File name:

all_files.txt

Full analysis: https://app.any.run/tasks/453b1ab6-b51f-40e7-b5c2-53ac3d6b36c4
Verdict: Malicious activity
Analysis date: March 25, 2025, 02:47:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/plain
File info: Unicode text, UTF-8 text
MD5:

AA3A1B6150F27DA642B66104D7409B7E

SHA1:

AFA25E71ADA92E922616B0CBE52211B442557902

SHA256:

6C319D7997173BB42BAD59EA9DD2257B98B09DF85B1E545BDC54D5A4B47440B3

SSDEEP:

49152:x8SkTEW94hboq+ozruqkdWWIhmMlKOmnLACZpB+KVQAGVTYAXnrRIsISf8IscHv+:B2BbGXE/EzXvDa+FeWNwHHXnDNAM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • vc_redist.x86.exe (PID: 1888)
      • vc_redist.x86.exe (PID: 2612)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • toolbox-2.1.81-win32.exe (PID: 2592)

    • The process creates files with name similar to system file names

      • toolbox-2.1.81-win32.exe (PID: 2592)

    • Executable content was dropped or overwritten

      • vc_redist.x86.exe (PID: 1888)
      • toolbox-2.1.81-win32.exe (PID: 2592)

    • Application launched itself

      • vc_redist.x86.exe (PID: 2612)

    • Process drops legitimate windows executable

      • vc_redist.x86.exe (PID: 1888)
      • toolbox-2.1.81-win32.exe (PID: 2592)

    • Process drops python dynamic module

      • toolbox-2.1.81-win32.exe (PID: 2592)

    • There is functionality for taking screenshot (YARA)

      • toolbox-2.1.81-win32.exe (PID: 2592)

    • Searches for installed software

      • vc_redist.x86.exe (PID: 1888)

  • INFO

    • Manual execution by a user

      • toolbox-2.1.81-win32.exe (PID: 2592)
      • toolbox-2.1.81-win32.exe (PID: 1964)

    • Checks supported languages

      • vc_redist.x86.exe (PID: 2612)
      • vc_redist.x86.exe (PID: 1888)
      • toolbox-2.1.81-win32.exe (PID: 2592)

    • Reads the computer name

      • toolbox-2.1.81-win32.exe (PID: 2592)
      • vc_redist.x86.exe (PID: 2612)
      • vc_redist.x86.exe (PID: 1888)

    • Create files in a temporary directory

      • toolbox-2.1.81-win32.exe (PID: 2592)
      • vc_redist.x86.exe (PID: 1888)

    • The sample compiled with english language support

      • vc_redist.x86.exe (PID: 1888)
      • toolbox-2.1.81-win32.exe (PID: 2592)

    • Creates files in the program directory

      • toolbox-2.1.81-win32.exe (PID: 2592)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
5
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start notepad.exe no specs toolbox-2.1.81-win32.exe no specs toolbox-2.1.81-win32.exe vc_redist.x86.exe no specs vc_redist.x86.exe

Process information

PID
CMD
Path
Indicators
Parent process
1888"C:\Program Files (x86)\Tesla\Toolbox\vc_redist.x86.exe" /passive /norestart -burn.unelevated BurnPipe.{41139438-50EE-424E-B8A1-4659C4771077} {F53D871E-9B58-445F-B40F-4FE02F7BD26E} 2612C:\Program Files (x86)\Tesla\Toolbox\vc_redist.x86.exe
vc_redist.x86.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215
Exit code:
1638
Version:
14.0.24215.1
Modules
Images
c:\program files (x86)\tesla\toolbox\vc_redist.x86.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24542_none_5c0717c7a00ddc6d\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1964"C:\Users\admin\Desktop\toolbox-2.1.81-win32.exe" C:\Users\admin\Desktop\toolbox-2.1.81-win32.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\toolbox-2.1.81-win32.exe
c:\windows\system32\ntdll.dll
2592"C:\Users\admin\Desktop\toolbox-2.1.81-win32.exe" C:\Users\admin\Desktop\toolbox-2.1.81-win32.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\toolbox-2.1.81-win32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2612"C:\Program Files (x86)\Tesla\Toolbox\vc_redist.x86.exe" /passive /norestartC:\Program Files (x86)\Tesla\Toolbox\vc_redist.x86.exe—toolbox-2.1.81-win32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215
Exit code:
1638
Version:
14.0.24215.1
Modules
Images
c:\program files (x86)\tesla\toolbox\vc_redist.x86.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24542_none_5c0717c7a00ddc6d\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2736"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\all_files.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
1 265
Read events
1 261
Write events
4
Delete events
0

Modification events

(PID) Process:(2736) notepad.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Notepad
Operation:writeName:iWindowPosX
Value:
214
(PID) Process:(2736) notepad.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Notepad
Operation:writeName:iWindowPosY
Value:
140
(PID) Process:(2736) notepad.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Notepad
Operation:writeName:iWindowPosDX
Value:
960
(PID) Process:(2736) notepad.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Notepad
Operation:writeName:iWindowPosDY
Value:
501
Executable files
130
Suspicious files
2
Text files
897
Unknown types
0

Dropped files

PID
Process
Filename
Type
2592toolbox-2.1.81-win32.exeC:\Users\admin\AppData\Local\Temp\nsd628E.tmp\StartMenu.dllexecutable
MD5:A4173B381625F9F12AADB4E1CDAEFDB8
SHA256:7755FF2707CA19344D489A5ACEC02D9E310425FA6E100D2F13025761676B875B
1888vc_redist.x86.exeC:\Users\admin\AppData\Local\Temp\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1028\license.rtftext
MD5:D4A9B6D1DBAD45982B85F3B296D60117
SHA256:9AB1E570F8D1257094B0A933017669D68FAC393615588DF909157125291A4DA8
2592toolbox-2.1.81-win32.exeC:\Users\admin\AppData\Local\Temp\nsd628E.tmp\nsDialogs.dllexecutable
MD5:C10E04DD4AD4277D5ADC951BB331C777
SHA256:E31AD6C6E82E603378CB6B80E67D0E0DCD9CF384E1199AC5A65CB4935680021A
2592toolbox-2.1.81-win32.exeC:\Users\admin\AppData\Local\Temp\nsd628E.tmp\modern-wizard.bmpimage
MD5:70E067D8627BDCF11EED2F984308A912
SHA256:40C0C9CF5765F114398A48CA12271C7148FAC6E0D1F0BA912963C4279C0E84D6
1888vc_redist.x86.exeC:\Users\admin\AppData\Local\Temp\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1036\license.rtftext
MD5:B2425005ED1EC70689F598544842F760
SHA256:276DED59422B72402E7AEF6431628F705ABC465D14ED24AF2E53C22DDC86E35F
2592toolbox-2.1.81-win32.exeC:\Program Files (x86)\Tesla\Toolbox\vc_redist.x86.exeexecutable
MD5:A3CB49DAA1347FFE34B517F1A12F40AB
SHA256:12A69AF8623D70026690BA14139BF3793CC76C865759CAD301B207C1793063ED
1888vc_redist.x86.exeC:\Users\admin\AppData\Local\Temp\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1029\license.rtftext
MD5:F2D8C94464B459E9EB907C3FEB941A9C
SHA256:F2DB4BF289198917EC1CF8FBC8B65A91A96C76EDEF46476CEE4F9E88FF8B9936
2592toolbox-2.1.81-win32.exeC:\Users\admin\AppData\Local\Temp\nsd628E.tmp\System.dllexecutable
MD5:C17103AE9072A06DA581DEC998343FC1
SHA256:DC58D8AD81CACB0C1ED72E33BFF8F23EA40B5252B5BB55D393A0903E6819AE2F
2592toolbox-2.1.81-win32.exeC:\Users\admin\AppData\Local\Temp\nsd628E.tmp\modern-header.bmpimage
MD5:8586D654E04B1E58DE06527CF4ED8726
SHA256:8F39A98B4D5E87BF91A0B80BB6E9E21CC7C030DFB3689BEBEEB68878E33C6766
1888vc_redist.x86.exeC:\Users\admin\AppData\Local\Temp\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\wixstdba.dllexecutable
MD5:4D20A950A3571D11236482754B4A8E76
SHA256:A9295AD4E909F979E2B6CB2B2495C3D35C8517E689CD64A918C690E17B49078B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.174
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
all_files.txt