File name:

Dox_Tool_V3_Cracked.rar

Full analysis: https://app.any.run/tasks/4e1ccdea-9dba-4bb1-8628-aab9c3e34801
Verdict: Malicious activity
Threats:

Quasar is a very popular RAT in the world thanks to its code being available in open-source. This malware can be used to control the victim’s computer remotely.

Malware Trends Tracker     >>>
Analysis date: November 25, 2021, 01:00:19
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
rat
quasar
trojan
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

3644F99DDF506A39DA30126C9A0ABB6A

SHA1:

F04F0277FF79AEEA0D5CD0F28E8245F50A2C7D65

SHA256:

9C09DED5AE06EFDB1D52F183D70F6A3FC821618BCD60D6F4A9F0C46D20BF589A

SSDEEP:

49152:cjBI5buvPNb4ah+utzurqOeJ35JwzY/yqlY:eC5SXNMKlurqxpyqa

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Dox Tool V3 Cracked.exe (PID: 548)
      • Launcher.exe (PID: 2332)
      • doxsys.exe (PID: 2572)
      • svchost.exe (PID: 3116)
      • Windows Services.exe (PID: 2464)
      • Secure System Shell.exe (PID: 2856)
      • Runtime Explorer.exe (PID: 3784)
      • Dox Tool V3 Cracked.exe (PID: 1792)
      • DOX.exe (PID: 1104)
      • WindowsUpdate.exe (PID: 2128)
      • SystemUpdate.exe (PID: 444)
      • Runtime Explorer.exe (PID: 1984)
      • Runtime Explorer.exe (PID: 2572)
      • Runtime Explorer.exe (PID: 3716)
      • Runtime Explorer.exe (PID: 2240)
      • Runtime Explorer.exe (PID: 3132)
      • Runtime Explorer.exe (PID: 2544)
      • HQUHlwGxWA.exe (PID: 2700)
      • Runtime Explorer.exe (PID: 3232)
      • Runtime Explorer.exe (PID: 2604)
      • Runtime Explorer.exe (PID: 2264)
      • Dox Tool V3 Cracked.exe (PID: 3472)
      • Launcher.exe (PID: 2940)
      • doxsys.exe (PID: 3048)
      • svchost.exe (PID: 1232)
      • HQUHlwGxWA.exe (PID: 1032)

    • Loads dropped or rewritten executable

      • Launcher.exe (PID: 2332)
      • HQUHlwGxWA.exe (PID: 2700)
      • Launcher.exe (PID: 2940)
      • HQUHlwGxWA.exe (PID: 1032)

    • Drops executable file immediately after starts

      • doxsys.exe (PID: 2572)
      • Dox Tool V3 Cracked.exe (PID: 1792)

    • Drops/Copies Quasar RAT executable

      • Dox Tool V3 Cracked.exe (PID: 1792)
      • WindowsUpdate.exe (PID: 2128)

    • Writes to a start menu file

      • Launcher.exe (PID: 2332)

    • Uses Task Scheduler to autorun other applications

      • WindowsUpdate.exe (PID: 2128)
      • SystemUpdate.exe (PID: 444)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 4004)
      • schtasks.exe (PID: 2928)

    • Changes the autorun value in the registry

      • Launcher.exe (PID: 2332)
      • svchost.exe (PID: 1232)

  • SUSPICIOUS

    • Reads the computer name

      • Dox Tool V3 Cracked.exe (PID: 548)
      • Launcher.exe (PID: 2332)
      • powershell.exe (PID: 3852)
      • WinRAR.exe (PID: 3652)
      • svchost.exe (PID: 3116)
      • doxsys.exe (PID: 2572)
      • Dox Tool V3 Cracked.exe (PID: 1792)
      • WindowsUpdate.exe (PID: 2128)
      • DOX.exe (PID: 1104)
      • Windows Services.exe (PID: 2464)
      • Secure System Shell.exe (PID: 2856)
      • SystemUpdate.exe (PID: 444)
      • HQUHlwGxWA.exe (PID: 2700)
      • Launcher.exe (PID: 2940)
      • Dox Tool V3 Cracked.exe (PID: 3472)
      • dw20.exe (PID: 3628)
      • svchost.exe (PID: 1232)
      • HQUHlwGxWA.exe (PID: 1032)

    • Checks supported languages

      • Dox Tool V3 Cracked.exe (PID: 548)
      • WinRAR.exe (PID: 3652)
      • Launcher.exe (PID: 2332)
      • powershell.exe (PID: 3852)
      • doxsys.exe (PID: 2572)
      • Dox Tool V3 Cracked.exe (PID: 1792)
      • DOX.exe (PID: 1104)
      • WindowsUpdate.exe (PID: 2128)
      • svchost.exe (PID: 3116)
      • Runtime Explorer.exe (PID: 3784)
      • Windows Services.exe (PID: 2464)
      • Secure System Shell.exe (PID: 2856)
      • SystemUpdate.exe (PID: 444)
      • Runtime Explorer.exe (PID: 1984)
      • Runtime Explorer.exe (PID: 2572)
      • Runtime Explorer.exe (PID: 2240)
      • Runtime Explorer.exe (PID: 3132)
      • Runtime Explorer.exe (PID: 2604)
      • Runtime Explorer.exe (PID: 2544)
      • HQUHlwGxWA.exe (PID: 2700)
      • Runtime Explorer.exe (PID: 3232)
      • Runtime Explorer.exe (PID: 3716)
      • Runtime Explorer.exe (PID: 2264)
      • Launcher.exe (PID: 2940)
      • Dox Tool V3 Cracked.exe (PID: 3472)
      • doxsys.exe (PID: 3048)
      • dw20.exe (PID: 3628)
      • svchost.exe (PID: 1232)
      • HQUHlwGxWA.exe (PID: 1032)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • WinRAR.exe (PID: 3652)

    • Executes PowerShell scripts

      • Launcher.exe (PID: 2332)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 3652)
      • Dox Tool V3 Cracked.exe (PID: 1792)
      • svchost.exe (PID: 3116)
      • svchost.exe (PID: 1232)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 3652)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3652)
      • doxsys.exe (PID: 2572)
      • Dox Tool V3 Cracked.exe (PID: 1792)
      • Launcher.exe (PID: 2332)
      • WindowsUpdate.exe (PID: 2128)
      • svchost.exe (PID: 3116)
      • svchost.exe (PID: 1232)

    • Creates executable files which already exist in Windows

      • doxsys.exe (PID: 2572)

    • Reads Environment values

      • svchost.exe (PID: 3116)
      • WindowsUpdate.exe (PID: 2128)
      • SystemUpdate.exe (PID: 444)
      • DOX.exe (PID: 1104)
      • svchost.exe (PID: 1232)

    • Creates files in the Windows directory

      • Launcher.exe (PID: 2332)
      • WindowsUpdate.exe (PID: 2128)

    • Creates files in the user directory

      • Launcher.exe (PID: 2332)
      • SystemUpdate.exe (PID: 444)
      • svchost.exe (PID: 1232)

    • Checks for external IP

      • WindowsUpdate.exe (PID: 2128)
      • SystemUpdate.exe (PID: 444)
      • svchost.exe (PID: 3116)
      • svchost.exe (PID: 1232)

    • Starts itself from another location

      • WindowsUpdate.exe (PID: 2128)
      • svchost.exe (PID: 3116)

    • Searches for installed software

      • svchost.exe (PID: 3116)
      • svchost.exe (PID: 1232)

  • INFO

    • Reads settings of System Certificates

      • powershell.exe (PID: 3852)

    • Checks Windows Trust Settings

      • powershell.exe (PID: 3852)

    • Dropped object may contain Bitcoin addresses

      • Launcher.exe (PID: 2332)

    • Reads the computer name

      • schtasks.exe (PID: 4004)
      • schtasks.exe (PID: 2928)

    • Checks supported languages

      • schtasks.exe (PID: 4004)
      • schtasks.exe (PID: 2928)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
77
Monitored processes
31
Malicious processes
20
Suspicious processes
8

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe dox tool v3 cracked.exe no specs launcher.exe powershell.exe no specs doxsys.exe svchost.exe dox tool v3 cracked.exe windowsupdate.exe dox.exe windows services.exe no specs secure system shell.exe no specs runtime explorer.exe no specs schtasks.exe no specs systemupdate.exe runtime explorer.exe no specs schtasks.exe no specs runtime explorer.exe no specs runtime explorer.exe no specs runtime explorer.exe no specs runtime explorer.exe no specs runtime explorer.exe no specs runtime explorer.exe no specs runtime explorer.exe no specs hquhlwgxwa.exe no specs runtime explorer.exe no specs dox tool v3 cracked.exe no specs launcher.exe doxsys.exe dw20.exe no specs svchost.exe hquhlwgxwa.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
444"C:\Windows\system32\SubDir\SystemUpdate.exe"C:\Windows\system32\SubDir\SystemUpdate.exe
WindowsUpdate.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.3.0.0
Modules
Images
c:\windows\system32\subdir\systemupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
548"C:\Users\admin\AppData\Local\Temp\Rar$EXa3652.18599\Dox Tool V3 Cracked\Dox Tool V3 Cracked.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3652.18599\Dox Tool V3 Cracked\Dox Tool V3 Cracked.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Launcher
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3652.18599\dox tool v3 cracked\dox tool v3 cracked.exe
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1032"C:\Users\admin\AppData\Local\Temp\HQUHlwGxWA.exe" C:\Users\admin\AppData\Local\Temp\HQUHlwGxWA.exe—svchost.exe
User:
admin
Integrity Level:
HIGH
Exit code:
4294967295
Version:
1.0.6473.36168
Modules
Images
c:\users\admin\appdata\local\temp\hquhlwgxwa.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1104"C:\Users\admin\AppData\Local\Temp\DOX.exe" C:\Users\admin\AppData\Local\Temp\DOX.exe
Dox Tool V3 Cracked.exe
User:
admin
Integrity Level:
HIGH
Description:
LU OFFICIAL TOOL
Exit code:
3489660927
Version:
1.0
Modules
Images
c:\users\admin\appdata\local\temp\dox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1232"C:\Users\admin\AppData\Roaming\svchost.exe" C:\Users\admin\AppData\Local\Temp\svchost.exeC:\Users\admin\AppData\Roaming\svchost.exe
svchost.exe
User:
admin
Company:
Microsoft @ 2015
Integrity Level:
HIGH
Description:
Control ACLs Program
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1792"C:\Users\admin\AppData\Local\Temp\Dox Tool V3 Cracked.exe" C:\Users\admin\AppData\Local\Temp\Dox Tool V3 Cracked.exe
doxsys.exe
User:
admin
Integrity Level:
HIGH
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\dox tool v3 cracked.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1984"C:\Windows\IMF\Runtime Explorer.exe" C:\Windows\IMF\Runtime Explorer.exe—Windows Services.exe
User:
admin
Company:
Microsoft Windows
Integrity Level:
HIGH
Exit code:
0
Version:
1.00
Modules
Images
c:\windows\imf\runtime explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2128"C:\Users\admin\AppData\Local\Temp\WindowsUpdate.exe" C:\Users\admin\AppData\Local\Temp\WindowsUpdate.exe
Dox Tool V3 Cracked.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.3.0.0
Modules
Images
c:\users\admin\appdata\local\temp\windowsupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2240"C:\Windows\IMF\Runtime Explorer.exe" C:\Windows\IMF\Runtime Explorer.exe—Windows Services.exe
User:
admin
Company:
Microsoft Windows
Integrity Level:
HIGH
Exit code:
0
Version:
1.00
Modules
Images
c:\windows\imf\runtime explorer.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
2264"C:\Windows\IMF\Runtime Explorer.exe" C:\Windows\IMF\Runtime Explorer.exe—Windows Services.exe
User:
admin
Company:
Microsoft Windows
Integrity Level:
HIGH
Exit code:
0
Version:
1.00
Modules
Images
c:\windows\imf\runtime explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
14 849
Read events
14 693
Write events
156
Delete events
0

Modification events

(PID) Process:(3652) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3652) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3652) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3652) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3652) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3652) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Dox_Tool_V3_Cracked.rar
(PID) Process:(3652) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3652) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3652) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3652) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
36
Suspicious files
16
Text files
9
Unknown types
2

Dropped files

PID
Process
Filename
Type
3652WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3652.18599\Dox Tool V3 Cracked\data\LICENCE.datcompressed
MD5:—
SHA256:—
3652WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3652.18599\Dox Tool V3 Cracked\data\Search.ProtocolHandler.MAPI2.dllexecutable
MD5:1EFF11CED2866665F101892E9D097D14
SHA256:A90C1A13965F534565F98B4A7C0DE5804B35482E9668F3D60DF8A1C039E51AD9
2572doxsys.exeC:\Users\admin\AppData\Local\Temp\svchost.exeexecutable
MD5:—
SHA256:—
3652WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3652.18599\Dox Tool V3 Cracked\data\Ionic.Zip.dllexecutable
MD5:F6933BF7CEE0FD6C80CDF207FF15A523
SHA256:17BB0C9BE45289A2BE56A5F5A68EC9891D7792B886E0054BC86D57FE84D01C89
2572doxsys.exeC:\Users\admin\AppData\Local\Temp\Dox Tool V3 Cracked.exeexecutable
MD5:—
SHA256:—
3652WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3652.18599\Dox Tool V3 Cracked\data\Launcher.exeexecutable
MD5:C6D4C881112022EB30725978ECD7C6EC
SHA256:0D87B9B141A592711C52E7409EC64DE3AB296CDDC890BE761D9AF57CEA381B32
3652WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3652.18599\Dox Tool V3 Cracked\data\doxsys.exeexecutable
MD5:8F36CAF603F3F2B192C5FD06A8E3C699
SHA256:0CA828C630091173CAFD2663393888849459FBC9581D1FD062567D0AFDF79A38
3652WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3652.18599\Dox Tool V3 Cracked\data\sqlmap.conftext
MD5:D996323D71A04CE49F1CCBF36E5269DD
SHA256:BC5836E6E6E97290914AFDE652237450092729EE31634DA6AB71B435A39EBDE6
3652WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3652.18599\Dox Tool V3 Cracked\Newtonsoft.Json.dllexecutable
MD5:4DF6C8781E70C3A4912B5BE796E6D337
SHA256:3598CCCAD5B535FEA6F93662107A4183BFD6167BF1D0F80260436093EDC2E3AF
3652WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3652.18599\Dox Tool V3 Cracked\Virus Total\desktop.iniini
MD5:C279803B27F13369AA54FC9B84B72468
SHA256:D80758A34364CAB9DE42FF6ED57BCC753A0936DDDDF9952C5B4FB9FF0D7966C9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
12
DNS requests
5
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
444
SystemUpdate.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
binary
257 b
malicious
2128
WindowsUpdate.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
binary
257 b
malicious
3116
svchost.exe
GET
200
104.18.115.97:80
http://icanhazip.com/
US
text
13 b
shared
1232
svchost.exe
GET
200
104.18.115.97:80
http://icanhazip.com/
US
text
13 b
shared
1232
svchost.exe
GET
404
162.243.129.169:80
http://puu.sh/jMSLc.txt
US
text
30 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3116
svchost.exe
104.18.115.97:80
icanhazip.com
Cloudflare Inc
US
malicious
1232
svchost.exe
104.18.115.97:80
icanhazip.com
Cloudflare Inc
US
malicious
1232
svchost.exe
162.243.129.169:80
puu.sh
Digital Ocean, Inc.
US
suspicious
—
—
192.168.100.108:53206
—
—
—
malicious
—
—
192.168.100.108:52518
—
—
—
malicious
3116
svchost.exe
162.243.129.169:80
puu.sh
Digital Ocean, Inc.
US
suspicious
2128
WindowsUpdate.exe
208.95.112.1:80
ip-api.com
IBURST
—
malicious
1104
DOX.exe
104.21.66.166:80
drizzybot.com
Cloudflare Inc
US
suspicious
—
—
208.95.112.1:80
ip-api.com
IBURST
—
malicious
—
—
192.168.100.108:52173
—
—
—
malicious

DNS requests

Domain
IP
Reputation
puu.sh
  • 162.243.129.169
shared
ip-api.com
  • 208.95.112.1
malicious
drizzybot.com
  • 104.21.66.166
  • 172.67.205.204
malicious
dns.msftncsi.com
  • 131.107.255.255
shared
icanhazip.com
  • 104.18.115.97
  • 104.18.114.97
shared

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET POLICY External IP Lookup ip-api.com
—
—
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
—
—
Potentially Bad Traffic
ET INFO GET to Puu.sh for TXT File with Minimal Headers
—
—
Attempted Information Leak
ET POLICY IP Check Domain (icanhazip. com in HTTP Host)
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Dox_Tool_V3_Cracked.rar