quasar | hxxps://gofile[.]io/d/B2iUtm

Analysis

max time kernel
141s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2024, 00:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/B2iUtm

Score

10^/10

quasar office04 discovery execution persistence privilege_escalation spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Office04

192.168.1.11:4782

Mutex

QSR_MUTEX_f39lWqYnYtP5YngtM5

Attributes

encryption_key
c5q7P5jsfrwN6nB5c3mG
install_name
SystemUpdate.exe
log_directory
Logs
reconnect_delay
3000
startup_key
WindowsUpdate
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023d8f-750.dat	family_quasar
behavioral2/memory/1740-768-0x0000000000C70000-0x0000000000CCE000-memory.dmp	family_quasar

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2012	powershell.exe
5196	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	Dox Tool V3 Cracked.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	doxsys.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	Dox Tool V3 Cracked.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	svchost.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Startup.lnk	Launcher.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 11 IoCs

pid	Process
2404	7z2408-x64.exe
972	7zG.exe
4832	Dox Tool V3 Cracked.exe
4628	Launcher.exe
3972	doxsys.exe
1032	svchost.exe
3960	Dox Tool V3 Cracked.exe
1740	WindowsUpdate.exe
2504	DOX.exe
3704	Windows Services.exe
4536	HQUHlwGxWA.exe

Loads dropped DLL 5 IoCs

pid	Process
3456	Process not Found
3456	Process not Found
972	7zG.exe
4628	Launcher.exe
4628	Launcher.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Runtime Explorer = "C:\\Windows\\IMF\\\\Windows Services.exe"	Launcher.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Dox Tool V3 Cracked\Dox Tool V3 Cracked\Virus Total\desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Dox Tool V3 Cracked\Dox Tool V3 Cracked\Virus Total\desktop.ini	7zG.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
149	icanhazip.com
141	ip-api.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	7z2408-x64.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\IMF\LICENCE.zip	Launcher.exe
File created	C:\Windows\IMF\LICENCE.dat	Launcher.exe
File opened for modification	C:\Windows\IMF\Runtime Explorer.exe	Launcher.exe
File opened for modification	C:\Windows\IMF\Windows Services.exe	Launcher.exe
File created	C:\Windows\IMF\LICENCE.zip	Launcher.exe
File created	C:\Windows\IMF\Runtime Explorer.exe.tmp	Launcher.exe
File created	C:\Windows\IMF\Windows Services.exe.tmp	Launcher.exe
File created	C:\Windows\IMF\Secure System Shell.exe.tmp	Launcher.exe
File opened for modification	C:\Windows\IMF\Secure System Shell.exe	Launcher.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DOX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2408-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dox Tool V3 Cracked.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	doxsys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dox Tool V3 Cracked.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows Services.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2408-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2408-x64.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 712495.crdownload:SmartScreen	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5252	schtasks.exe
5556	schtasks.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
2024	msedge.exe
2024	msedge.exe
4836	msedge.exe
4836	msedge.exe
2288	identity_helper.exe
2288	identity_helper.exe
3740	msedge.exe
3740	msedge.exe
2444	msedge.exe
2444	msedge.exe
868	msedge.exe
868	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
4628	Launcher.exe
4628	Launcher.exe
2012	powershell.exe
2012	powershell.exe
2012	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	972	7zG.exe
Token: 35	972	7zG.exe
Token: SeSecurityPrivilege	972	7zG.exe
Token: SeSecurityPrivilege	972	7zG.exe
Token: SeDebugPrivilege	4628	Launcher.exe
Token: SeDebugPrivilege	2012	powershell.exe
Token: SeDebugPrivilege	1032	svchost.exe

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
972	7zG.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
868	OpenWith.exe
868	OpenWith.exe
868	OpenWith.exe
2404	7z2408-x64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 4420	4836	msedge.exe	84
PID 4836 wrote to memory of 4420	4836	msedge.exe	84
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2388	4836	msedge.exe	85
PID 4836 wrote to memory of 2024	4836	msedge.exe	86
PID 4836 wrote to memory of 2024	4836	msedge.exe	86
PID 4836 wrote to memory of 3632	4836	msedge.exe	87
PID 4836 wrote to memory of 3632	4836	msedge.exe	87
PID 4836 wrote to memory of 3632	4836	msedge.exe	87
PID 4836 wrote to memory of 3632	4836	msedge.exe	87
PID 4836 wrote to memory of 3632	4836	msedge.exe	87
PID 4836 wrote to memory of 3632	4836	msedge.exe	87
PID 4836 wrote to memory of 3632	4836	msedge.exe	87
PID 4836 wrote to memory of 3632	4836	msedge.exe	87
PID 4836 wrote to memory of 3632	4836	msedge.exe	87
PID 4836 wrote to memory of 3632	4836	msedge.exe	87
PID 4836 wrote to memory of 3632	4836	msedge.exe	87
PID 4836 wrote to memory of 3632	4836	msedge.exe	87
PID 4836 wrote to memory of 3632	4836	msedge.exe	87
PID 4836 wrote to memory of 3632	4836	msedge.exe	87
PID 4836 wrote to memory of 3632	4836	msedge.exe	87
PID 4836 wrote to memory of 3632	4836	msedge.exe	87
PID 4836 wrote to memory of 3632	4836	msedge.exe	87
PID 4836 wrote to memory of 3632	4836	msedge.exe	87
PID 4836 wrote to memory of 3632	4836	msedge.exe	87
PID 4836 wrote to memory of 3632	4836	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/B2iUtm
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbbb3346f8,0x7ffbbb334708,0x7ffbbb334718
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,7573563326991005675,14211546328886658162,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,7573563326991005675,14211546328886658162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,7573563326991005675,14211546328886658162,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7573563326991005675,14211546328886658162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7573563326991005675,14211546328886658162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7573563326991005675,14211546328886658162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7573563326991005675,14211546328886658162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,7573563326991005675,14211546328886658162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,7573563326991005675,14211546328886658162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7573563326991005675,14211546328886658162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7573563326991005675,14211546328886658162,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7573563326991005675,14211546328886658162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7573563326991005675,14211546328886658162,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7573563326991005675,14211546328886658162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,7573563326991005675,14211546328886658162,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7573563326991005675,14211546328886658162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1188 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,7573563326991005675,14211546328886658162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7573563326991005675,14211546328886658162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7573563326991005675,14211546328886658162,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6488 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7573563326991005675,14211546328886658162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7573563326991005675,14211546328886658162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7573563326991005675,14211546328886658162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7573563326991005675,14211546328886658162,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7573563326991005675,14211546328886658162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7573563326991005675,14211546328886658162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7573563326991005675,14211546328886658162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7573563326991005675,14211546328886658162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2080,7573563326991005675,14211546328886658162,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3552 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,7573563326991005675,14211546328886658162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3548 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2444
- C:\Users\Admin\Downloads\7z2408-x64.exe
  "C:\Users\Admin\Downloads\7z2408-x64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7573563326991005675,14211546328886658162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7573563326991005675,14211546328886658162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,7573563326991005675,14211546328886658162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,7573563326991005675,14211546328886658162,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4064 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3196

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:868

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:180

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Dox Tool V3 Cracked\" -ad -an -ai#7zMap5918:100:7zEvent30419
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:972

C:\Users\Admin\Downloads\Dox Tool V3 Cracked\Dox Tool V3 Cracked\Dox Tool V3 Cracked.exe
"C:\Users\Admin\Downloads\Dox Tool V3 Cracked\Dox Tool V3 Cracked\Dox Tool V3 Cracked.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4832
- C:\Users\Admin\Downloads\Dox Tool V3 Cracked\Dox Tool V3 Cracked\data\Launcher.exe
  "C:\Users\Admin\Downloads\Dox Tool V3 Cracked\Dox Tool V3 Cracked\data\Launcher.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4628
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath C:\Windows\IMF\
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2012
- - C:\Windows\IMF\Windows Services.exe
    "C:\Windows\IMF\Windows Services.exe" {Arguments If Needed}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3704
  - - C:\Windows\IMF\Secure System Shell.exe
      "C:\Windows\IMF\Secure System Shell.exe"
      4⤵
      PID:2760
  - - C:\Windows\IMF\Runtime Explorer.exe
      "C:\Windows\IMF\Runtime Explorer.exe"
      4⤵
      PID:1372
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath C:\Users\Admin\AppData\Roaming\
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5196
- C:\Users\Admin\Downloads\Dox Tool V3 Cracked\Dox Tool V3 Cracked\data\doxsys.exe
  "C:\Users\Admin\Downloads\Dox Tool V3 Cracked\Dox Tool V3 Cracked\data\doxsys.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3972
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1032
  - - C:\Users\Admin\AppData\Local\Temp\HQUHlwGxWA.exe
      "C:\Users\Admin\AppData\Local\Temp\HQUHlwGxWA.exe"
      4⤵
      Executes dropped EXE
      PID:4536
  - - C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe" C:\Users\Admin\AppData\Local\Temp\svchost.exe
      4⤵
      PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\HQUHlwGxWA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HQUHlwGxWA.exe"
        5⤵
        
        PID:5976
- - C:\Users\Admin\AppData\Local\Temp\Dox Tool V3 Cracked.exe
    "C:\Users\Admin\AppData\Local\Temp\Dox Tool V3 Cracked.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1740
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "WindowsUpdate" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5252
    - - C:\Windows\SysWOW64\SubDir\SystemUpdate.exe
        
        "C:\Windows\SysWOW64\SubDir\SystemUpdate.exe"
        5⤵
        
        PID:5368
      - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "WindowsUpdate" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\SystemUpdate.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5556
  - - C:\Users\Admin\AppData\Local\Temp\DOX.exe
      "C:\Users\Admin\AppData\Local\Temp\DOX.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2504

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:3960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.dll

Filesize
99KB

MD5
d346530e648e15887ae88ea34c82efc9

SHA1
5644d95910852e50a4b42375bddfef05f6b3490f

SHA256
f972b164d9a90821be0ea2f46da84dd65f85cd0f29cd1abba0c8e9a7d0140902

SHA512
62db21717f79702cbdd805109f30f51a7f7ff5f751dc115f4c95d052c5405eb34d5e8c5a83f426d73875591b7d463f00f686c182ef3850db2e25989ae2d83673

Download Submit
C:\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
1143c4905bba16d8cc02c6ba8f37f365

SHA1
db38ac221275acd087cf87ebad393ef7f6e04656

SHA256
e79ddfb6319dbf9bac6382035d23597dad979db5e71a605d81a61ee817c1e812

SHA512
b918ae107c179d0b96c8fb14c2d5f019cad381ba4dcdc760c918dfcd5429d1c9fb6ce23f4648823a0449cb8a842af47f25ede425a4e37a7b67eb291ce8cce894

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
692KB

MD5
4159ff3f09b72e504e25a5f3c7ed3a5b

SHA1
b79ab2c83803e1d6da1dcd902f41e45d6cd26346

SHA256
0163ec83208b4902a2846de998a915de1b9e72aba33d98d5c8a14a8fbf0f6101

SHA512
48f54f0ab96be620db392b4c459a49a0fa8fbe95b1c1b7df932de565cf5f77adfaae98ef1e5998f326172b5ae4ffa9896aeac0f7b98568fcde6f7b1480df4e2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
56e271332ae6c80885cb7935f1a24459

SHA1
3a21609ab0c6502ba37feb1b18dd2fa39190726c

SHA256
b5552c84070e2101cc889bc76c91b12dc3c84f44ff16314fa78315e872dee3f6

SHA512
639d4ae64998ad6f1f59926af76288083925085372d4f5e30884719e109bf51ba14264cb6cc438b8d4be49d4a039d877eef4d0fc19a69baa1df2617e018d3d0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
c88e8b6fdb445972a037b90781b4a0f2

SHA1
4ba1993b2140ef0cb055c37a1e82a58ba0754563

SHA256
3a25f16111a72ec00428fc5ea00c6ce90b4a8434e055f31567fad23e76dc93ed

SHA512
5d5c68f459be2422ae2cf2db15064f81168508cd87035b24bfad044c9f15e6a9259d047f20bcfc1cfb291042e1d1ae618fecf638d664f813058f77030dd3157f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
012b0bf32cdb9b3b2e4731e2296f6a38

SHA1
6ff091a7a979434ff9da8bce4dc8cabc04c2c7f4

SHA256
e83b80ca2e437ddf7c5789b6c08671a8deed9a50d2e283c991f4c286b078237e

SHA512
deeb742b6960453ce639a2ca054799c25e61f5ec1736b993ac4345ff611762e86cdfe812c4dc2ed6396dea6e48deb4fa3a77480fa56dd48200cf495d7528d12a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
856B

MD5
eed63a4144ba667563f9fe2a0e2ad51a

SHA1
95b6ca2f7e8246a9df22210741748db4ee144b0f

SHA256
5b0f6115e2c0a703d3a0a4956aac0fcc625d512022c877aab41c57c623adbe45

SHA512
52e37f2104c13d9fe8ced70525ca58b11114289584a140741b8ce5a795f9be7f60a1b3b3221098612ba592a34add0b1726e73c57e1d04c4ec2dc1a8a7dc9a558

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
747fa54ce650d4463356f05751bc5f91

SHA1
b2a7eca2d8a62c570a811b8200cd36be58264875

SHA256
15e663d5b1215975c24fd1c8089dc8fa64be040bc0adc1e236a538a54256f469

SHA512
b185a73b6ada371bf795cff52be0fd32a2d4a294e32a9d3e5b899f97c4c9de957b25c5d8f24aa0bd70bdc514e8c1215e1d68ea4685e9af0c04993186ec2b789e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8cb43c3fe1e924537cb24a1e7a7fb0d3

SHA1
ce67788dd908ece9e0e4a888d16e201763a7ac2e

SHA256
d9bc87562787bcb8a63c50cd044150cfab99c982ccfbce080462a1b0d43a5a16

SHA512
f6f0d7a80b7f0d71d30ea5859318205293c0d9efc599902712791a0a439e7933383eda06e56c4a3e386b9d79dd2e8dfd4f7435c374d99cb0ea7a64c85497530e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ebf497c9cd31df8f6529a0d3c9edb210

SHA1
d3cb163fadbff3cade92224c9c5731dc09e7723e

SHA256
9446ab46ba83cc93f951dad6ab998fbcc3706b8c27b8e5122e984b43aee61ab9

SHA512
943b2508795e5c8333426fc8fd48733f1d1df66d7f225f0e26d372de14058cf2294404b149ff223aea329bc3b04b9a2bd88efc7e5d80427a8e8d627e1268b7ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
079b87e4a7659a00abb3fd21bb4765bf

SHA1
e2c7193252bdb6efabb43a528d5d13cc5c34611f

SHA256
fa8d48d63b996fcc76a9b500317916f5c972dfd177de3565001e9169d72ceaa3

SHA512
bcbc48d49057af43e8504f9a2cb1211a6119327c69a493d148116456d28ff36277bed9ac3b791e555b18c3d1e9defd66d95229283134c50e8e2b7b789b6740d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8821196f578a05f90edcf8daa8dc1758

SHA1
ef357932b3cddb083e379da94a073c83e10f15cf

SHA256
44d027871a173932eefae91a8bbb38a69f941c5f6a9e3fd8cada41cc73e867e6

SHA512
0fdd9fc870bea8d3f104850295ea26824099b4a78e3acd9df3f937d0a6a48543ce3a7b3d5f509483c9979b1ccef77ba8c25b3f8c322027588a11f4a70bc2fc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7c7064e537be503df3733b36d4e8bf71

SHA1
bba815ff1516d3b869aa5791a63c4e3eeae0e8a5

SHA256
4312df8f065bd9ba7073c58da7f0be600ac05369a61d68237c3aab3c47e9efa6

SHA512
7f59eedc7ab8467bcf160a17b064faa35e65acd23173096b4bdccb3ba91f970116415a862b27cb2385cc3e84cf9695959dc036bd9bb66a81c1f3dd610e1c2c48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b0a7c768a45fcdc0e7ba9a14f04ac85c

SHA1
e56740444de70484dcb66ed4ce2101198ae34acf

SHA256
3fa91749108518d437bad85580b8464b98d24675e2e2c194d61454caa59a149c

SHA512
9914be12b32917406681e9d4853f5fca0fa754aab5d46fb7284b170d471c93c4714964a791a242b68ad08e4f9a4275def204da02683a36fc1ef74e193b38a5ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
91d9711149a0a73c2342cac2b8418ec2

SHA1
075526e1eccdc8d8a09a97b16bdaa38df0e9da1e

SHA256
b0820d70ef5348cda6e82e12f8e7933670aee254b06ca95d84a3c0231e58ad8f

SHA512
a89b41fdc114e006887572cdac44aaff5386bc124e9fddd3d361fd41c1713c5b67ffb5d3f81f45510f1aabcac996c6423117ee95f37dcbcf771448cece8d08ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5927a3.TMP

Filesize
538B

MD5
0ec2fb8ecacc2b721003ae8dae271e9b

SHA1
d3b1129ece76634b1b30f3878529e0bb4f280697

SHA256
10f8bdc9d4ee591c51b313fe3403c93ce54e2a1b051b13aaac10d6a41dfc93d6

SHA512
931d151fd8793151710d75dba98dc4ac866b4f36474c80cbb505961b8bdf90cfdd8390290e32f0892265c8d85061a8f7ccb908af209ad45b2dc70f76e845abe7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
998d2bfae5720972f3fbfb49936d31dd

SHA1
d342640b2658cceb695950384056005ce3662e01

SHA256
04c7f1f37bfb59f6a05095422afed3cc6b21aad47989ec7856f585dcd32683b4

SHA512
6c961ca4b3dae8e1f697a381e0a0efb9b0913bcae3555f3afef8b2b447004c461f8d3a2d55dbab55a953bcedc6e3211a215fb288e7516d5daddecb54aa6a6e65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3755ba444edb619ef5b66795f176f9ba

SHA1
117140536cf2915845fc0ae4aff576d8f60c634e

SHA256
627f840aa1c8fbce8bdd6dbff7c498fe98fdf026d5d726c38360eb5fd30a52dd

SHA512
d889f35a2f1c46f8e5f7b89eb98f35a1f2a698ed5bd5047d7e158fbd36de607c796368eb0a327b0f80b56a67d7c26741be44ad1a3ad582cadaa5a65714a30480

Download Submit
C:\Users\Admin\AppData\Local\Temp\DOX.exe

Filesize
154KB

MD5
670f75850165e3c3ef0df41e1565ff58

SHA1
784ae13c951ac390d7dea0071c97aded6800b708

SHA256
fb128eba50fac8bc22faac39de602c306809cb37167b950bd194eb0bd9832812

SHA512
c0355235fbce7829dbcd3fac26ec5663b09c880826a014599127f330ddd3c16a95a0ab973fa75ddbb4ce0f8756ab2494739b04d1fda0bb799d577e493c9ca9b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Dox Tool V3 Cracked.exe

Filesize
688KB

MD5
19d55f26a6237985cb72c59c08d4828f

SHA1
8bc51ad39e35f9be7d46e9e90e754e07d9c88b80

SHA256
317f9d304aea7c5a4b3516f5379a63e2a4fec91578f3c3f69507c8167798062e

SHA512
7a9de012783f9323264fb59739b76195acedd846ea15382d67e5ab19325269a37647865aaa44da9a97fb8eacdf365c1b6c55c0920c46a6cdca6a7c73b09e19d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\HQUHlwGxWA.exe

Filesize
20KB

MD5
0d282d4eb8db6d5152b4e5fd3e2064b5

SHA1
72cec747647d5d0f6ef2e5ddb34f1db68fc183e5

SHA256
8663bef0304a937fe47af465c03b8930a5db2dad39bf4dd1cc6baa64cc272061

SHA512
16b2551711afa27baf9aa95d37c2d1b0689c32930ca5a4c7fabe66ea05513f460c58b36fdb96efb26963f10cdc518934dd3f5b623d424a2f299cc47d150f1e72

Download Submit
C:\Users\Admin\AppData\Local\Temp\WebCam_Capture.dll

Filesize
20KB

MD5
94306f6cf69f7e7c0b4f10ea499f73dd

SHA1
3228b4c2ca9109aa86f2810afc3d528947501c92

SHA256
ed937977d846c19ea5a721c8f720dafc4c697c2b136c17d66d7b6a4200090a7e

SHA512
d6c19775a96dedbd40be96d5b3aa3fb0db3d52749e0d54667b38a2f677c94b630ab543457708a1c123776ec473e9f40f18eb4080703ee9adf08110c417dea136

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

Filesize
348KB

MD5
a59f7fb8ac2dc166432a86eb8e2179ff

SHA1
9c8b24bda935e397e1c0cb33752331fe1f773b45

SHA256
82d315a2102a1bbd8c1533ea70f93982d2ad0fbbad3d48e9a4265c45353ceacc

SHA512
ff05149ca95d982ee44c820d8bc03e48d6230a7085291f0653398a410a16610038fbc336ec843db7020458fbe982762439990b348de050248758450b3ea263be

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eujanf3i.wgj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
76KB

MD5
a57d275fcac1be0b9aad189223a313df

SHA1
0762b222741fa30751dce16e7dae2bcd191adaea

SHA256
1c6d4e2a60849385c9b4cfbb1fc92032cb503497099208f62d7908e52b9b487b

SHA512
41d90ec2548654b86bba21d178bae55b538bc7acf7811b9615095e4719e52075096053427ff85428a51047f405e8d1e6a633b999655e296c9ac396fb2bba36a8

Download Submit
C:\Users\Admin\Downloads\Dox Tool V3 Cracked.rar

Filesize
1.6MB

MD5
59e6daac9b75d49b47a741e49e54b3ae

SHA1
795b6b2ac832e63265e301eb2a586ffd84ab5d41

SHA256
6e19dcec6b36433e5cdf7fd4ef20c1add51293e9cc0aa971f34b7857ea86f682

SHA512
a7a8664df8d44be44bfc91c99f8cc99e5482577d355a9e8e45ea2e5942b20e28ca56c21556652955bb2253e0eb5e2814d2044a73c7b378c05c22b9fe308e70fc

Download Submit
C:\Users\Admin\Downloads\Dox Tool V3 Cracked\Dox Tool V3 Cracked\Dox Tool V3 Cracked.exe

Filesize
207KB

MD5
6c206cadf297a02c0af977c65637a166

SHA1
7d382b1e6cefd120f9d87f894e14088e18d01c73

SHA256
f4f78f44719af71a363bd50107840f53f8eebf3190505c10bac2cf7be3c29e59

SHA512
2672ae02fb6b768861f469556f9818fd84866d62122f243309b5f2d13c4c907b6555e968bfb4b10cd48188fe3b2182b15ee7f425ddd14835b483d0dfe721b515

Download Submit
C:\Users\Admin\Downloads\Dox Tool V3 Cracked\Dox Tool V3 Cracked\data\Ionic.Zip.dll

Filesize
480KB

MD5
f6933bf7cee0fd6c80cdf207ff15a523

SHA1
039eeb1169e1defe387c7d4ca4021bce9d11786d

SHA256
17bb0c9be45289a2be56a5f5a68ec9891d7792b886e0054bc86d57fe84d01c89

SHA512
88675512daa41e17ce4daf6ca764ccb17cd9633a7c2b7545875089cae60f6918909a947f3b1692d16ec5fa209e18e84bc0ff3594f72c3e677a6cca9f3a70b8d6

Download Submit
C:\Users\Admin\Downloads\Dox Tool V3 Cracked\Dox Tool V3 Cracked\data\LICENCE.dat

Filesize
77KB

MD5
5180046f168dfd684b5bf268f5a0fa56

SHA1
ac8202ad5c94eb4d9e6227af92b5120e6d1b7ce7

SHA256
4139baa8beebcde4504c33bc88cf13b9ab9f32e4a054871ebeb82be6b84edc01

SHA512
04add8dc053c39a594e7889071b3fb9036fdc978b6f39f769c38b322e18a4ea6e05b6b66d97f0ac40c58f39120c791006a5b732da46ceba799e0db74afbed3e0

Download Submit
C:\Users\Admin\Downloads\Dox Tool V3 Cracked\Dox Tool V3 Cracked\data\Launcher.exe

Filesize
53KB

MD5
c6d4c881112022eb30725978ecd7c6ec

SHA1
ba4f96dc374195d873b3eebdb28b633d9a1c5bf5

SHA256
0d87b9b141a592711c52e7409ec64de3ab296cddc890be761d9af57cea381b32

SHA512
3bece10b65dfda69b6defbf50d067a59d1cd1db403547fdf28a4cbc87c4985a4636acfcff8300bd77fb91f2693084634d940a91517c33b5425258835ab990981

Download Submit
C:\Users\Admin\Downloads\Dox Tool V3 Cracked\Dox Tool V3 Cracked\data\doxsys.exe

Filesize
1.0MB

MD5
8f36caf603f3f2b192c5fd06a8e3c699

SHA1
44f387152ee1fb02a83ed0be5e942fd4a733e235

SHA256
0ca828c630091173cafd2663393888849459fbc9581d1fd062567d0afdf79a38

SHA512
9df012c7420a4f6224907a8ac1e3293985b30c9ff829ecc9cdeea56fdcaa1c46d8e131fdd9b525e6af092065a29401c11f24390ba30969e9f3ab7e60e094dcba

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 712495.crdownload

Filesize
1.5MB

MD5
0330d0bd7341a9afe5b6d161b1ff4aa1

SHA1
86918e72f2e43c9c664c246e62b41452d662fbf3

SHA256
67cb9d3452c9dd974b04f4a5fd842dbcba8184f2344ff72e3662d7cdb68b099b

SHA512
850382414d9d33eab134f8bd89dc99759f8d0459b7ad48bd9588405a3705aeb2cd727898529e3f71d9776a42e141c717e844e0b5c358818bbeac01d096907ad1

Download Submit
C:\Windows\IMF\Runtime Explorer.exe

Filesize
152KB

MD5
03f5e0141f4519f0c5ac26ce0b036a0f

SHA1
4f7a2a230e7a194a898cc9f2d563ac8777fe99c0

SHA256
78a408c628e33e3332645f480ee7ce01b5dc24fc96cf16ffa0868d43f3d421ef

SHA512
86a68f040654006e06b51c5714e0d7168d0d1bef7f3c39843632068104f773f771d21be4bc251d712f3e915cd1058f89ad31d9e3f3d9e7cf6da6785cbf22d8d7

Download Submit
C:\Windows\IMF\Secure System Shell.exe

Filesize
45KB

MD5
7d0c7359e5b2daa5665d01afdc98cc00

SHA1
c3cc830c8ffd0f53f28d89dcd9f3426be87085cb

SHA256
f1abd5ab03189e82971513e6ca04bd372fcf234d670079888f01cf4addd49809

SHA512
a8f82b11b045d8dd744506f4f56f3382b33a03684a6aebc91a02ea901c101b91cb43b7d0213f72f39cbb22f616ecd5de8b9e6c99fb5669f26a3ea6bcb63c8407

Download Submit
C:\Windows\IMF\Windows Services.exe

Filesize
46KB

MD5
ad0ce1302147fbdfecaec58480eb9cf9

SHA1
874efbc76e5f91bc1425a43ea19400340f98d42b

SHA256
2c339b52b82e73b4698a0110cdfe310c00c5c69078e9e1bd6fa1308652bf82a3

SHA512
adccd5520e01b673c2fc5c451305fe31b1a3e74891aece558f75fefc50218adf1fb81bb8c7f19969929d3fecb0fdb2cb5b564400d51e0a5a1ad8d5bc2d4eed53

Download Submit
memory/1032-745-0x0000000000FC0000-0x0000000000FDA000-memory.dmp

Filesize
104KB

Download
memory/1740-768-0x0000000000C70000-0x0000000000CCE000-memory.dmp

Filesize
376KB

Download
memory/1740-850-0x0000000005C30000-0x0000000005C42000-memory.dmp

Filesize
72KB

Download
memory/1740-854-0x0000000006920000-0x000000000695C000-memory.dmp

Filesize
240KB

Download
memory/2012-839-0x00000000081B0000-0x000000000882A000-memory.dmp

Filesize
6.5MB

Download
memory/2012-705-0x0000000002F20000-0x0000000002F56000-memory.dmp

Filesize
216KB

Download
memory/2012-739-0x0000000006DB0000-0x0000000006DFC000-memory.dmp

Filesize
304KB

Download
memory/2012-720-0x00000000062B0000-0x0000000006604000-memory.dmp

Filesize
3.3MB

Download
memory/2012-728-0x0000000006840000-0x000000000685E000-memory.dmp

Filesize
120KB

Download
memory/2012-871-0x0000000007E90000-0x0000000007E98000-memory.dmp

Filesize
32KB

Download
memory/2012-708-0x0000000006120000-0x0000000006186000-memory.dmp

Filesize
408KB

Download
memory/2012-709-0x0000000006240000-0x00000000062A6000-memory.dmp

Filesize
408KB

Download
memory/2012-846-0x0000000007DF0000-0x0000000007E86000-memory.dmp

Filesize
600KB

Download
memory/2012-707-0x00000000059A0000-0x00000000059C2000-memory.dmp

Filesize
136KB

Download
memory/2012-706-0x0000000005A00000-0x0000000006028000-memory.dmp

Filesize
6.2MB

Download
memory/2012-870-0x0000000007EB0000-0x0000000007ECA000-memory.dmp

Filesize
104KB

Download
memory/2012-857-0x0000000007DB0000-0x0000000007DC4000-memory.dmp

Filesize
80KB

Download
memory/2012-844-0x0000000007BE0000-0x0000000007BEA000-memory.dmp

Filesize
40KB

Download
memory/2012-856-0x0000000007DA0000-0x0000000007DAE000-memory.dmp

Filesize
56KB

Download
memory/2012-840-0x0000000007B70000-0x0000000007B8A000-memory.dmp

Filesize
104KB

Download
memory/2012-852-0x0000000007D70000-0x0000000007D81000-memory.dmp

Filesize
68KB

Download
memory/2012-823-0x000000006E020000-0x000000006E06C000-memory.dmp

Filesize
304KB

Download
memory/2012-835-0x0000000006E20000-0x0000000006E3E000-memory.dmp

Filesize
120KB

Download
memory/2012-836-0x0000000007A50000-0x0000000007AF3000-memory.dmp

Filesize
652KB

Download
memory/2012-822-0x0000000007A10000-0x0000000007A42000-memory.dmp

Filesize
200KB

Download
memory/2504-770-0x0000000000360000-0x000000000038C000-memory.dmp

Filesize
176KB

Download
memory/2760-848-0x0000000000C30000-0x0000000000C42000-memory.dmp

Filesize
72KB

Download
memory/3704-813-0x0000000000A40000-0x0000000000A52000-memory.dmp

Filesize
72KB

Download
memory/4536-837-0x000000001C000000-0x000000001C4CE000-memory.dmp

Filesize
4.8MB

Download
memory/4536-838-0x000000001C570000-0x000000001C60C000-memory.dmp

Filesize
624KB

Download
memory/4536-841-0x0000000001600000-0x0000000001608000-memory.dmp

Filesize
32KB

Download
memory/4536-843-0x000000001BB10000-0x000000001BB18000-memory.dmp

Filesize
32KB

Download
memory/4628-797-0x00000000066E0000-0x0000000006756000-memory.dmp

Filesize
472KB

Download
memory/4628-798-0x00000000066C0000-0x00000000066DE000-memory.dmp

Filesize
120KB

Download
memory/4628-701-0x0000000006A80000-0x0000000006AFE000-memory.dmp

Filesize
504KB

Download
memory/4628-697-0x0000000000AC0000-0x0000000000AD4000-memory.dmp

Filesize
80KB

Download
memory/4832-685-0x00000000055C0000-0x0000000005616000-memory.dmp

Filesize
344KB

Download
memory/4832-684-0x00000000052E0000-0x00000000052EA000-memory.dmp

Filesize
40KB

Download
memory/4832-682-0x00000000058F0000-0x0000000005E94000-memory.dmp

Filesize
5.6MB

Download
memory/4832-683-0x00000000053E0000-0x0000000005472000-memory.dmp

Filesize
584KB

Download
memory/4832-680-0x00000000009A0000-0x00000000009DA000-memory.dmp

Filesize
232KB

Download
memory/4832-681-0x0000000005200000-0x000000000529C000-memory.dmp

Filesize
624KB

Download
memory/5196-874-0x000000006E020000-0x000000006E06C000-memory.dmp

Filesize
304KB

Download
memory/5196-885-0x00000000072A0000-0x0000000007343000-memory.dmp

Filesize
652KB

Download
memory/5196-886-0x00000000075F0000-0x0000000007601000-memory.dmp

Filesize
68KB

Download
memory/5196-887-0x0000000007630000-0x0000000007644000-memory.dmp

Filesize
80KB

Download