File name:

all_files.txt

Full analysis: https://app.any.run/tasks/c7386ba9-4396-4406-a89a-d5ade0eaa8c0
Verdict: Malicious activity
Analysis date: March 25, 2025, 02:44:26
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/plain
File info: Unicode text, UTF-8 text
MD5:

AA3A1B6150F27DA642B66104D7409B7E

SHA1:

AFA25E71ADA92E922616B0CBE52211B442557902

SHA256:

6C319D7997173BB42BAD59EA9DD2257B98B09DF85B1E545BDC54D5A4B47440B3

SSDEEP:

49152:x8SkTEW94hboq+ozruqkdWWIhmMlKOmnLACZpB+KVQAGVTYAXnrRIsISf8IscHv+:B2BbGXE/EzXvDa+FeWNwHHXnDNAM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • vc_redist.x86.exe (PID: 2832)
      • vc_redist.x86.exe (PID: 3856)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • toolbox-2.1.81-win32.exe (PID: 268)
      • vc_redist.x86.exe (PID: 3856)

    • The process creates files with name similar to system file names

      • toolbox-2.1.81-win32.exe (PID: 268)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • toolbox-2.1.81-win32.exe (PID: 268)

    • Application launched itself

      • vc_redist.x86.exe (PID: 2832)

    • Process drops legitimate windows executable

      • toolbox-2.1.81-win32.exe (PID: 268)
      • vc_redist.x86.exe (PID: 3856)

    • Process drops python dynamic module

      • toolbox-2.1.81-win32.exe (PID: 268)

    • There is functionality for taking screenshot (YARA)

      • toolbox-2.1.81-win32.exe (PID: 268)

    • Searches for installed software

      • vc_redist.x86.exe (PID: 3856)

  • INFO

    • Manual execution by a user

      • toolbox-2.1.81-win32.exe (PID: 2276)
      • toolbox-2.1.81-win32.exe (PID: 268)

    • Checks supported languages

      • toolbox-2.1.81-win32.exe (PID: 268)
      • vc_redist.x86.exe (PID: 2832)
      • vc_redist.x86.exe (PID: 3856)

    • Reads the computer name

      • toolbox-2.1.81-win32.exe (PID: 268)
      • vc_redist.x86.exe (PID: 2832)
      • vc_redist.x86.exe (PID: 3856)

    • Creates files in the program directory

      • toolbox-2.1.81-win32.exe (PID: 268)

    • Create files in a temporary directory

      • toolbox-2.1.81-win32.exe (PID: 268)
      • vc_redist.x86.exe (PID: 3856)

    • The sample compiled with english language support

      • toolbox-2.1.81-win32.exe (PID: 268)
      • vc_redist.x86.exe (PID: 3856)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
5
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start notepad.exe no specs toolbox-2.1.81-win32.exe no specs toolbox-2.1.81-win32.exe vc_redist.x86.exe no specs vc_redist.x86.exe

Process information

PID
CMD
Path
Indicators
Parent process
268"C:\Users\admin\Desktop\toolbox-2.1.81-win32.exe" C:\Users\admin\Desktop\toolbox-2.1.81-win32.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\toolbox-2.1.81-win32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2276"C:\Users\admin\Desktop\toolbox-2.1.81-win32.exe" C:\Users\admin\Desktop\toolbox-2.1.81-win32.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\toolbox-2.1.81-win32.exe
c:\windows\system32\ntdll.dll
2736"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\all_files.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2832"C:\Program Files (x86)\Tesla\Toolbox\vc_redist.x86.exe" /passive /norestartC:\Program Files (x86)\Tesla\Toolbox\vc_redist.x86.exe—toolbox-2.1.81-win32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215
Exit code:
1638
Version:
14.0.24215.1
Modules
Images
c:\program files (x86)\tesla\toolbox\vc_redist.x86.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24542_none_5c0717c7a00ddc6d\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3856"C:\Program Files (x86)\Tesla\Toolbox\vc_redist.x86.exe" /passive /norestart -burn.unelevated BurnPipe.{730BE876-03E2-44FA-BE66-598C8F72B873} {706B9CA7-D9B3-4734-BE17-0E0546F99FE3} 2832C:\Program Files (x86)\Tesla\Toolbox\vc_redist.x86.exe
vc_redist.x86.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215
Exit code:
1638
Version:
14.0.24215.1
Modules
Images
c:\program files (x86)\tesla\toolbox\vc_redist.x86.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24542_none_5c0717c7a00ddc6d\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
1 209
Read events
1 209
Write events
0
Delete events
0

Modification events

No data
Executable files
130
Suspicious files
0
Text files
744
Unknown types
0

Dropped files

PID
Process
Filename
Type
268toolbox-2.1.81-win32.exeC:\Users\admin\AppData\Local\Temp\nsl757A.tmp\nsDialogs.dllexecutable
MD5:C10E04DD4AD4277D5ADC951BB331C777
SHA256:E31AD6C6E82E603378CB6B80E67D0E0DCD9CF384E1199AC5A65CB4935680021A
268toolbox-2.1.81-win32.exeC:\Users\admin\AppData\Local\Temp\nsl757A.tmp\System.dllexecutable
MD5:C17103AE9072A06DA581DEC998343FC1
SHA256:DC58D8AD81CACB0C1ED72E33BFF8F23EA40B5252B5BB55D393A0903E6819AE2F
268toolbox-2.1.81-win32.exeC:\Program Files (x86)\Tesla\Toolbox\vc_redist.x86.exeexecutable
MD5:A3CB49DAA1347FFE34B517F1A12F40AB
SHA256:12A69AF8623D70026690BA14139BF3793CC76C865759CAD301B207C1793063ED
3856vc_redist.x86.exeC:\Users\admin\AppData\Local\Temp\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1029\license.rtftext
MD5:F2D8C94464B459E9EB907C3FEB941A9C
SHA256:F2DB4BF289198917EC1CF8FBC8B65A91A96C76EDEF46476CEE4F9E88FF8B9936
3856vc_redist.x86.exeC:\Users\admin\AppData\Local\Temp\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1031\license.rtftext
MD5:59E7C6E022B76B9906B13B324F7EC9B3
SHA256:243039F0FFE11EE032104E690EF61B2053F7369363D30BAFC430E96B6226EFFC
268toolbox-2.1.81-win32.exeC:\Users\admin\AppData\Local\Temp\nsl757A.tmp\StartMenu.dllexecutable
MD5:A4173B381625F9F12AADB4E1CDAEFDB8
SHA256:7755FF2707CA19344D489A5ACEC02D9E310425FA6E100D2F13025761676B875B
268toolbox-2.1.81-win32.exeC:\Users\admin\AppData\Local\Temp\nsl757A.tmp\modern-wizard.bmpimage
MD5:70E067D8627BDCF11EED2F984308A912
SHA256:40C0C9CF5765F114398A48CA12271C7148FAC6E0D1F0BA912963C4279C0E84D6
268toolbox-2.1.81-win32.exeC:\Users\admin\AppData\Local\Temp\nsl757A.tmp\modern-header.bmpimage
MD5:8586D654E04B1E58DE06527CF4ED8726
SHA256:8F39A98B4D5E87BF91A0B80BB6E9E21CC7C030DFB3689BEBEEB68878E33C6766
3856vc_redist.x86.exeC:\Users\admin\AppData\Local\Temp\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1028\license.rtftext
MD5:D4A9B6D1DBAD45982B85F3B296D60117
SHA256:9AB1E570F8D1257094B0A933017669D68FAC393615588DF909157125291A4DA8
3856vc_redist.x86.exeC:\Users\admin\AppData\Local\Temp\{e2803110-78b3-4664-a479-3611a381656a}\.ba1\1036\license.rtftext
MD5:B2425005ED1EC70689F598544842F760
SHA256:276DED59422B72402E7AEF6431628F705ABC465D14ED24AF2E53C22DDC86E35F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.46
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
all_files.txt