File name:

Joker Combo Leecher [v1.0] [Craxpro.io - Crax.Tube].rar

Full analysis: https://app.any.run/tasks/a294d89b-65b4-4407-b9c6-f39af79eb572
Verdict: Malicious activity
Analysis date: April 18, 2025, 14:37:45
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
arch-doc
confuser
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

C82B578A3446BF9598DE1DF38FDC3E08

SHA1:

622D584FF670696EAD8934806C2329CD559000EB

SHA256:

963D7772ADE747D6FBC4CC887C7920B47F7A16A37B5E264D02B3FAF8B6AE3462

SSDEEP:

49152:Al+c6ybDHJ6pYNfdK5K+g2ECecE8mk7/LmDCUUgR9ulLM6RF5Jorzlevatht4mix:43H0pKugHN8T7/LkCUUgR9uBMworzQvF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 5024)

    • Changes Windows Defender settings

      • Launcher.exe (PID: 7752)

    • Adds path to the Windows Defender exclusion list

      • Launcher.exe (PID: 7752)

    • Create files in the Startup directory

      • Launcher.exe (PID: 7752)

    • Changes the autorun value in the registry

      • Launcher.exe (PID: 7752)

  • SUSPICIOUS

    • Write to the desktop.ini file (may be used to cloak folders)

      • WinRAR.exe (PID: 5024)

    • Reads security settings of Internet Explorer

      • Joker Combo Leecher [v1.0].exe (PID: 7636)
      • WinRAR.exe (PID: 5024)
      • Launcher.exe (PID: 7752)
      • Windows Services.exe (PID: 8024)
      • S3rq.exe (PID: 7920)

    • Starts POWERSHELL.EXE for commands execution

      • Launcher.exe (PID: 7752)

    • Script adds exclusion path to Windows Defender

      • Launcher.exe (PID: 7752)

    • Executable content was dropped or overwritten

      • S3rq.exe (PID: 7920)
      • Launcher.exe (PID: 7752)

    • The process creates files with name similar to system file names

      • Launcher.exe (PID: 7752)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5024)

    • Checks supported languages

      • Launcher.exe (PID: 7752)
      • Joker Combo Leecher [v1.0].exe (PID: 7636)
      • S3rq.exe (PID: 7920)
      • Secure System Shell.exe (PID: 8096)
      • Windows Services.exe (PID: 8024)
      • Runtime Explorer.exe (PID: 8108)

    • Reads the computer name

      • Launcher.exe (PID: 7752)
      • Joker Combo Leecher [v1.0].exe (PID: 7636)
      • S3rq.exe (PID: 7920)
      • Windows Services.exe (PID: 8024)
      • Secure System Shell.exe (PID: 8096)
      • Runtime Explorer.exe (PID: 8108)

    • Process checks computer location settings

      • Joker Combo Leecher [v1.0].exe (PID: 7636)
      • Launcher.exe (PID: 7752)
      • Windows Services.exe (PID: 8024)

    • Reads the machine GUID from the registry

      • Joker Combo Leecher [v1.0].exe (PID: 7636)
      • Launcher.exe (PID: 7752)
      • Windows Services.exe (PID: 8024)
      • S3rq.exe (PID: 7920)
      • Secure System Shell.exe (PID: 8096)

    • Creates files or folders in the user directory

      • S3rq.exe (PID: 7920)
      • Launcher.exe (PID: 7752)

    • The sample compiled with english language support

      • S3rq.exe (PID: 7920)
      • Launcher.exe (PID: 7752)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7812)

    • Confuser has been detected (YARA)

      • S3rq.exe (PID: 7920)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7812)

    • Create files in a temporary directory

      • Runtime Explorer.exe (PID: 8108)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
CompressedSize: 277254
UncompressedSize: 492032
OperatingSystem: Win32
ArchivedFileName: Joker Combo Leecher [v1.0]/Data/Ionic.Zip.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
11
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe no specs joker combo leecher [v1.0].exe no specs launcher.exe powershell.exe no specs conhost.exe no specs s3rq.exe windows services.exe no specs secure system shell.exe no specs runtime explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
5024"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Joker Combo Leecher [v1.0] [Craxpro.io - Crax.Tube].rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7228C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7260"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7636"C:\Users\admin\AppData\Local\Temp\Rar$EXa5024.38818\Joker Combo Leecher [v1.0]\Joker Combo Leecher [v1.0].exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa5024.38818\Joker Combo Leecher [v1.0]\Joker Combo Leecher [v1.0].exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Launcher
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa5024.38818\joker combo leecher [v1.0]\joker combo leecher [v1.0].exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
7752"C:\Users\admin\AppData\Local\Temp\Rar$EXa5024.38818\Joker Combo Leecher [v1.0]\Data\Launcher.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa5024.38818\Joker Combo Leecher [v1.0]\Data\Launcher.exe
Joker Combo Leecher [v1.0].exe
User:
admin
Integrity Level:
HIGH
Description:
Launcher
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa5024.38818\joker combo leecher [v1.0]\data\launcher.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
7812"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath C:\Windows\IMF\C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—Launcher.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7820\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7920"C:\Users\admin\AppData\Local\Temp\Rar$EXa5024.38818\Joker Combo Leecher [v1.0]\Data\S3rq.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa5024.38818\Joker Combo Leecher [v1.0]\Data\S3rq.exe
Joker Combo Leecher [v1.0].exe
User:
admin
Integrity Level:
HIGH
Description:
Joker Combo Leecher [v1.0]
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa5024.38818\joker combo leecher [v1.0]\data\s3rq.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
8024"C:\Windows\IMF\Windows Services.exe" {Arguments If Needed}C:\Windows\IMF\Windows Services.exe—Launcher.exe
User:
admin
Integrity Level:
HIGH
Description:
Windows Services
Version:
1.0.0.0
Modules
Images
c:\windows\imf\windows services.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
8096"C:\Windows\IMF\Secure System Shell.exe" C:\Windows\IMF\Secure System Shell.exe—Windows Services.exe
User:
admin
Integrity Level:
HIGH
Description:
Secure System Shell
Version:
1.0.0.0
Modules
Images
c:\windows\imf\secure system shell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
17 166
Read events
17 071
Write events
89
Delete events
6

Modification events

(PID) Process:(5024) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(5024) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5024) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(5024) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Joker Combo Leecher [v1.0] [Craxpro.io - Crax.Tube].rar
(PID) Process:(5024) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5024) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5024) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5024) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7752) Launcher.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Runtime Explorer
Value:
C:\Windows\IMF\\Windows Services.exe
(PID) Process:(7920) S3rq.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:NodeSlots
Value:
02020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202
Executable files
18
Suspicious files
5
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
5024WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5024.38818\Joker Combo Leecher [v1.0]\Data\Launcher.exeexecutable
MD5:C6D4C881112022EB30725978ECD7C6EC
SHA256:0D87B9B141A592711C52E7409EC64DE3AB296CDDC890BE761D9AF57CEA381B32
5024WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5024.38818\Joker Combo Leecher [v1.0]\Joker Combo Leecher [v1.0].exeexecutable
MD5:36E21928FC8F108963896F8D499C38F3
SHA256:10AA1F23F3FDA64011F85BFCBA9B08F583E9453DA26706ADD794A682E808B138
5024WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5024.38818\Joker Combo Leecher [v1.0]\Data\Leaf.Net.dllexecutable
MD5:C98DE72CD4374C4210EB5C0102E1C2AF
SHA256:77EBB46EB03ACE07790B535020DBD1170C5C5EEFC249F55FE27C9F19561BEB8B
5024WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5024.38818\Joker Combo Leecher [v1.0]\Data\Ionic.Zip.dllexecutable
MD5:F6933BF7CEE0FD6C80CDF207FF15A523
SHA256:17BB0C9BE45289A2BE56A5F5A68EC9891D7792B886E0054BC86D57FE84D01C89
5024WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5024.38818\Joker Combo Leecher [v1.0]\Leaf.Net.dllexecutable
MD5:C98DE72CD4374C4210EB5C0102E1C2AF
SHA256:77EBB46EB03ACE07790B535020DBD1170C5C5EEFC249F55FE27C9F19561BEB8B
5024WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5024.38818\Joker Combo Leecher [v1.0]\SkinSoft.VisualStyler.dllexecutable
MD5:60AC512E63A6B95EB37CFD530A01B94E
SHA256:9F3E7EA22D052FEE0E5BE8CD904AC4425F3840DF7452C760D5CC5357830C394E
5024WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5024.38818\Joker Combo Leecher [v1.0]\Data\LICENCE.datcompressed
MD5:F3014A18051F4E596AB95DA9138F6F6B
SHA256:1F84A00808D5ECA122FDE7F20708F272C349FAE1EAA1129B5C694750F2E047D6
7752Launcher.exeC:\Windows\IMF\LICENCE.zipcompressed
MD5:F3014A18051F4E596AB95DA9138F6F6B
SHA256:1F84A00808D5ECA122FDE7F20708F272C349FAE1EAA1129B5C694750F2E047D6
5024WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5024.38818\Joker Combo Leecher [v1.0]\Data\S3rq.exeexecutable
MD5:701E25F568E9631167DB0FB82544E854
SHA256:2ED107ED07EC8CAAF5487CEF98BB562C586B85F7E235984844C706A407F6514F
7920S3rq.exeC:\Users\admin\Documents\urs.txt —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
18
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.22:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.22:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1088
SIHClient.exe
GET
200
23.59.18.102:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1088
SIHClient.exe
GET
200
23.59.18.102:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.22:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.22:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.136:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1088
SIHClient.exe
172.202.163.200:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.206
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.216.77.22
  • 23.216.77.32
  • 23.216.77.39
  • 23.216.77.30
  • 23.216.77.21
  • 23.216.77.29
  • 23.216.77.6
  • 23.216.77.7
  • 23.216.77.28
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.32.136
  • 40.126.32.140
  • 40.126.32.134
  • 20.190.160.67
  • 40.126.32.133
  • 20.190.160.14
  • 20.190.160.65
  • 20.190.160.22
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
www.microsoft.com
  • 23.59.18.102
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Joker Combo Leecher [v1.0] [Craxpro.io - Crax.Tube].rar