File name:

all_files.txt

Full analysis: https://app.any.run/tasks/c7386ba9-4396-4406-a89a-d5ade0eaa8c0
Verdict: Malicious activity
Analysis date: March 25, 2025, 02:44:26
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/plain
File info: Unicode text, UTF-8 text
MD5:

AA3A1B6150F27DA642B66104D7409B7E

SHA1:

AFA25E71ADA92E922616B0CBE52211B442557902

SHA256:

6C319D7997173BB42BAD59EA9DD2257B98B09DF85B1E545BDC54D5A4B47440B3

SSDEEP:

49152:x8SkTEW94hboq+ozruqkdWWIhmMlKOmnLACZpB+KVQAGVTYAXnrRIsISf8IscHv+:B2BbGXE/EzXvDa+FeWNwHHXnDNAM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • vc_redist.x86.exe (PID: 2832)
      • vc_redist.x86.exe (PID: 3856)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • toolbox-2.1.81-win32.exe (PID: 268)
      • vc_redist.x86.exe (PID: 3856)

    • The process creates files with name similar to system file names

      • toolbox-2.1.81-win32.exe (PID: 268)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • toolbox-2.1.81-win32.exe (PID: 268)

    • Process drops legitimate windows executable

      • toolbox-2.1.81-win32.exe (PID: 268)
      • vc_redist.x86.exe (PID: 3856)

    • Application launched itself

      • vc_redist.x86.exe (PID: 2832)

    • There is functionality for taking screenshot (YARA)

      • toolbox-2.1.81-win32.exe (PID: 268)

    • Process drops python dynamic module

      • toolbox-2.1.81-win32.exe (PID: 268)

    • Searches for installed software

      • vc_redist.x86.exe (PID: 3856)

  • INFO

    • Manual execution by a user

      • toolbox-2.1.81-win32.exe (PID: 2276)
      • toolbox-2.1.81-win32.exe (PID: 268)

    • Reads the computer name

      • toolbox-2.1.81-win32.exe (PID: 268)
      • vc_redist.x86.exe (PID: 3856)
      • vc_redist.x86.exe (PID: 2832)

    • Checks supported languages

      • toolbox-2.1.81-win32.exe (PID: 268)
      • vc_redist.x86.exe (PID: 2832)
      • vc_redist.x86.exe (PID: 3856)

    • Create files in a temporary directory

      • toolbox-2.1.81-win32.exe (PID: 268)
      • vc_redist.x86.exe (PID: 3856)

    • Creates files in the program directory

      • toolbox-2.1.81-win32.exe (PID: 268)

    • The sample compiled with english language support

      • toolbox-2.1.81-win32.exe (PID: 268)
      • vc_redist.x86.exe (PID: 3856)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
5
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start notepad.exe no specs toolbox-2.1.81-win32.exe no specs toolbox-2.1.81-win32.exe vc_redist.x86.exe no specs vc_redist.x86.exe

Process information

PID
CMD
Path
Indicators
Parent process
268"C:\Users\admin\Desktop\toolbox-2.1.81-win32.exe" C:\Users\admin\Desktop\toolbox-2.1.81-win32.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\toolbox-2.1.81-win32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2276"C:\Users\admin\Desktop\toolbox-2.1.81-win32.exe" C:\Users\admin\Desktop\toolbox-2.1.81-win32.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\toolbox-2.1.81-win32.exe
c:\windows\system32\ntdll.dll
2736"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\all_files.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2832"C:\Program Files (x86)\Tesla\Toolbox\vc_redist.x86.exe" /passive /norestartC:\Program Files (x86)\Tesla\Toolbox\vc_redist.x86.exe—toolbox-2.1.81-win32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215
Exit code:
1638
Version:
14.0.24215.1
Modules
Images
c:\program files (x86)\tesla\toolbox\vc_redist.x86.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24542_none_5c0717c7a00ddc6d\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3856"C:\Program Files (x86)\Tesla\Toolbox\vc_redist.x86.exe" /passive /norestart -burn.unelevated BurnPipe.{730BE876-03E2-44FA-BE66-598C8F72B873} {706B9CA7-D9B3-4734-BE17-0E0546F99FE3} 2832C:\Program Files (x86)\Tesla\Toolbox\vc_redist.x86.exe
vc_redist.x86.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215
Exit code:
1638
Version:
14.0.24215.1
Modules
Images
c:\program files (x86)\tesla\toolbox\vc_redist.x86.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24542_none_5c0717c7a00ddc6d\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
1 209
Read events
1 209
Write events
0
Delete events
0

Modification events

No data
Executable files
130
Suspicious files
0
Text files
744
Unknown types
0

Dropped files

PID
Process
Filename
Type
268toolbox-2.1.81-win32.exeC:\Users\admin\AppData\Local\Temp\nsl757A.tmp\nsDialogs.dllexecutable
MD5:C10E04DD4AD4277D5ADC951BB331C777
SHA256:E31AD6C6E82E603378CB6B80E67D0E0DCD9CF384E1199AC5A65CB4935680021A
268toolbox-2.1.81-win32.exeC:\Users\admin\AppData\Local\Temp\nsl757A.tmp\System.dllexecutable
MD5:C17103AE9072A06DA581DEC998343FC1
SHA256:DC58D8AD81CACB0C1ED72E33BFF8F23EA40B5252B5BB55D393A0903E6819AE2F
268toolbox-2.1.81-win32.exeC:\Users\admin\AppData\Local\Temp\nsl757A.tmp\modern-wizard.bmpimage
MD5:70E067D8627BDCF11EED2F984308A912
SHA256:40C0C9CF5765F114398A48CA12271C7148FAC6E0D1F0BA912963C4279C0E84D6
268toolbox-2.1.81-win32.exeC:\Users\admin\AppData\Local\Temp\nsl757A.tmp\StartMenu.dllexecutable
MD5:A4173B381625F9F12AADB4E1CDAEFDB8
SHA256:7755FF2707CA19344D489A5ACEC02D9E310425FA6E100D2F13025761676B875B
3856vc_redist.x86.exeC:\Users\admin\AppData\Local\Temp\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1042\license.rtftext
MD5:D66807A2D5E059061BF3C8CF60238C3C
SHA256:503C25737668D3234B6E7BFFFE664A657868E57D93E65400930E460FEF13472B
3856vc_redist.x86.exeC:\Users\admin\AppData\Local\Temp\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1029\license.rtftext
MD5:F2D8C94464B459E9EB907C3FEB941A9C
SHA256:F2DB4BF289198917EC1CF8FBC8B65A91A96C76EDEF46476CEE4F9E88FF8B9936
3856vc_redist.x86.exeC:\Users\admin\AppData\Local\Temp\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1028\license.rtftext
MD5:D4A9B6D1DBAD45982B85F3B296D60117
SHA256:9AB1E570F8D1257094B0A933017669D68FAC393615588DF909157125291A4DA8
268toolbox-2.1.81-win32.exeC:\Program Files (x86)\Tesla\Toolbox\vc_redist.x86.exeexecutable
MD5:A3CB49DAA1347FFE34B517F1A12F40AB
SHA256:12A69AF8623D70026690BA14139BF3793CC76C865759CAD301B207C1793063ED
3856vc_redist.x86.exeC:\Users\admin\AppData\Local\Temp\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\wixstdba.dllexecutable
MD5:4D20A950A3571D11236482754B4A8E76
SHA256:A9295AD4E909F979E2B6CB2B2495C3D35C8517E689CD64A918C690E17B49078B
3856vc_redist.x86.exeC:\Users\admin\AppData\Local\Temp\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1055\license.rtftext
MD5:51208B192D025522D69EDF7B5CABABDA
SHA256:E7067FE502D0A2CE51AF2F66A0CED1472D6702244E4C06479935BBC655DB4970
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.46
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
all_files.txt