Analysis
-
max time kernel
228s -
max time network
235s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
21-07-2024 18:37
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://drive.google.com/drive/folders/12zRLOVDctyaPkeo_t3QZbDJ7oiL_8xRD
Resource
win10v2004-20240704-en
General
-
Target
https://drive.google.com/drive/folders/12zRLOVDctyaPkeo_t3QZbDJ7oiL_8xRD
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 11 drive.google.com 12 drive.google.com 8 drive.google.com -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133660606730070409" chrome.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 440 chrome.exe 440 chrome.exe 784 chrome.exe 784 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 440 chrome.exe Token: SeCreatePagefilePrivilege 440 chrome.exe Token: SeShutdownPrivilege 440 chrome.exe Token: SeCreatePagefilePrivilege 440 chrome.exe Token: SeShutdownPrivilege 440 chrome.exe Token: SeCreatePagefilePrivilege 440 chrome.exe Token: SeShutdownPrivilege 440 chrome.exe Token: SeCreatePagefilePrivilege 440 chrome.exe Token: SeShutdownPrivilege 440 chrome.exe Token: SeCreatePagefilePrivilege 440 chrome.exe Token: SeShutdownPrivilege 440 chrome.exe Token: SeCreatePagefilePrivilege 440 chrome.exe Token: SeShutdownPrivilege 440 chrome.exe Token: SeCreatePagefilePrivilege 440 chrome.exe Token: SeShutdownPrivilege 440 chrome.exe Token: SeCreatePagefilePrivilege 440 chrome.exe Token: SeShutdownPrivilege 440 chrome.exe Token: SeCreatePagefilePrivilege 440 chrome.exe Token: SeShutdownPrivilege 440 chrome.exe Token: SeCreatePagefilePrivilege 440 chrome.exe Token: SeShutdownPrivilege 440 chrome.exe Token: SeCreatePagefilePrivilege 440 chrome.exe Token: SeShutdownPrivilege 440 chrome.exe Token: SeCreatePagefilePrivilege 440 chrome.exe Token: SeShutdownPrivilege 440 chrome.exe Token: SeCreatePagefilePrivilege 440 chrome.exe Token: SeShutdownPrivilege 440 chrome.exe Token: SeCreatePagefilePrivilege 440 chrome.exe Token: SeShutdownPrivilege 440 chrome.exe Token: SeCreatePagefilePrivilege 440 chrome.exe Token: SeShutdownPrivilege 440 chrome.exe Token: SeCreatePagefilePrivilege 440 chrome.exe Token: SeShutdownPrivilege 440 chrome.exe Token: SeCreatePagefilePrivilege 440 chrome.exe Token: SeShutdownPrivilege 440 chrome.exe Token: SeCreatePagefilePrivilege 440 chrome.exe Token: SeShutdownPrivilege 440 chrome.exe Token: SeCreatePagefilePrivilege 440 chrome.exe Token: SeShutdownPrivilege 440 chrome.exe Token: SeCreatePagefilePrivilege 440 chrome.exe Token: SeShutdownPrivilege 440 chrome.exe Token: SeCreatePagefilePrivilege 440 chrome.exe Token: SeShutdownPrivilege 440 chrome.exe Token: SeCreatePagefilePrivilege 440 chrome.exe Token: SeShutdownPrivilege 440 chrome.exe Token: SeCreatePagefilePrivilege 440 chrome.exe Token: SeShutdownPrivilege 440 chrome.exe Token: SeCreatePagefilePrivilege 440 chrome.exe Token: SeShutdownPrivilege 440 chrome.exe Token: SeCreatePagefilePrivilege 440 chrome.exe Token: SeShutdownPrivilege 440 chrome.exe Token: SeCreatePagefilePrivilege 440 chrome.exe Token: SeShutdownPrivilege 440 chrome.exe Token: SeCreatePagefilePrivilege 440 chrome.exe Token: SeShutdownPrivilege 440 chrome.exe Token: SeCreatePagefilePrivilege 440 chrome.exe Token: SeShutdownPrivilege 440 chrome.exe Token: SeCreatePagefilePrivilege 440 chrome.exe Token: SeShutdownPrivilege 440 chrome.exe Token: SeCreatePagefilePrivilege 440 chrome.exe Token: SeShutdownPrivilege 440 chrome.exe Token: SeCreatePagefilePrivilege 440 chrome.exe Token: SeShutdownPrivilege 440 chrome.exe Token: SeCreatePagefilePrivilege 440 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe 440 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 440 wrote to memory of 3592 440 chrome.exe 86 PID 440 wrote to memory of 3592 440 chrome.exe 86 PID 440 wrote to memory of 3432 440 chrome.exe 87 PID 440 wrote to memory of 3432 440 chrome.exe 87 PID 440 wrote to memory of 3432 440 chrome.exe 87 PID 440 wrote to memory of 3432 440 chrome.exe 87 PID 440 wrote to memory of 3432 440 chrome.exe 87 PID 440 wrote to memory of 3432 440 chrome.exe 87 PID 440 wrote to memory of 3432 440 chrome.exe 87 PID 440 wrote to memory of 3432 440 chrome.exe 87 PID 440 wrote to memory of 3432 440 chrome.exe 87 PID 440 wrote to memory of 3432 440 chrome.exe 87 PID 440 wrote to memory of 3432 440 chrome.exe 87 PID 440 wrote to memory of 3432 440 chrome.exe 87 PID 440 wrote to memory of 3432 440 chrome.exe 87 PID 440 wrote to memory of 3432 440 chrome.exe 87 PID 440 wrote to memory of 3432 440 chrome.exe 87 PID 440 wrote to memory of 3432 440 chrome.exe 87 PID 440 wrote to memory of 3432 440 chrome.exe 87 PID 440 wrote to memory of 3432 440 chrome.exe 87 PID 440 wrote to memory of 3432 440 chrome.exe 87 PID 440 wrote to memory of 3432 440 chrome.exe 87 PID 440 wrote to memory of 3432 440 chrome.exe 87 PID 440 wrote to memory of 3432 440 chrome.exe 87 PID 440 wrote to memory of 3432 440 chrome.exe 87 PID 440 wrote to memory of 3432 440 chrome.exe 87 PID 440 wrote to memory of 3432 440 chrome.exe 87 PID 440 wrote to memory of 3432 440 chrome.exe 87 PID 440 wrote to memory of 3432 440 chrome.exe 87 PID 440 wrote to memory of 3432 440 chrome.exe 87 PID 440 wrote to memory of 3432 440 chrome.exe 87 PID 440 wrote to memory of 3432 440 chrome.exe 87 PID 440 wrote to memory of 3432 440 chrome.exe 87 PID 440 wrote to memory of 4720 440 chrome.exe 88 PID 440 wrote to memory of 4720 440 chrome.exe 88 PID 440 wrote to memory of 1576 440 chrome.exe 89 PID 440 wrote to memory of 1576 440 chrome.exe 89 PID 440 wrote to memory of 1576 440 chrome.exe 89 PID 440 wrote to memory of 1576 440 chrome.exe 89 PID 440 wrote to memory of 1576 440 chrome.exe 89 PID 440 wrote to memory of 1576 440 chrome.exe 89 PID 440 wrote to memory of 1576 440 chrome.exe 89 PID 440 wrote to memory of 1576 440 chrome.exe 89 PID 440 wrote to memory of 1576 440 chrome.exe 89 PID 440 wrote to memory of 1576 440 chrome.exe 89 PID 440 wrote to memory of 1576 440 chrome.exe 89 PID 440 wrote to memory of 1576 440 chrome.exe 89 PID 440 wrote to memory of 1576 440 chrome.exe 89 PID 440 wrote to memory of 1576 440 chrome.exe 89 PID 440 wrote to memory of 1576 440 chrome.exe 89 PID 440 wrote to memory of 1576 440 chrome.exe 89 PID 440 wrote to memory of 1576 440 chrome.exe 89 PID 440 wrote to memory of 1576 440 chrome.exe 89 PID 440 wrote to memory of 1576 440 chrome.exe 89 PID 440 wrote to memory of 1576 440 chrome.exe 89 PID 440 wrote to memory of 1576 440 chrome.exe 89 PID 440 wrote to memory of 1576 440 chrome.exe 89 PID 440 wrote to memory of 1576 440 chrome.exe 89 PID 440 wrote to memory of 1576 440 chrome.exe 89 PID 440 wrote to memory of 1576 440 chrome.exe 89 PID 440 wrote to memory of 1576 440 chrome.exe 89 PID 440 wrote to memory of 1576 440 chrome.exe 89 PID 440 wrote to memory of 1576 440 chrome.exe 89 PID 440 wrote to memory of 1576 440 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/drive/folders/12zRLOVDctyaPkeo_t3QZbDJ7oiL_8xRD1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8dbc3ab58,0x7ff8dbc3ab68,0x7ff8dbc3ab782⤵PID:3592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1596 --field-trial-handle=1872,i,6982663514742865577,7098682310590882267,131072 /prefetch:22⤵PID:3432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1988 --field-trial-handle=1872,i,6982663514742865577,7098682310590882267,131072 /prefetch:82⤵PID:4720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2280 --field-trial-handle=1872,i,6982663514742865577,7098682310590882267,131072 /prefetch:82⤵PID:1576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2996 --field-trial-handle=1872,i,6982663514742865577,7098682310590882267,131072 /prefetch:12⤵PID:3184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3004 --field-trial-handle=1872,i,6982663514742865577,7098682310590882267,131072 /prefetch:12⤵PID:3540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4628 --field-trial-handle=1872,i,6982663514742865577,7098682310590882267,131072 /prefetch:82⤵PID:4200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4500 --field-trial-handle=1872,i,6982663514742865577,7098682310590882267,131072 /prefetch:82⤵PID:320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4668 --field-trial-handle=1872,i,6982663514742865577,7098682310590882267,131072 /prefetch:12⤵PID:1596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3036 --field-trial-handle=1872,i,6982663514742865577,7098682310590882267,131072 /prefetch:12⤵PID:4324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3132 --field-trial-handle=1872,i,6982663514742865577,7098682310590882267,131072 /prefetch:82⤵PID:3680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 --field-trial-handle=1872,i,6982663514742865577,7098682310590882267,131072 /prefetch:82⤵PID:4712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5096 --field-trial-handle=1872,i,6982663514742865577,7098682310590882267,131072 /prefetch:12⤵PID:4052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 --field-trial-handle=1872,i,6982663514742865577,7098682310590882267,131072 /prefetch:82⤵PID:4404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3100 --field-trial-handle=1872,i,6982663514742865577,7098682310590882267,131072 /prefetch:12⤵PID:1076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 --field-trial-handle=1872,i,6982663514742865577,7098682310590882267,131072 /prefetch:82⤵PID:3336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5116 --field-trial-handle=1872,i,6982663514742865577,7098682310590882267,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=4384 --field-trial-handle=1872,i,6982663514742865577,7098682310590882267,131072 /prefetch:12⤵PID:1916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2492 --field-trial-handle=1872,i,6982663514742865577,7098682310590882267,131072 /prefetch:82⤵PID:4964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=988 --field-trial-handle=1872,i,6982663514742865577,7098682310590882267,131072 /prefetch:12⤵PID:64
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3032 --field-trial-handle=1872,i,6982663514742865577,7098682310590882267,131072 /prefetch:82⤵PID:724
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:4560
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1404
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_Radargun-master-20240721T183921Z-001.zip\Radargun-master\html\init.js"1⤵PID:5080
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_Radargun-master-20240721T183921Z-001.zip\Radargun-master\html\jquery.js"1⤵PID:1768
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_CarSpawner-20240721T184006Z-001.zip\CarSpawner\config.ini1⤵PID:3748
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD5bfb4ad144233248db8f0b493c9f53943
SHA175f204ac49008ca945d35db03568db5ffa2ee27d
SHA25657819395af403b8697d446c0ef64388fd0f4b33af5647bf8a79d0616cd903393
SHA5120f5f4ffdc046a81da203998f22ce0f156036b3c14646faa1b1c30d6bd0cf5138b70b3d5ac60b2b6eed36d2beadc108b78119f757bea84705ac71a8f1b3d4dd6e
-
Filesize
984B
MD5b9ac55ec9ee520215b2b6be84ebeb8ee
SHA1c47b9c96d5a4c0ad612b2d41d7a7d94d66af674d
SHA256b8bb3c1f6333b10ab393812fef12ca1674cb68097c61a7c0b7a382fc5e4d43f5
SHA512035f44ae6b6ae3cbba88d8d105c1cfe64bef3cb023403a83cb2dd9c99d374850c53cfc163aab02025bad7f9550f18babc5a8218638a2b5ded4580efa228cc93f
-
Filesize
936B
MD503b503d8410be8720e0f8e3802b179c0
SHA15229978bd625c204387211522a5c5b5e17aca141
SHA256674530f77c697361ba0d606da88877cffefa499f3bb1781c6d7797e9699392b0
SHA5121158d429486ec59384ea7ea4a2b7a46f96ef384b7cf387899d1d8cb667552704fbdb09770913958636e3ef3eb2e8a3be9174fbbc48482413b123d3653b2df549
-
Filesize
1008B
MD5ce7b33bf91795b33c71133f431c8e7a5
SHA1b86c92a3c1364ff3f0e7221c7e0704d2d581da25
SHA25629e6d950da65f42a5e58ef10db7115ec85fe41714d27f09e896274d061ce4984
SHA512b20e448f8b35ce5d63ce03209061be798454a59a7f3b58ed218779d3dea46bd70ca1579f09150d2781cc65aa5e173117d5dc5225e0cacebe3895e3ba16d6d310
-
Filesize
1KB
MD58893e14169e0034ec6531ae6efc244f7
SHA1f3de9aa51af79197d1c2b8375b42a8142960cc4f
SHA256229a1617c953b107c48699c618c8150d2ae52d6a0659d79c31fb3542761a8c52
SHA5123aeec0fda8f3065bf14bc866e62c6b32e7ea63322a3f8c4c0e09fd4bd2f19bccaef69247b9eac8f4c0b20a67f34cbeef3229fa7b0623cef8f45c3beabe67fcb0
-
Filesize
264KB
MD5b925c4b5e7e9d5512573b2756f7d146f
SHA188f09279914308a1f2db03a1a8def86ee2e0aa63
SHA256b7a4c8e864ad933c9f62121df59d0f00d9765514d6e3e9bfd612a7009731c3cf
SHA5122a0cdc3657310ee335b001a32bb40ac01f5be6559fbe4dcbc5cd22790ef75ea1c814d157fed52d73fe2adceb44de2f63e4c7b7153d99d6767477e47e0de46d54
-
Filesize
5KB
MD5d57404f4742b9b35f474f19d38a73de5
SHA170c6909e687383e085ee5ecba3b6bd3723155e4d
SHA25685b4cfb8d47c26a5c617dec1d3fcff1efdd22c8a0b2f7526bba74441b4821aaf
SHA51268c4d6a855b9567de3f1d21c5c16845fcd8d7ae4f82fab68c208e059982036e7dee34ff8296f469c9502eff426fc41a57aaded2b62db1d4277075847feff1cbf
-
Filesize
4KB
MD559d9870e27af4df0a8ce77ec6e2d7f7d
SHA12c147b9aa6caebc62ec33cac71c0b78735b4dc48
SHA2565e9cbeea85d9e7112a9942125ec0b4e17f070584a74e7d3d577d554cb1321256
SHA512e830e17fb0ab4040e36ee788d9f8bf606b97aff408381de559a6d3704e2c90d4c9d065f7850ac73cfd8690491af5aaf959858c8f40b6b06358b903464ad4e4ab
-
Filesize
4KB
MD573dc6448e25e03f2c6ce9816c4eea828
SHA1fd6c7a0cc8a2420522b6a346a62e013d9fc85c07
SHA256b7eaeb36a093c6d73ef0be6dde715ccc02eb0e869f11a4e1201959e93893c5f8
SHA5120a53816ee9d2e0416dc7c00ebee2cfde243ee72b0b141e720fb897838c7c6fbc25617d23e9865825d3f7d23a6aa9267566bcca5cc1303a4c168554f8c43d0595
-
Filesize
4KB
MD5ce31182305b98bf551ba1ee180df8e06
SHA19a3af2e9f7099a7efc6c7132724bf3f3496a74d6
SHA256c4a410c6f7da8f48b30a8bb41c3fecf753b252feecbcbb20cb50c9f251c90a74
SHA512ca0552cda08518133c55d7a4109f4b1a81d292a8edca550ed95028e3cfbb54f1cb6edbc491b8d6073ef561cb0b0b7add7ad0b9a205a57a788e7a9ecef888dfad
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
1KB
MD564f788a87eac0ea2642b56126299b6c5
SHA14cc2198c0f4eac4dc6b1977bbe0ff3b0b4063eb4
SHA2567e2c75aaca90dd90cccf4b0b81213638ef84252389d95fac4f7e7ca243a172bb
SHA512d2f88c2bb259cec5e0dc923916eaa5b4419f8ab847078b6ae1d7f06a90b775a2f8ea213ae38bc23adbc6de68f2628ebc9ad7e80e26e38ae3f2347f1aff7d8fc2
-
Filesize
1KB
MD5c1cfa6ee3cfb3ec1abcfc2a245299b10
SHA1749795ccaa8f815a9f99fbbdefa0a90eb47e8070
SHA256d3ae9d98c00c102b5121c3f9bce4aa9f54e19c602f73f6a78f61803e75dd67b4
SHA512c394a42f14f8acf2058252ff364abab82fac01da7bb6211b43c8eed72d477d36b475c150190a3522142a6469065cb65b9871f93e2e07e277ab9c8b013c5402a9
-
Filesize
1KB
MD5006df11fcf631e4f8807f26463fbf50d
SHA1af7fa87a1e660b0d74dc446c466ca8770418d63d
SHA2560c681221cfcd08fa09cb6306ff61f8b3fd9d60a8fdafb0fb2948435027e18325
SHA51265e6e9d0b607703331ec8428ec9fd7626b49a7628f618576294ed730756c06664f6fc8e4895448bd69e122f0a92b85b91ccef09eb642cc6928870ea2eb621419
-
Filesize
1KB
MD57707751d2095a6f6fdd877c233a06ac1
SHA1c40984446c6a7849c2cdf4c3ff84b7efeaf55c2b
SHA25672e4fbab65fedb820194ac839e9b0c37ddf74cd4bff2267702d95c41eafca35d
SHA5129401968a7de04458e14fea150bb336f0fab1294c931a41e8b04ac6a000fdf76798b12f9c3348934e352b0bbd33a9a4607463a99e8fc5cd453d242bdc87349112
-
Filesize
1KB
MD5614a38a571d18f2dcbe431b804b115fc
SHA1788b267d1337c528986441c3383c4aa280e44d47
SHA2562cb8270b1905e29e8c56f848f0a8efe950ff3ee3189013608a1cc9a7829a2335
SHA512f9a5c0e95f4814e6b3141c05487f0d195e24d7cb4ffbdd6bb59d8e0bf6d7e07f53393d353231eb2be7b6ec90588d7d2fc6fbfa806638d62a7eeec56574ea4f89
-
Filesize
1KB
MD5e931f47cb2758aa3563e79cd13969d0f
SHA1386274ed281680f99c097cca3f8e8b47bd3ff6dc
SHA256828da57df4613894337b59db331ac397eb47f1600aa7f11bbaf821cbce1d36fa
SHA51268808b7fd81c675011f05bd5df8d8db1471f974204888f7f8179d44d7a990f93bf09a4b048851dde4b50b568936d7e88e47a1cc6a19a38fdcc701a4ada7ac98c
-
Filesize
1KB
MD57b547b8d9099b139dea2f850be45fb15
SHA1fccfef8b53e3874f80f17536547e9cc5a9b8d513
SHA256890585b1e245d919065bc6ebeb3b6af06a224b26b533b317b6345a5118c56b95
SHA512fc2dc7f479f51797b14d47573ff0eaedbc6cd77861081308f155fbb223623d7e66e5024fee910dca9cf35762cb31541dc474fe335ada45fa1b581b15cc59c1d4
-
Filesize
1KB
MD573bc3f823b54c98542fe15ef9d99094a
SHA1ac7e86241f2289259248194ebce8e339fb1bd213
SHA2565434625a8287673ab5d9410483df250569bdd1935b94babd64c15877413dd75f
SHA51213ba410397b0f113ee5f27511183dc61136891ce13a4cb4ba75d76ecf6f87d42b2337a5bac49ab0dfceda0d795ae7b839e55d2e11bf310c90697650b9b33958a
-
Filesize
1KB
MD5f3a31717f2b1bdd6a39abc6d27f99db3
SHA1e44c28a3ac3221b95070f50387e5fc2bb5b03002
SHA2568f0072cb5d71a00929bb8d90a6b31c4583dac7615e5c520af4d9173afaceaf01
SHA512e24f7b432b5a48dd414d1d74b493ef545c3f07f932b6ba24e5397dfac41135c5e0f7ba402795a2f406bc7c999a780ad38628271903e40949969a32e107457f2d
-
Filesize
1KB
MD5c8c27d37550f1a0bc81b9ba0981ebf2d
SHA15b4a17ad583e6f6907360c4c3afc2f6fe85f4077
SHA256d2e378a7cde4d687645514e6554a7aa2f937672ea4eb2a2f57501ea1827952ef
SHA512c298c197cfadc991c1f7abdd44161bddd3ba615cfff30b509b726b692013e4292e874c9e603a2d40a4147707a21198683e364a4e11d61ebcec835e01826914c1
-
Filesize
7KB
MD51eece8b1bd416edb24b949fdc2b5d2d2
SHA145e39ee6fa03bc3d52fb708b8e9c01cf37d3d274
SHA2560a5d4940df73de6d39096d0d7095999632cadb11e1c601f79c5574d5b1ed0a8f
SHA51274f7de18c15d93224ce3666fbf88093f53fcff8bac025190f64984ddd23f55b50628780e6be0112da8c78f0eb2c8f8278201f1880b0420d03691e0ef94de2cf9
-
Filesize
6KB
MD5f679860caa403c6c3573c502341c1cab
SHA1c2c150d025879e6a8d697a1bd8a5a0d91b66c875
SHA256bf5abbc6c7f876f64fd747e80e2712b6fb17cfb90aa7395d0f2b210e2218e767
SHA5128f90cad338c953b5a177de273e7ea272810ee518546af9fa5ae5d69ca4ba9e58c071f861c785b5df27830199bbd90b77f0a0aae24de8fbd61366f567385dbc6e
-
Filesize
7KB
MD52e693d66e35c1c1121e5aa14ea9d73e5
SHA1e4dca7a1ef8c665249130edcc6f1e34de689d416
SHA256ee0da608951fb5d0098dfe03120f9929a661eede6744c96339a468b86d68edf3
SHA5128eca7cc8465eca8d04559987ad5310a90ce28d16b6a25521176a32bd14893bb3e1018d399544c5b6856e62656dfe76c11539606522804b10459b254c50c61a97
-
Filesize
8KB
MD5f9cff1813e0cbf03c8f0e09d416ef837
SHA17515ccc125ffdef73d3b62aa9e5fc221046de587
SHA2566bd517529acb25df124c025530d20f113f25b4c69a27fa9e508ee1f9aa1e1509
SHA512a20db75ec5df06230137e27acf283bbcb928eb7fed9969e5ff28aa874456f00124a4fd9fc31e4bd63154b0d900af85b14e7ddc8f2c7f9954a3d5add2724419fe
-
Filesize
7KB
MD592a7c3e4d7bbe81973491e288f5cb378
SHA1dc78b6180542d2e0353afdf261a23807a0adf6cb
SHA256336cecbadb5c784ecc7d64f71dbc87c5aef78b2e1200069e137e77de8f09e7e3
SHA512e9d51d4ac2bc43736d50570b6a1a2b76c61db2e094cf059e79c974937b7dfe136081d9c6f855f9c10a46113c71b3b84c58f5c7bf34771657311de76621dd676e
-
Filesize
7KB
MD50d6ff44b08120f47fcfbfb2510c78ad3
SHA196bd0e6682c32910d8f3e30c325c8172c3532f5d
SHA25677a3c25d18ca28b17a46e6479f26ebc4e36c51bc0a593ede87ccc135df06c82f
SHA5127727050be9c9bc44e8f3ece8f90b9ac322a023a62b22071ee8a74dacc66fbd6acaeb2b2cad30778e0589502587a486661ecae1f43a13dad5a9109bf739a0235b
-
Filesize
7KB
MD5d3b4c79a18c4b49dddd23ecdb0f51a94
SHA1e7d70b56ad761b539339c267b665056832607b94
SHA256960342a7cde365b64ec934edac06337388c971ba44d11431e6352b9b40d6311b
SHA512217777e51f05118bff5c13310b0f5f9c3422385caeec66e929f4be07e0d2b82e3fa2240aad198f591506926287f51122f233c2163b91c4b5afaffe97186360c4
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\16.png
Filesize567B
MD532069dd75567b3138421e48e7d7aeb13
SHA172fd75e45ee3b788816bdd7672160f3e709c2ee5
SHA2561b5970e696016e753f60e9c2bb59aca67b46b8349184975ff5ff725a465f53cb
SHA512e6c5d055b704af8af801aa53793ccfad32d02cb314440869560bc87bf9e7d2e938602ce97a1cda0ee0d9083304033f57d848b25b5d06f7586cf0c8a26d5bfd4d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir440_159993922\Icons\128.png
Filesize7KB
MD59f7165e53ce1f7f109be240a7145d96d
SHA108df18922492fe799f75912a100d00f4fb9ed4c4
SHA2567ace7af33ecddb14b0e5870d9c5be28f0218d106f33fb505154d089a5055e9e9
SHA5128fed74e748736b36a9ff33340120a85f722651a877b5404ae79eb650b31885d37b43d8102cfd9eeda4033dbf463d324533ced3bb2418e95fa0662291652db448
-
Filesize
144KB
MD5b4845a7d9dadb0ca6d0b4d7da7e0cc73
SHA1852bce312060da1ce0025b45deeb1aea2dd3315d
SHA256ebf7ee9f6c840cd2990585c5a56b92029689ae61221b6cacbfe06c11a39b515b
SHA512113f1f290f5b265d49466d9a05a9585a5d16695a276bf5ee5cc8b8696257d58717d6f336b031de925734a17c5081343a0a20c16ec4a98ef1b1ee0a29da5e128a
-
Filesize
144KB
MD57d527db42c415d6eb1955ac6ff77a198
SHA120cd6fb0652f634335398a9a6fe658db43e94465
SHA25627139cdb3e6789c4d34d899f488d546d449c8c54b58475caf2325b8fed66ab00
SHA512d55a0c19d3a1cb8ff150f8b495f400f44db66d75bfab4206b193e67f92a6ba9e3e3749d95748d5b936dd5c27c102a194be202789bfbf0cada87a9c6a8f6967b5
-
Filesize
144KB
MD586de96a9aca1401d4788dfeac97c333e
SHA1995bd8548869e1d03c0268069e514149c7bffe1d
SHA256d406f7c38646efa3d9dababf129c7293804d9046ab01a95aabfc2426fbf9c288
SHA5126fc52ac7c4d53e59abf0fab0f34a0a6d2194b205fecae15b0748e91a64d65a032ef73a7cbb39b69dc6aa443d229e3c96122e2a0dfd228ea6e49300931ef5b9c6
-
Filesize
97KB
MD5fe9b4187ce8b2109dd2911ea4ec4b169
SHA1de1738e92fee39bf5ace8ea5826c54aa8340793a
SHA256c98360c2ac7ac857d16d8a9b4b6a7b86fdbc1867c4a731c0100b4d64f4a26b74
SHA512c1c3e422683b8d168933034ffab39d723d66a06c79c4ac426c69b8f7a0983734ef6fc0cd27eb6f553bbe54a5569c584dec2ac52b7f202dda4c89a76943e53e08
-
Filesize
94KB
MD5fb9fe6398391e9f79e268e9d1472e47d
SHA1c553d32f7d5faa07194f0dcfe5f3ac598d556446
SHA25672ebf388e89ca4539fbe4ae5bb128d31d112f16171c11c6383586e0db7918479
SHA512a30c5102d1dfc425be9b8fe7b9ca99f1f39823838dd3c41de2a4687c3d84b50a373edac1bea63f97e5fe6ed22b8def230878d99bb59920c34f5d65e240765053
-
Filesize
31.3MB
MD5522b39908a97214089911fee673bd10b
SHA1ecdcf4dd95c30a061e2bc9123476aebde114eaaf
SHA256bd2710eea5ea06a63f061e019632497d6bca14c06504b50bfe4b0627f1a30c79
SHA512166894e308152b7bab4cf1a4ea8d3f30b84eddad288e90f7f5b23c42e2f95b2dff513ea76170a1ede91753229a34b3d6f3af55431a7b8ddbb9de04fa15d23a0f
-
Filesize
113KB
MD5ae2f9f5816cb5d733c7e817c35920aad
SHA15817799d7b080712612c257d761dc754cf953816
SHA2562a2b286e630cde1ab6421ea4f5bfa7a7bd9e17a1d7089a33696c9fc6a037649d
SHA5127c242195ffe3dc2fc6d90a0fc4a4ca5e0509c1ff41ca65f49e460615336648623a8c1a7e3b25250ec37d1768fc9bc64a3c3dd249604909d607d37205ed81e3ad
-
Filesize
826KB
MD5c4f3543ac8a5c2c26325757b7da41493
SHA1addc064749630327494afa78e764cee7e6f15bce
SHA2560ce034e5e66a498bb70c100946d2629be08b4314c9eba2fdceb5c668c1054fbe
SHA512670f3f76ad2168df7fa76b4fc0516777ce28e05d97ee2c02a1e8bd534cecd2a6b84efdaf9ca23e01b6b70e4c08f072ce7b69a74ad24b15147b09bacb37920b70
-
Filesize
292KB
MD53c7f5d17adf5e71b26bb6df11db49d11
SHA1f47f0edc628146fbf4c5c9b6b36838313adf966d
SHA256d78ed2c220c062c1240eb9c37a1550d610b04d4707e4994ee258c7ff82706d9a
SHA5127819aefa4c32066b5992975302bff3ca76dbd30837da2ee4bac2ce16e86dc07fabb1c289773c5161601eb45990e9f86e9ef5b11d1eb71ac6258d65e64b3a5475
-
Filesize
31.5MB
MD5bd561f7b24df4198f846417ebd72728d
SHA14417cc1a9772d0030e944c731f3294df843653d9
SHA256906fb7dbc56be0477762fff0d598e81c96f3081b3277a462baef29a5ad00bb80
SHA51292038dc79f9eadc7a23826ee8636ee8f7a5411e3a426d352dbb2425b95fdff144b4467d2580ccefbda11c9188df40621466d359e88507b75581369ab1e674a9d