toxiceye | hxxps://mega[.]nz/file/8jVhQAhC#ODXNzG4x8v3YT9b76ZytNrFdz4zBOX7t4ANzja-Akw0

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-09-2024 20:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/8jVhQAhC#ODXNzG4x8v3YT9b76ZytNrFdz4zBOX7t4ANzja-Akw0

Score

10^/10

toxiceye discovery execution ransomware rat spyware stealer trojan

Malware Config

Extracted

Family

toxiceye

https://api.telegram.org/bot7313933025:AAHouyLOfu1tAXngtnciu-autL9gI2FqI-I/sendMessage?chat_id=5597821522

Signatures

ToxicEye
ToxicEye is a trojan written in C#.
rat trojan toxiceye
Renames multiple (271) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

TelegramRAT.exerat.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	TelegramRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	rat.exe

Executes dropped EXE 2 IoCs

Processes:

TelegramRAT.exerat.exe

pid process

5568 TelegramRAT.exe
5976 rat.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates processes with tasklist 1 TTPs 1 IoCs
discovery

Process Discovery
T1057

Processes:

tasklist.exe

pid process

5916 tasklist.exe
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
5568	TelegramRAT.exe
5976	rat.exe

pid	process
5916	tasklist.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

5960 timeout.exe

pid	process
5960	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exeEXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 2 IoCs

Processes:

OpenWith.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 2 IoCs

Processes:

msedge.exeTelegramRAT.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 690385.crdownload:SmartScreen	msedge.exe
File created	C:\Users\ToxicEye\rat.exe\:SmartScreen:$DATA	TelegramRAT.exe

Opens file in notepad (likely ransom note) 2 IoCs
ransomware

Processes:

NOTEPAD.EXENOTEPAD.EXE

pid process

6116 NOTEPAD.EXE
5808 NOTEPAD.EXE
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

5792 schtasks.exe
5156 schtasks.exe
Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

rat.exeEXCEL.EXE

pid process

5976 rat.exe
5792 EXCEL.EXE

pid	process
6116	NOTEPAD.EXE
5808	NOTEPAD.EXE

pid	process
5792	schtasks.exe
5156	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exerat.exe

pid	process
3064	msedge.exe
3064	msedge.exe
712	msedge.exe
712	msedge.exe
2784	identity_helper.exe
2784	identity_helper.exe
5464	msedge.exe
5464	msedge.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe
5976	rat.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

OpenWith.exeOpenWith.exe

pid process

5988 OpenWith.exe
5592 OpenWith.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

712 msedge.exe
712 msedge.exe
712 msedge.exe
712 msedge.exe
712 msedge.exe
712 msedge.exe
712 msedge.exe

pid	process
5988	OpenWith.exe
5592	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

AUDIODG.EXETelegramRAT.exetasklist.exerat.exe

description	pid	process
Token: 33	3524	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3524	AUDIODG.EXE
Token: SeDebugPrivilege	5568	TelegramRAT.exe
Token: SeDebugPrivilege	5916	tasklist.exe
Token: SeDebugPrivilege	5976	rat.exe
Token: SeDebugPrivilege	5976	rat.exe

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

msedge.exe

pid	process
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

rat.exeOpenWith.exeOpenWith.exe

pid	process
5976	rat.exe
5988	OpenWith.exe
5988	OpenWith.exe
5988	OpenWith.exe
5988	OpenWith.exe
5988	OpenWith.exe
5988	OpenWith.exe
5988	OpenWith.exe
5988	OpenWith.exe
5988	OpenWith.exe
5988	OpenWith.exe
5988	OpenWith.exe
5988	OpenWith.exe
5988	OpenWith.exe
5988	OpenWith.exe
5988	OpenWith.exe
5988	OpenWith.exe
5988	OpenWith.exe
5988	OpenWith.exe
5988	OpenWith.exe
5988	OpenWith.exe
5988	OpenWith.exe
5988	OpenWith.exe
5988	OpenWith.exe
5988	OpenWith.exe
5988	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe
5592	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 712 wrote to memory of 2204	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2204	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2200	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 3064	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 3064	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2432	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2432	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2432	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2432	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2432	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2432	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2432	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2432	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2432	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2432	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2432	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2432	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2432	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2432	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2432	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2432	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2432	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2432	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2432	712	msedge.exe	msedge.exe
PID 712 wrote to memory of 2432	712	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/8jVhQAhC#ODXNzG4x8v3YT9b76ZytNrFdz4zBOX7t4ANzja-Akw0
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x9c,0x108,0x7fff779246f8,0x7fff77924708,0x7fff77924718
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,14045822715986017246,5837439917532535982,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,14045822715986017246,5837439917532535982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,14045822715986017246,5837439917532535982,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14045822715986017246,5837439917532535982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14045822715986017246,5837439917532535982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,14045822715986017246,5837439917532535982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,14045822715986017246,5837439917532535982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14045822715986017246,5837439917532535982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14045822715986017246,5837439917532535982,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14045822715986017246,5837439917532535982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14045822715986017246,5837439917532535982,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2116,14045822715986017246,5837439917532535982,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,14045822715986017246,5837439917532535982,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14045822715986017246,5837439917532535982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2116,14045822715986017246,5837439917532535982,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,14045822715986017246,5837439917532535982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5464
- C:\Users\Admin\Downloads\TelegramRAT.exe
  "C:\Users\Admin\Downloads\TelegramRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  PID:5568
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5792
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpC9D.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpC9D.tmp.bat
    3⤵
    PID:5848
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 5568"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5916
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:5924
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5960
  - - C:\Users\ToxicEye\rat.exe
      "rat.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:5976
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\ToxicEye\rat.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,14045822715986017246,5837439917532535982,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2900 /prefetch:2
  2⤵
  PID:5000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:540

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x39c 0x348
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3524

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ProtectGet.js"
1⤵
PID:3376

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5988
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\UseHide.eps
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:6116

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5592
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\UseHide.eps
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5808

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\ExpandSend.xlsx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
PID:5792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9581a24d-be65-4def-98d6-ee78484ae86c.tmp

Filesize
10KB

MD5
23f592de24cb4d43325b46204003707c

SHA1
83fbad3e3d3f0eea30655f5e6d9f0669f624cca1

SHA256
58941832e37813a5ac17b9e54ba72662ca6cd50a1221f605269947268b8478c5

SHA512
e49c4f24026c302064a962434e50402b5398d78eeeaeb7cd5cd58f93130acb9f63cc986905fe283fff469471eefd16ced82aea1fda3b73b82c5e11e115d38842

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
d19dde322d9ad9787be743cae5c6f0bc

SHA1
9f41abb5129f89d3ce0e86c77104140377491101

SHA256
8c7e8e615aa2f6993692540a1d545dd587c1d66d68b8073ac40677a1551888e5

SHA512
29eb43f2cd66e18c6e3a014d2226d916f01f4499cb4def1f15e7647807b8e1a99d375f9d2f693d47085d4d915d141f150bee90138eacb7e6921a249016fa0fe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
188B

MD5
008114e1a1a614b35e8a7515da0f3783

SHA1
3c390d38126c7328a8d7e4a72d5848ac9f96549b

SHA256
7301b76033c2970e61bab5eaddaff5aa652c39db5c0ea5632814f989716a1d18

SHA512
a202fc891eace003c346bad7e5d2c73dadf9591d5ce950395ff4b63cc2866b17e02bd3f0ad92749df033a936685851455bcdbfad30f26e765c3c89d3309cb82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
70ca6cb8aedbfbb42948b3bbcc5de77c

SHA1
05c70b0b7f6eef4b7135835c289767cd07486dc0

SHA256
905534c23e314965d092ee1e685345ea3d60d11e33abf015f18583d0d63430ab

SHA512
38a3df5b2019424b5abf4dea6a4e88700c04fc85ed68bb277d46962e0f4884a98ccedbb04473868683e188b4a646cd7cb9de9639bd95e379f31899707dc1f458

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d37073c915d047ce92af1641bad70d30

SHA1
6f89c99591f557a5c47fb4ace2782e956ae9dbe5

SHA256
1635f78cee6413ff17134e6d5d3951d7e3811d0a5fc011c9728419448a4dcbe4

SHA512
e0fcc2f8673703d0a50c4998104fc9fece005ff12bf7bab85a5f64ed50bba8bb81f9469b92abf812eee52cd1956ffc2f6ad0d0084e25b2965bcd61dc4c799d9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
87c1e8e6e92009e64eef02ffb401738e

SHA1
18c874354a9b95a6a9a1d415a0aab9c20878c805

SHA256
6bdc5323835e2361c22d83216dc42027f52659d41a4f31eb99cef77c9d7d9d33

SHA512
90f05ec852686aec30816919373023c72e0afe61b473d5bf06e3afded2db11e88cc3ee01b9bf0b6e093713efd8026d5aa59798428ab3f9a405452253210147d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c03479500e8a198c43066551435bc9a0

SHA1
e6e6474478c916a6c36d0c4f6e75788229877968

SHA256
c247ed88e11fa82f521460e892fe6692da162abc76b64e3c4ef43390a9b386c5

SHA512
0cfebbe4f60ae2ab43ad58fbab31801bf1a253ca40b2b0f01bb106463c42d4fe5eba930c199a9a46a421f6a0452c960385b61162311e5047152c85d597c03d20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
4b8d6b10d97c42c5627a39f7037907a6

SHA1
731ab75e7d1df76e35f03984b632c5ab98ece48a

SHA256
65fc9193f32a2b89b6bc74b1bda258e61293979f0420c4cdc062c5abc8bce0f9

SHA512
d9b70b0a6baeee19c0d71f80173627a126492231230712dd86e593072093b4344ac4aae79560703843218e884cdbb2b7d4cd38e73816cbe19d96d5be189ceb4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58179a.TMP

Filesize
48B

MD5
c8552f96bd3a615018169b84168f7734

SHA1
f87ebfad41139d57350b940293beba7eb20725c2

SHA256
1424064d2bacac2a22c944b642afbad854371a94b557c3797e167bd9e6e87dad

SHA512
7385172e4b21607e0d53bbc7594e932994b329ecca73c526e1190b1304cbb1e51f6c101f8d19773813d01a9328c0477d2bb480ca479736156a86e9fea6a34c92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8945a561ed4316b52c17e1ef0c215415

SHA1
b17782e3f2fda4ac8726eae96c82d024affa3b4f

SHA256
8e1165a6c19934e16253b801ca6be4c3cfb1edad77c6f9f09a6eae4846ad0a10

SHA512
65f9752cd129a538e7bf4ed920de5c559b34dcd876b08c0b914f344a109a7553ebabdf7975c903c4357946e8c7b8ae153adefb1b2eaa276a459ddc58cabecca9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7870cb96781c411c1d6111db1f73d99e

SHA1
ff6bd7fc29cdc28d0f18ddcacb4720a055c729d0

SHA256
c04eefae775436871c408c0794c483e3fe98043580ea15bed68ce45bcf9b32a9

SHA512
6b38d8076d1faa7521a790c0895f30fab91c1ee3ecf5327aa0dcc459147a47875b7959316a0e50fda8f649173f308bbb17420a2a73cfae874fbdf59895294ea8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Filesize
321KB

MD5
a9f066f656095c8131962834a3e8269d

SHA1
16f3c158dea2114033e206fc8f2aa258f26e779c

SHA256
9cf36585a57090d57cccfdac8887b6267655ffab40f5f10e3082fe5209af5a35

SHA512
bc103bd0f5f5448a16bd04a674a5cba47534556a4dec332d87c83ef89b33a14d30094a79b51ce800c4230573fbc84874b7f6044e1b28c0684c3cf6a77f11d193

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\onenote.exe_Rules.xml.crypted

Filesize
271KB

MD5
cd4bfac33b26cdcfcb00d088404b8145

SHA1
f655824376cf3dfddf4a5648f6436b390427ad8c

SHA256
4ea9c9412f79b42b5beed8fd323eb11b3469017b6beac935c34f0d2207c079c7

SHA512
87350f6c4362002248d57e3cf42cf5248c6d3bc962a75cf9659ffac670fdbd90f1399e4713061f3f84f49c61b946f9859ed4fbb06c4adae9ed0285947a2056ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
8383e00a1c1f95e28c64c7117ec5a0fe

SHA1
84e4c540229832025ad695071fb6e247943e2d74

SHA256
2b52205fe858e5f2e268c48aa9c43ebd241b079a9d12111d3a9abc5c7b7457e6

SHA512
2faeebc155e5d93f765c6d7d210c998d8bf31cc20ee82a0deaa97eba82cb15daab1eb45c15d4ad2fc8c49e336d53a7b74f6908eb5cd8c9fee9489b1d1665cf39

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{dbb8ad24-1824-4f41-995d-6f14cc9e2b3d}\0.1.filtertrie.intermediate.txt.crypted

Filesize
16B

MD5
fa1c5d041c23c83bd87ffd7671678c9d

SHA1
d34549e84d0daa38d52629c7db9f26fe1aee90ed

SHA256
54f4804c19377994e9b13b619343eca5193312d93284f6c63e78227b9e2e3606

SHA512
ddf99a40282013a922e8314418b2113c02d46779e4641b53a76ec68a483a3f0fe6dcfb36775ef20358e8085862c1cc2c0aba12ee4eea59b52f9f9ff2375347bf

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{dbb8ad24-1824-4f41-995d-6f14cc9e2b3d}\0.2.filtertrie.intermediate.txt.crypted

Filesize
16B

MD5
08e8187adc035a710132aa3540b0cfa6

SHA1
2a7f0330a5e5c5160f1d1016bd6c378c09fea4d8

SHA256
9b84341e635b82c7a6d7e0c983f6fd5f1940c2c3970fcbcb643dab60712eeba7

SHA512
eda8b5625e1faa45c54359ca19e94abf40649cc63e886f8ea8dee9a74c9b23cf1a3caa4bd1288adc565a1fc6f5069f56eb838c1c45465d29520250db146bf4d2

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670754378380563.txt

Filesize
77KB

MD5
0244a1c7a537e285c37a3b4e5b83866e

SHA1
838f8cc158717a0d947bd300837c4989ad59bd97

SHA256
8c075f21c94507b20dae00a7cbf34052636200400032bd744b46b25d04f6cb53

SHA512
014d608d6676417a648cda9faf79014c071a6767d118682f2bd887232a4c7ad2e3b8c01ad415fe6e8a72b3c7b87d4ff5f28ad684affbf4fcae71e62f6571f2b5

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670754378380563.txt.crypted

Filesize
77KB

MD5
4626dcffd208b83c5b5bcba03b72ac0d

SHA1
540d50e461ae97b884b1ff9a372a137a80a27c8d

SHA256
4df9f19487147264d4d4b498bd898d4683f3c9c45c3c13e11419e210ea9d2e5d

SHA512
5c5d701d4f3d79dc9d4287fd4860faa4e53a1e122e4c997fa56df11da42e475ba629c8bbfacc899b9b6ae07bdf023d68597f9f02d5064bf979073d9ce9efae74

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670756262703360.txt

Filesize
47KB

MD5
83f502539dc9da050609c9b9c8b96985

SHA1
ce2b1b771daca2ce996b7dee0aafe35a1c3a6848

SHA256
cf558593dc7103bc2de19f72a09deb347b4b71a8a2fb2fe893da05cee7d43cd2

SHA512
47f9fd470db4c23b664c674dd2cd620d6a4da57b4b9f64aa5389804f4d1b03dad970e5b9ee0090bd6fc151e8646415aaeb47343e1635bb6a1956a2bb093ba983

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670756262703360.txt.crypted

Filesize
47KB

MD5
a24b71975a7881bf4bbe876145a1e9d9

SHA1
f84c7361fef7606845760d5e14672edc0aa5bca6

SHA256
c70226ad757a7daed3836bbd40d618b71dddecffdf257f69ab8d4a5413ad9e44

SHA512
77d5f551626e28cb99c4f30fb596671944891ecf1792b1e455e9a64b6228e9e47b0d8d043248b166257e172c18bd0e9d408757bfe787d95cc3a7f14178445f3b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670762916891590.txt

Filesize
65KB

MD5
a6f0856d5f2841558ca617d819644a05

SHA1
f6ae57dc8dc4a7355d2c5056b533a550a9e0e84d

SHA256
2dd19a20b12feb80089050b8725d0eae4b87c0c4cbc9d82b00f86e2f0aa69a74

SHA512
5676dcad94f24885a74aa2cec28fbd78ba77ee57c7a2fd8d9790b9f45995718918fcd188074f4edd09f2bb722e189cf1e0be540dd52f6b4f092698803510b43f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670762916891590.txt.crypted

Filesize
65KB

MD5
96ec96a008489230220842dff5471529

SHA1
edc22190130006e85a664c923d7f9c16c67572da

SHA256
2988d9d8b1b0e75460ba7bbdc891ffad4d25a86485ca1b626886708475464d5d

SHA512
e9e9237831a48570be59a89dd8b0c36aa7608ab7b95b3f080af6c8ad652554bfa862776c3ceecb25d6f9881b5a3b981f6f5dde550cb7205328545a6273eb6b0d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670788678258192.txt

Filesize
75KB

MD5
4a131455f03689d9deba589068141cdd

SHA1
12ba3c68e92e975f2e2cadef53ea84375c01852a

SHA256
f13e1945cd6aa1d49e03ae6120458a25043cb32873d6e05da5b3301b4a4f1074

SHA512
d5b5dead7295db0b64359201f8c3449c72d020e9f8542308a9fdb6affb94a881f98220a3b5a7bb12a1619942d04928856c13611e998c68cded3f1cbf50d6f5b1

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670788678258192.txt.crypted

Filesize
75KB

MD5
a71b26b99b85808c46788dd4305d0d8a

SHA1
e99893407a9ce96c011eef04c6f12a3ee33dfa84

SHA256
3f85f49ffe6282c5b2d44ffaa0412f3d738ed5b18234fa54cc5318915c025bd0

SHA512
f1d1d689c3e64d54af0d71750072d6962ec15772a7940c9eaca3fdb6b48269f9a5d1cb78bf6288b8f399268324e762b328bef53856996ff807b6ad2012a14b62

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC9D.tmp.bat

Filesize
188B

MD5
0c1dd40e85426e7d96b3651dc4d76136

SHA1
42e14b589a1b0a7f980abe749e978870c75ee356

SHA256
eb9687b7f5f3599ec84fb4f0fb90a153a3bfedf061eab2319c3b56e9ebaf2aaf

SHA512
373dfaba9041856a6cbc6c9a01dc73582c569596541168b46e8e6785b8fce1d8cbbf18416702d6b8345b05470cbc0bea6da79ed55c145e4dd0515f47a63ba8a4

Download Submit
C:\Users\Admin\Desktop\ExpandSend.xlsx

Filesize
339KB

MD5
c0011050e544a3472c129e2a0ef5fd77

SHA1
3638e8d252fe46e23d73f9c2f9f0bc1440d00304

SHA256
b42c650411881efeac6042e83fd8fd3cfc5297440cc95b4047555a47028be142

SHA512
1e6e2b0a9d428dd11e844fd5a0d5a91fa29e10b8b175e5b932694047973f42f30b1f33b5203b2b1c7c3ff4b0678310a5c0ca86c47c74fc71cb647c29eae39f34

Download Submit
C:\Users\Admin\Downloads\TelegramRAT.exe

Filesize
111KB

MD5
9c6f004d573a9660f4201028b795cfad

SHA1
235d54b393067c9ebceaf89c25877f8f310bb037

SHA256
3e37cefc156c265e1b048f8f59caf0e87c9bd097e9a43d4c0eeb2f05999add5b

SHA512
ddc6c0856576611329be1ca108c2d97854a6efef1bc3ad3d4266c562b8ff92a31990dbe4d3cbce57c13f733bdbfd9d3e98a8200929ced2f26b4c63743bb08ef5

Download Submit
\??\pipe\LOCAL\crashpad_712_FRVWVSGKSJYQVXUG

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/5568-175-0x000001E56B780000-0x000001E56B7A2000-memory.dmp

Filesize
136KB

Download
memory/5792-1360-0x00007FFF462D0000-0x00007FFF462E0000-memory.dmp

Filesize
64KB

Download
memory/5792-1358-0x00007FFF462D0000-0x00007FFF462E0000-memory.dmp

Filesize
64KB

Download
memory/5792-1359-0x00007FFF462D0000-0x00007FFF462E0000-memory.dmp

Filesize
64KB

Download
memory/5792-1361-0x00007FFF462D0000-0x00007FFF462E0000-memory.dmp

Filesize
64KB

Download
memory/5792-1362-0x00007FFF43C30000-0x00007FFF43C40000-memory.dmp

Filesize
64KB

Download
memory/5792-1363-0x00007FFF43C30000-0x00007FFF43C40000-memory.dmp

Filesize
64KB

Download
memory/5792-1357-0x00007FFF462D0000-0x00007FFF462E0000-memory.dmp

Filesize
64KB

Download
memory/5976-219-0x0000027C1F480000-0x0000027C1F52A000-memory.dmp

Filesize
680KB

Download
memory/5976-220-0x0000027C1F530000-0x0000027C1F5A6000-memory.dmp

Filesize
472KB

Download