(cache)Analysis ToxidPP.rar (MD5: 0F0060E989FB469D48ABF9C9C11F154B) Malicious activity

Move your mouse to view screenshots

Malicious activity

Win7

32 bit

complete

ToxidPP.rar

0f0060e989fb469d48abf9c9c11f154b

14.03.2022, 13:10

31 s

Get sample

IOC

MalConf

Restart

Text report

Graph

ATT&CK

CPU

RAM

Processes

Only important

Lost connection with guest OS while task running

1324

WinRAR.exe

"C:\Users\admin\Desktop\ToxidPP.rar"

1k

926

95
2232

SUS
SearchProtocolHost.exe

Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

219

711

57
1148

ToxidPP.exe

PE

3

0

2
2252

ToxidPP.exe

PE

749

68

47

Network
Files
Debug

PCAP

Timeshift

Headers

Rep

PID

Process name

URL

Сontent

No data

word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word