e1f7b00ef33

SHA1
1fc2fe16e05ba0fab6a2ad8505ac9b51784fecda

SHA256
e5a167c5ceacf3f85e28429c8df4162f7a59a95161e93c4db5acda9ea7849296

SHA512
6147572a3b42ad95a70186b22cdb5999fef882c6f928e453bfe29257aa213ad61b990c73199fa4fc67d31c4dd3f2008c23bcc072958e8f7da252ce6dde25f9d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
59407153ffea81f0ff48dc0f99090c5c

SHA1
658c053284dd995b93a22aa13ce339db6dd2feb6

SHA256
3796940cd15180acc3bc73daa61b968c2662b93fb24fbe7075cb24c66844e513

SHA512
24739a26a89a71387f906a01815a07b0d90535d194e9f8c4a9b63f34c0c228c8135d4e8b5fc901fba9fa251b12fe22454f6ac027cce5b64b646c9ec46f3abcc2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
858B

MD5
cf66589313a27c5116521aaf0c67b806

SHA1
a0b62ba89401e73a007a2c2e6dfe0ca1d1531ca7

SHA256
8db45811b173689fe17b4ef7818934e2ba85cc1fa73c88a4be234ab87cc49d85

SHA512
e0f3779af31d15ad6fe8645cc5b8e48d8c8fe9feb6b5f1b5a4419892601bfe144684c4a98393ee0eba1aa8ed0145c1759d5851b512d3570d972365ac8b69a54f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
1b675591ed1dc265d2278bb3584b3d4c

SHA1
5866d399a91e2007ef9e64bda502ffbf75954ef7

SHA256
91c4be5d64bdaf4e25b3690f2e1a61a41903afbdd57e83515c9730906246338d

SHA512
dd6dbbaf6ee5e72925a9ac23e1e9c18049092842f1552f30e6b81101dde50049ab245a868997e0ddb372a55d2277753e5535817fa938a15c8ba978ac156d3f84

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
30c014e3e8e3c7f8f0ad683c89f4b88a

SHA1
0beedd72fec40c975874367c7e3728c58bdcd62a

SHA256
4984183b28c391654c8027adc89b2e05946f8b74c00d42afd73dac6757e9018b

SHA512
d607c46f4121a25b0245814183407d8c432e2f20d72e01c589ae4d5e1c9882e606fbc795c08b68586cbe5fd2aa1ba4e2018b4a82dbd8bae97f07f5bb99d734a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
dd458e7c253b84ad79367b426fa149a3

SHA1
7f3ff7997efd14995247cbee0d401179a2373362

SHA256
d8aa95a92128dfb010bf582db3ad25881161ccd64a723ec35868a35f1f34b7b1

SHA512
5836ddc764a0f00992b23754897cccc2f74569a897cc3044420b5d56220abcbf7fc2130d9b53f7273b66bc09fedd02684610ef92c687525d35d0ebd49a2c4990

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
98e19ec52f6a7b8967dde6601e5b7239

SHA1
03b39f148ddc14fad41f68d2d4f0f2ee405197a0

SHA256
1ea097e51f2bba6d0bf92cb842dd35c20461561baf176b028f6a0bd3902eda43

SHA512
b7000f6ae923b4e1b14e59dd7715baeb4902ab8c7ba7780f82787fa4cd9c94df686905bf160d7de283e377ad487a4e6ff61ad3c041d803cc66da7200490ca6bc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b2060527afc94feca69f95f235707a6c

SHA1
4884ea430c12cf3dd75af7cdbd433ecf00d607b1

SHA256
6e4815e0785b557ef7e6e7cf4307d68499e0e2bc41275eec1cfcf253d0c62cd1

SHA512
2ab2cff2617e4abb8745b259a2650d71613195f194406abc8f73270c8c3bd9fbaeb411154d22cfe7118a0323974727475c541068c01540930c5de6b067ebe91b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b1cff5c3356b8c358eb89f41041841af

SHA1
20eb3f361dd2ab1c2d34db06306d8da5a5c3ac4c

SHA256
1d2ff3c5c5e698009ff4cdf3414dd87a08e2eb3538a0b6ad3f6a0f113e3959ad

SHA512
28fc35bad47d0ef1a8a3a2d7bba0f55d40901556aa0a1b423cf94265514645fe7f426c4b8e3e104a569d0cfe6afc201b579bf88a7b098d32befb9d1a6ea96036

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
3c8a02affb72a530fe0a20aea6232f47

SHA1
f49a4748d13781a88e908f48d987e84e3b15a3c9

SHA256
4746ff7010b57c633add31f6d0a0e43dc1eecfcd501518a44cd98ff72dee8556

SHA512
5743c479bbe3db96f01d9e882c5e0bb4fe9452014b4b012837e1e7184eb7141e6d06452e71a4cf2e4e2d65cbffb003a8cc198ace718bce94fc9d517f0de70dcb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
d4c6060b07249eb2936be54dddb235b9

SHA1
6786c989ccbc1497d04e907f096632ba676b6bb1

SHA256
a5c725a381d5437479fd803dcb554c41b109aefee8e4316a9b93ba0d7d2cc6de

SHA512
91ca2769b8254070d759266e6959f89801b4f1370ef592e8771a1117713875a5684d969a75f5263f66a64d26b7c077946cea6330f4361a9e6dd7626d94ab7cbd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
03bd73019645deb6bb36c15f9bf1e257

SHA1
9944d1aafeae47071217cc8778b8dccb243998f3

SHA256
704fdb0fc0c98e1e5cfeb59a40ea186f4c56903ed094ce224d6ada860ab2e8ee

SHA512
2abc1090a071dc86686a48c9d6eb77f8d30523fd02bba5933f2dac6178c2c30d2d6c83ede09bc33de16337ca7b00410d58d8d8dfe781be29a86670adbaa84af5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
ec4c441718ffa635a68cb29f0fdb8a19

SHA1
f507ef5fb0efaa76e04bdb172b18116406323f08

SHA256
9c4cbb1d6877b5980f3cd9936c81436ad276931126dccc296d4c15beba7cdfd0

SHA512
54b3f4c3ea9ff8ae488a71df24edf3854efc2349fe400cc446e79fe97e0b3ce2abf50fc5f6ce86725b8846c0ee043a8d3eb9e847a03d6f1302f4a1ba627ce75d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
1b5bce1729c7999c041a9bf795a2b7d8

SHA1
aecbc463041d07d26b57db4adefea0a2f4649e65

SHA256
b1d4cd4378bf7a4e9df439e81338c18d56b5067b751e7cb0bb6bbb8851400f8c

SHA512
09e573f51a634f4c856d741c8cf923516338d13da17ed97065e2ebb5858ba18d8da029e544fa6dc88f5c8de1f6f7b8f2b673fa38f160ec92bc521f3465229932

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
46fc0e18b901acc4c97d1b3bfc641e8a

SHA1
f872b1e1394aa6a32d8b9c6a5e22bc1246d5a019

SHA256
395d4ac847e553eb2eeb887390f6bf2e4f1ea53ef0737dbd4aafaee85fcfe7b2

SHA512
10f8d5f51ebfdddb311124cd5a789617e694a92903c0e49dbc728f36d050464bede34a80de5105a1499aebda72b2b80c87def4443006893704ccfab0c54f7dd5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
10356ccbe1a921d7827dba0ae5a2b506

SHA1
94affcfb37106e7dffbcf1fd95d72fa7857737bc

SHA256
1408146498075dd260abd86913a0acfae8af76e90f258a15bea6860caadd7fda

SHA512
6b12516da43c558e8597933aedcd1b42912df06784504624dcb739b2015d179ec97b1e6c190d6b9c94c070383031fa764284f5cce6996b677dbf43f1c20e76c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
6bac4f06eed08f83af4f4ea51bcc6bd4

SHA1
9543ecf136c55b4d96056000cd0de3903ccd39a5

SHA256
9db710caceadf132704850bdbcc6bd3072bc14e6165d6db5c8a943645c37b1a7

SHA512
24391bdfe9a79e1a7c659e689e5bf886aab50225826989e6ea01a03e030781699ee1074484dc38ca34a58830aac7294310237c6b6e95ee5c6f5f6a1ed6a7b7c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
123KB

MD5
cd434de4e837424b854ba529770a3f4d

SHA1
77ac3ccb1748749ebfd64fa693f4771240703f63

SHA256
e6ddef278da49f4bc899528826a95bd1b16c03b3a2c59d28cb80612498c90d45

SHA512
467ef11c4b6f441f80b9806f84c648ba1a93342e99095a7898c4ea88792c1db15a3d4b58e054d18ccc7e72fabb86512531a1b51be1051d06d99771a0b98b9110

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
123KB

MD5
539390d7b9977f49f2523b4ab61a9758

SHA1
6eae4a7f9c4dfb8b710109c7377487ebf2308d81

SHA256
f423a31798f42964afe772325b10a94ea7087a7fcc7ec30068370dabbf9d3cd9

SHA512
3e388c39c8864667313e9ccf2f32f2023d72d8047200b1a469b7db8d30bc9cb7f4e2b88fcd8e464938a93526679a644019d1d721b7e9af017090849c73bbb876

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
123KB

MD5
911b2e50558311fe119390c47f2069db

SHA1
afe110557a98aa7dca7dd0d074d9e13cec01721d

SHA256
40884db8e61a8fd7e216d015aa4680ee071b2d6b36cf43048827054b8d36d8ab

SHA512
a1e607989eb6eaf93e4a11e43c4b3e5452c5af194f34e9261f0ce01a86041d5e95aef2a91b469195940061f8193560b34499bb63f6b87b042a87c845b17572a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PowerShell.exe.log

Filesize
2KB

MD5
5dc9a9599fb11ee70f9164d8fea15abf

SHA1
85faf41a206f3fa8b469609333558cf817df2cda

SHA256
3f033142ed64a5d1e1e19d11a710e22a32827e98922769497ed6bd6e452e44de

SHA512
499407006c53a5f8e5b2b00dab734613762e66a9080504ab50d21e4c8a32b75d7308ccaa0cecfbeb7058044448a40912715da1f02ec72994596d567b515dcfca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
20KB

MD5
7faad9758cde54cf2b61670e311a49d6

SHA1
4cef4827e6d4dc20805556eb77082329a292f928

SHA256
e2dbcd837969545c98f43635e0af25bf18a90665aef07112289e8d59ded2cede

SHA512
626a210af9820823f358f5e3480a8dd204e9af975ebe3266aa7fba4abcfd0350b34936a5964222ee4087cdd416dbabc4c002d8335a064e64c12027e950a41c4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
21KB

MD5
56ed7131975888b5b7593981065f8795

SHA1
465ac58c63581171a45718b725efa2d887d66257

SHA256
ebc6510ea58a757be8afa1c79bddc1be55ede72f4f18433186dbc707337de09f

SHA512
4134ef741faa40b4f5c05e80d5f078aeb0911bc21128fbc78a882f7c7ed46da20c626503ea57e40bf8d73a54a2279f003330556b26be44ebdd3204b0e982db4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
20KB

MD5
cb7f4ff8e97031b6036af126e4340aaa

SHA1
79727e79beddd5696d71cda2e27c7ab4aea94694

SHA256
a2311420da90360643ad8cd332027f2fade383b5b37f45de4431ad112de74dad

SHA512
5bd1a2737eee8be6a4307279affe79da2f2128c3a44a957f019d7c5c13f18e15e5ab5b835e651e4e8b42a34abe93d0de53c8b3e99c5f873ef7d05854ce602c9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
20KB

MD5
abd5248d85d2f9d99cb7dc4793566d29

SHA1
ba31f10dd257cee172bcdc2c75177887c758cb8c

SHA256
889150ed6d37beb9c3192fe39a1c63dd2c11e3d6fb1c07e9955613ad0312d408

SHA512
d315748fe1befa25c7ddb57908a0fa3e895f0598a45f24bc3601e841a55665b4d50d9a680544fde6c741b58fe0f1f8e3fec25c575879411c8997abd5899abdd7

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\668de784-bfd1-4b71-a041-00a69757588f.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yv4owwzz.kx3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-7D3AB.tmp\_isetup\_isdecmp.dll

Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-I0TTK.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RI2VB.tmp\coinbase.tmp

Filesize
711KB

MD5
9917f679a0135245a5cc6b1aadcb3a6c

SHA1
7aab67a56fd3e10fd070e29d2998af2162c0a204

SHA256
a0090b3a687e7d0a6d6b6918bcbb798ebecb184cba8d3eb5fe4345ec9aba9243

SHA512
87194d9f3c97b48a297faef76e3a308de6b454d10a5b50adeb22336982ca5bd5ba3a1cacb39cfbaf78a3befbc37967eb89a7c84cfdd53054204647dffd5b35cd

Download Submit
C:\Users\Admin\AppData\Roaming\netapi32_2.ocx

Filesize
1.4MB

MD5
c87013ae4715ff280d9f8d2fe749cdba

SHA1
5e7e78ca3d2f799cb9befb0a2f13a1d5636a04af

SHA256
fef9803aa84de828968ffcaebab6050c109147d96420a753b9a6b5d1968ed4bf

SHA512
af9292f763dcd829d3d3d5aa1cd38bae54c2ceb92572f231ede1793e303173f3ba7eef17fe167a0fdc7dd25a9869bd18da4d9e3cb5c75573f1edb6ff1f2e5aaf

Download Submit
C:\Users\Admin\Downloads\coinbase.exe

Filesize
949KB

MD5
5f41899fe8f7801b20885898e0f4c05a

SHA1
b696ed30844f88392897eb9c0d47cfabcf9ad5f3

SHA256
62f7943a38968bc1d92d0ea08c185bf01b6a8daf5812bb30e25899b9ada0daed

SHA512
c9490f3359df8be70a21e88cc940c3486391fbc089cb026d5570cc235133f63dd6e8dfc6cce8db9dd11cb64d2a5be6d0329abb15713f5bfb37d9c362f9e3220a

Download Submit
C:\Users\Admin\Downloads\coinbase.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/228-182-0x00000000741D0000-0x000000007421C000-memory.dmp

Filesize
304KB

Download
memory/748-448-0x0000000074D30000-0x0000000074EA7000-memory.dmp

Filesize
1.5MB

Download
memory/1184-445-0x0000000007840000-0x00000000078E4000-memory.dmp

Filesize
656KB

Download
memory/1184-431-0x0000000006090000-0x00000000063E7000-memory.dmp

Filesize
3.3MB

Download
memory/1184-446-0x0000000007B90000-0x0000000007BA1000-memory.dmp

Filesize
68KB

Download
memory/1184-436-0x000000006FBA0000-0x000000006FBEC000-memory.dmp

Filesize
304KB

Download
memory/1184-435-0x0000000006650000-0x000000000669C000-memory.dmp

Filesize
304KB

Download
memory/1376-87-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/1376-108-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/1772-377-0x0000000004EF0000-0x0000000004EFA000-memory.dmp

Filesize
40KB

Download
memory/1772-374-0x0000000005210000-0x00000000057B6000-memory.dmp

Filesize
5.6MB

Download
memory/1772-376-0x0000000004F60000-0x0000000004FF2000-memory.dmp

Filesize
584KB

Download
memory/1772-373-0x0000000002890000-0x00000000028A8000-memory.dmp

Filesize
96KB

Download
memory/1772-378-0x0000000074D30000-0x0000000074EA7000-memory.dmp

Filesize
1.5MB

Download
memory/1772-229-0x0000000074D30000-0x0000000074EA7000-memory.dmp

Filesize
1.5MB

Download
memory/1772-390-0x0000000005BF0000-0x0000000005C8C000-memory.dmp

Filesize
624KB

Download
memory/1772-392-0x0000000074D30000-0x0000000074EA7000-memory.dmp

Filesize
1.5MB

Download
memory/1792-136-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1792-105-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2452-133-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/4320-538-0x0000000074D30000-0x0000000074EA7000-memory.dmp

Filesize
1.5MB

Download
memory/4572-80-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4572-82-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/4572-112-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4656-528-0x000000006FBA0000-0x000000006FBEC000-memory.dmp

Filesize
304KB

Download
memory/4720-150-0x0000000005880000-0x0000000005BD7000-memory.dmp

Filesize
3.3MB

Download
memory/4720-163-0x00000000062D0000-0x00000000062EE000-memory.dmp

Filesize
120KB

Download
memory/4720-139-0x0000000004E60000-0x0000000004E82000-memory.dmp

Filesize
136KB

Download
memory/4720-165-0x0000000007670000-0x0000000007CEA000-memory.dmp

Filesize
6.5MB

Download
memory/4720-166-0x0000000007030000-0x000000000704A000-memory.dmp

Filesize
104KB

Download
memory/4720-141-0x0000000005810000-0x0000000005876000-memory.dmp

Filesize
408KB

Download
memory/4720-138-0x0000000005090000-0x00000000056BA000-memory.dmp

Filesize
6.2MB

Download
memory/4720-164-0x0000000006EF0000-0x0000000006F94000-memory.dmp

Filesize
656KB

Download
memory/4720-151-0x0000000005D00000-0x0000000005D1E000-memory.dmp

Filesize
120KB

Download
memory/4720-140-0x0000000005730000-0x0000000005796000-memory.dmp

Filesize
408KB

Download
memory/4720-167-0x00000000070A0000-0x00000000070AA000-memory.dmp

Filesize
40KB

Download
memory/4720-168-0x00000000072D0000-0x0000000007366000-memory.dmp

Filesize
600KB

Download
memory/4720-154-0x00000000741D0000-0x000000007421C000-memory.dmp

Filesize
304KB

Download
memory/4720-153-0x0000000006EA0000-0x0000000006ED4000-memory.dmp

Filesize
208KB

Download
memory/4720-137-0x0000000002820000-0x0000000002856000-memory.dmp

Filesize
216KB

Download
memory/4720-152-0x0000000005D20000-0x0000000005D6C000-memory.dmp

Filesize
304KB

Download
memory/4720-169-0x0000000007240000-0x0000000007251000-memory.dmp

Filesize
68KB

Download
memory/4840-206-0x00000000741D0000-0x000000007421C000-memory.dmp

Filesize
304KB

Download