hxxps://drive[.]google[.]com/file/d/1v1jB9o4_bW0qJjMPHniyIwMAqGpEb0L1/view

Analysis

max time kernel
1031s
max time network
490s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2025 15:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1v1jB9o4_bW0qJjMPHniyIwMAqGpEb0L1/view

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
7	drive.google.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133802206484333407"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	chrome.exe

Opens file in notepad (likely ransom note) 18 IoCs

ransomware

pid	Process
4608	NOTEPAD.EXE
2756	NOTEPAD.EXE
3340	NOTEPAD.EXE
4120	NOTEPAD.EXE
1248	NOTEPAD.EXE
4468	NOTEPAD.EXE
1200	NOTEPAD.EXE
3980	NOTEPAD.EXE
3520	NOTEPAD.EXE
4336	NOTEPAD.EXE
3748	NOTEPAD.EXE
3384	NOTEPAD.EXE
5100	NOTEPAD.EXE
3292	NOTEPAD.EXE
3188	NOTEPAD.EXE
5072	NOTEPAD.EXE
436	NOTEPAD.EXE
4860	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4224	chrome.exe
4224	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 3452	4224	chrome.exe	82
PID 4224 wrote to memory of 3452	4224	chrome.exe	82
PID 4224 wrote to memory of 4232	4224	chrome.exe	84
PID 4224 wrote to memory of 4232	4224	chrome.exe	84
PID 4224 wrote to memory of 4232	4224	chrome.exe	84
PID 4224 wrote to memory of 4232	4224	chrome.exe	84
PID 4224 wrote to memory of 4232	4224	chrome.exe	84
PID 4224 wrote to memory of 4232	4224	chrome.exe	84
PID 4224 wrote to memory of 4232	4224	chrome.exe	84
PID 4224 wrote to memory of 4232	4224	chrome.exe	84
PID 4224 wrote to memory of 4232	4224	chrome.exe	84
PID 4224 wrote to memory of 4232	4224	chrome.exe	84
PID 4224 wrote to memory of 4232	4224	chrome.exe	84
PID 4224 wrote to memory of 4232	4224	chrome.exe	84
PID 4224 wrote to memory of 4232	4224	chrome.exe	84
PID 4224 wrote to memory of 4232	4224	chrome.exe	84
PID 4224 wrote to memory of 4232	4224	chrome.exe	84
PID 4224 wrote to memory of 4232	4224	chrome.exe	84
PID 4224 wrote to memory of 4232	4224	chrome.exe	84
PID 4224 wrote to memory of 4232	4224	chrome.exe	84
PID 4224 wrote to memory of 4232	4224	chrome.exe	84
PID 4224 wrote to memory of 4232	4224	chrome.exe	84
PID 4224 wrote to memory of 4232	4224	chrome.exe	84
PID 4224 wrote to memory of 4232	4224	chrome.exe	84
PID 4224 wrote to memory of 4232	4224	chrome.exe	84
PID 4224 wrote to memory of 4232	4224	chrome.exe	84
PID 4224 wrote to memory of 4232	4224	chrome.exe	84
PID 4224 wrote to memory of 4232	4224	chrome.exe	84
PID 4224 wrote to memory of 4232	4224	chrome.exe	84
PID 4224 wrote to memory of 4232	4224	chrome.exe	84
PID 4224 wrote to memory of 4232	4224	chrome.exe	84
PID 4224 wrote to memory of 4232	4224	chrome.exe	84
PID 4224 wrote to memory of 2112	4224	chrome.exe	85
PID 4224 wrote to memory of 2112	4224	chrome.exe	85
PID 4224 wrote to memory of 4460	4224	chrome.exe	86
PID 4224 wrote to memory of 4460	4224	chrome.exe	86
PID 4224 wrote to memory of 4460	4224	chrome.exe	86
PID 4224 wrote to memory of 4460	4224	chrome.exe	86
PID 4224 wrote to memory of 4460	4224	chrome.exe	86
PID 4224 wrote to memory of 4460	4224	chrome.exe	86
PID 4224 wrote to memory of 4460	4224	chrome.exe	86
PID 4224 wrote to memory of 4460	4224	chrome.exe	86
PID 4224 wrote to memory of 4460	4224	chrome.exe	86
PID 4224 wrote to memory of 4460	4224	chrome.exe	86
PID 4224 wrote to memory of 4460	4224	chrome.exe	86
PID 4224 wrote to memory of 4460	4224	chrome.exe	86
PID 4224 wrote to memory of 4460	4224	chrome.exe	86
PID 4224 wrote to memory of 4460	4224	chrome.exe	86
PID 4224 wrote to memory of 4460	4224	chrome.exe	86
PID 4224 wrote to memory of 4460	4224	chrome.exe	86
PID 4224 wrote to memory of 4460	4224	chrome.exe	86
PID 4224 wrote to memory of 4460	4224	chrome.exe	86
PID 4224 wrote to memory of 4460	4224	chrome.exe	86
PID 4224 wrote to memory of 4460	4224	chrome.exe	86
PID 4224 wrote to memory of 4460	4224	chrome.exe	86
PID 4224 wrote to memory of 4460	4224	chrome.exe	86
PID 4224 wrote to memory of 4460	4224	chrome.exe	86
PID 4224 wrote to memory of 4460	4224	chrome.exe	86
PID 4224 wrote to memory of 4460	4224	chrome.exe	86
PID 4224 wrote to memory of 4460	4224	chrome.exe	86
PID 4224 wrote to memory of 4460	4224	chrome.exe	86
PID 4224 wrote to memory of 4460	4224	chrome.exe	86
PID 4224 wrote to memory of 4460	4224	chrome.exe	86
PID 4224 wrote to memory of 4460	4224	chrome.exe	86

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/file/d/1v1jB9o4_bW0qJjMPHniyIwMAqGpEb0L1/view
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff86584cc40,0x7ff86584cc4c,0x7ff86584cc58
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1892,i,8550509422093229561,17254887602289577951,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2016,i,8550509422093229561,17254887602289577951,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2588 /prefetch:3
  2⤵
  PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2068,i,8550509422093229561,17254887602289577951,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2488 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3128,i,8550509422093229561,17254887602289577951,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3136,i,8550509422093229561,17254887602289577951,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3656,i,8550509422093229561,17254887602289577951,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4456 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4748,i,8550509422093229561,17254887602289577951,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4764 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5140,i,8550509422093229561,17254887602289577951,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:2732

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4884

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3784

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_xKoxDDnetConfig_v1.5.zip\xKox DDnet Config\config ENGLISH\!!!README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3188

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_xKoxDDnetConfig_v1.5.zip\xKox DDnet Config\config ENGLISH\binds\emote_spam\emote+shoot\0.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5072

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_xKoxDDnetConfig_v1.5.zip\xKox DDnet Config\config ENGLISH\binds\emote_spam\emote+shoot\1.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3384

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_xKoxDDnetConfig_v1.5.zip\xKox DDnet Config\config ENGLISH\binds\emote_spam\emote+shoot\2.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:436

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_xKoxDDnetConfig_v1.5.zip\xKox DDnet Config\config ENGLISH\binds\emote_spam\emote+shoot\0.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4608

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_xKoxDDnetConfig_v1.5.zip\xKox DDnet Config\config ENGLISH\binds\emote_spam\emote+shoot\15.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3980

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_xKoxDDnetConfig_v1.5.zip\xKox DDnet Config\config ENGLISH\binds\emote_spam\emote+shoot\0.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2756

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_xKoxDDnetConfig_v1.5.zip\xKox DDnet Config\config ENGLISH\binds\emote_spam\emote+shoot\0.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3340

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_xKoxDDnetConfig_v1.5.zip\xKox DDnet Config\config ENGLISH\binds\emote_spam\emote+shoot\0.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3520

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_xKoxDDnetConfig_v1.5.zip\xKox DDnet Config\config ENGLISH\binds\emote_spam\emote+shoot\15.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4336

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_xKoxDDnetConfig_v1.5.zip\xKox DDnet Config\config ENGLISH\binds\emote_spam\emote+shoot\15.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4120

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_xKoxDDnetConfig_v1.5.zip\xKox DDnet Config\config ENGLISH\binds\emote_spam\emote+shoot\14.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4860

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_xKoxDDnetConfig_v1.5.zip\xKox DDnet Config\config ENGLISH\binds\emote_spam\emote+shoot\0.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3748

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_xKoxDDnetConfig_v1.5.zip\xKox DDnet Config\config ENGLISH\binds\emote_spam\emote+shoot\1.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5100

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_xKoxDDnetConfig_v1.5.zip\xKox DDnet Config\config ENGLISH\binds\emote_spam\emote+shoot\0.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1248

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_xKoxDDnetConfig_v1.5.zip\xKox DDnet Config\config ENGLISH\binds\!!!README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4468

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_xKoxDDnetConfig_v1.5.zip\xKox DDnet Config\config ENGLISH\binds\emote_spam\options_emote+shoot.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1200

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_xKoxDDnetConfig_v1.5.zip\xKox DDnet Config\config ENGLISH\binds\emote_spam\options_emote+shoot.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
76d21702aae15b903c2a369640614f79

SHA1
5bfff552c7986e78f62eae0bd85d3704274af12c

SHA256
3cc6189665272596228fa72823045109c6304f9a9b279c184ec424daa28e3a48

SHA512
8227760942db7abdce5277fed5281e84c19dd1db4d30deef28be24c8264b991274bcf943434bd28cacab4503758e05dfa42bf3154c235fc35b233d3af66f656e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
d3cdfc7a3237b9e88d287900c02b2d30

SHA1
20eb1a21b8d1a6435fa878dfec99a957cda8827b

SHA256
c204ebaf86d5e919015444f9c022bd3b8b2449cd169c58478b4dd61cd411e277

SHA512
3cc2877b956cb80d6fa22d5c902f2760e922e437350c2e881e0b8a3080e46fea63fdd098f23c344c8653507c72691e23bbb0f873f5668589c79db08599235853

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
4c7ac62a053f782f235e67c9ce6706c2

SHA1
059b95f669b7856871a49d815385321de3ca27e1

SHA256
5746baf62d6bc1a069cc6c4dd8fee12b4542df39ce1c1ce247e83b5cf561c5bc

SHA512
30093928dae9b31d15c5b53e2e161e75891c81bedaa21e579a55269e96618e59e3b3181f6f4deea2d41e187f4923c76b7c7224b591fd9c8023ebd453ed0979dc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
56ad46a89194b2432dc76450974b819d

SHA1
6a90ce6c0b596f76e67d21ee6d0ceda2e2fd0ad2

SHA256
a1cfe7e855609bf8fbb321ac1a8e034327779714876be8bc5310d2ba08d2d1af

SHA512
71277d66ac39e6564ab023e64611ab2acc1aa0f0c2c7fa224398646fb37f524d2586542f92d74e4448b8e61d3dbd1a04b468140d390efbc8d9ce7a88a4921145

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b2347bcfb391676d0707e5445bdde44d

SHA1
50a5d4b7c798e7c1ceec51eb29d811dfa1717fb2

SHA256
aea9d78c283d17181a7cf2f7a89d59307324d9e7757ccf020fab468acf3fc17c

SHA512
84b8c0826553b804626bf3c332664453b5c75094f5e947b03cd38d5b4ffbce359d7eb5ba29faa4d50ff9fb0cb79ad31c89efadd8258760fa80e20b869392668d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
5d1cac355d23da603ac977702194c15a

SHA1
760f170b5a5cd1cda9b4e93d460deab1e7a14f67

SHA256
5dd8890b7eb30512c388201c7a7b63ffc4b07daa7761f03b39cc30dd5bee6064

SHA512
60059b906ce0654909c9f7994b4a3a55b33810e3b9edaa6c2f68de20454d8bceabcde8af94043c47fca9bc79f2a342a15803c0c49e70d0f6a4710f05ec31555e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
e1ecdf8b5c8876ce3bfcdf1953ec0efa

SHA1
3052c945a46b446237e487b90fd4b0cd99fbf1a9

SHA256
238416d85300b22ecddfd83bb0002c1c90687219d328b212f5125af6682fec90

SHA512
327cff178c3092261e154f7f138349e4b79737545ec16efadb796cd3ac55ae0735f5019afeb2775a9a6698128aa388cdd684d8c30025722c5c324d47cf029c83

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
7a60905563045d91947a627a264055f5

SHA1
1dc60a6e44f0abc7b20b13d35b3aae809cedc721

SHA256
28f3d7fedc0c67a70709cfc2533638babad4ab256e8630898bb6dbefa9d1b691

SHA512
9800141be4a68acc0dd4b1c564469e7e3972595b31c6bdc2c1da4e86be8dddc44c89d474b5fa5e9c3b4dc32b287ee9f90832817b1d8791e51305239c50b3c2ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\Downloads\xKoxDDnetConfig_v1.5.zip.crdownload

Filesize
186KB

MD5
50d2ac6352e92ed1333c9433e6b81f04

SHA1
19bf1bb508555989b638d1fb545523c25a1ba750

SHA256
6ee49719d3f5dc3ef3b19f3a3a3fad95f7769651d2f0f343b1da22fa8cf02928

SHA512
b352272fe0b510633a7d56051744ea9caae9c876c10573fcb457034d0e78886b875e2c34a86830992045421ead680a24385e8b72a5c8f35d8ae03b90cc503175

Download Submit