File name:

11 FBI Tools.rar

Full analysis: https://app.any.run/tasks/05c2563f-a98a-452e-9149-06e17dc91df2
Verdict: Malicious activity
Analysis date: July 28, 2020, 23:21:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

9001B4A355E92C251788856E195B1354

SHA1:

6CD5D32B9B835F681AE1B2CD48DCB1C9454CBD37

SHA256:

CCB375E84FC672486EA55AAADF7A33988C57845CE9AC23443D9E3F01D6C5CBA3

SSDEEP:

196608:80mEn7Z5RyAe2t1aLzXxVpKMCmaIPMgUsrxrg:8FwZ5rf1qLcZ3SZg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • Historian.exe (PID: 1112)
      • SearchProtocolHost.exe (PID: 3568)
      • NetworkMiner.exe (PID: 3660)
      • rip.exe (PID: 3212)

    • Application was dropped or rewritten from another process

      • Historian.exe (PID: 1112)
      • ADSLocator.exe (PID: 2252)
      • WFA.exe (PID: 3652)
      • usbHistory.exe (PID: 2912)
      • BIOS.exe (PID: 2912)
      • NetworkMiner.exe (PID: 3660)
      • MUICacheView.exe (PID: 2044)
      • adsdir.exe (PID: 2508)
      • OSWin.exe (PID: 4000)
      • rip.exe (PID: 3212)
      • AutoRun.exe (PID: 2824)
      • CPU.exe (PID: 1072)

  • SUSPICIOUS

    • Changes IE settings (feature browser emulation)

      • AcroRd32.exe (PID: 3844)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2416)

    • Creates executable files which already exist in Windows

      • WinRAR.exe (PID: 2416)

  • INFO

    • Manual execution by user

      • adsdir.exe (PID: 2508)
      • WFA.exe (PID: 3652)
      • NetworkMiner.exe (PID: 3660)
      • ADSLocator.exe (PID: 2252)
      • BIOS.exe (PID: 2912)
      • usbHistory.exe (PID: 2912)
      • CPU.exe (PID: 1072)
      • AcroRd32.exe (PID: 3844)
      • MUICacheView.exe (PID: 2044)
      • Historian.exe (PID: 1112)
      • cmd.exe (PID: 2492)
      • AutoRun.exe (PID: 2824)
      • OSWin.exe (PID: 4000)
      • taskmgr.exe (PID: 3248)

    • Application launched itself

      • AcroRd32.exe (PID: 3844)
      • RdrCEF.exe (PID: 3096)

    • Reads the hosts file

      • RdrCEF.exe (PID: 3096)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
71
Monitored processes
21
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe adsdir.exe no specs adslocator.exe taskmgr.exe no specs historian.exe no specs muicacheview.exe no specs networkminer.exe no specs wfa.exe no specs searchprotocolhost.exe no specs acrord32.exe no specs acrord32.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs usbhistory.exe no specs bios.exe no specs cpu.exe no specs autorun.exe no specs oswin.exe no specs cmd.exe no specs rip.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
648"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer "C:\Users\admin\Desktop\11 FBI Tools\windows file analyzer 1.0\WFA Guidance.pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe—AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe Acrobat Reader DC
Exit code:
1
Version:
15.23.20070.215641
Modules
Images
c:\program files\adobe\acrobat reader dc\reader\acrord32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1072"C:\Users\admin\Desktop\11 FBI Tools\systemreport 2.5\CPU.exe" C:\Users\admin\Desktop\11 FBI Tools\systemreport 2.5\CPU.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\11 fbi tools\systemreport 2.5\cpu.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1112"C:\Users\admin\Desktop\11 FBI Tools\historian 1.4\Historian.exe" C:\Users\admin\Desktop\11 FBI Tools\historian 1.4\Historian.exe—explorer.exe
User:
admin
Company:
Werner Rumpeltesz
Integrity Level:
MEDIUM
Description:
Historian
Exit code:
0
Version:
1.4.1.0
Modules
Images
c:\users\admin\desktop\11 fbi tools\historian 1.4\historian.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2044"C:\Users\admin\Desktop\11 FBI Tools\mui cacheview 1.00\MUICacheView.exe" C:\Users\admin\Desktop\11 FBI Tools\mui cacheview 1.00\MUICacheView.exe—explorer.exe
User:
admin
Company:
NirSoft
Integrity Level:
MEDIUM
Description:
MUICacheView
Exit code:
0
Version:
1.00
Modules
Images
c:\users\admin\desktop\11 fbi tools\mui cacheview 1.00\muicacheview.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
2252"C:\Users\admin\Desktop\11 FBI Tools\ads locator 2004\ADSLocator.exe" C:\Users\admin\Desktop\11 FBI Tools\ads locator 2004\ADSLocator.exe
explorer.exe
User:
admin
Company:
Safer Networking Limited
Integrity Level:
MEDIUM
Description:
ADS alternate streams locator
Exit code:
1
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\11 fbi tools\ads locator 2004\adslocator.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2416"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\11 FBI Tools.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2492cmd /c ""C:\Users\admin\Desktop\11 FBI Tools\regripper 2.02\ua.bat" "C:\Windows\system32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2508"C:\Users\admin\Desktop\11 FBI Tools\ads locator 2004\adsdir.exe" C:\Users\admin\Desktop\11 FBI Tools\ads locator 2004\adsdir.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\11 fbi tools\ads locator 2004\adsdir.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2824"C:\Users\admin\Desktop\11 FBI Tools\systemreport 2.5\AutoRun.exe" C:\Users\admin\Desktop\11 FBI Tools\systemreport 2.5\AutoRun.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\11 fbi tools\systemreport 2.5\autorun.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2912"C:\Users\admin\Desktop\11 FBI Tools\usb-history r1\usbHistory.exe" C:\Users\admin\Desktop\11 FBI Tools\usb-history r1\usbHistory.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\11 fbi tools\usb-history r1\usbhistory.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
1 569
Read events
1 391
Write events
178
Delete events
0

Modification events

(PID) Process:(2416) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2416) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2416) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\132\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2416) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\11 FBI Tools.rar
(PID) Process:(2416) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2416) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2416) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2416) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2416) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\132\52C64B7E
Operation:writeName:@C:\Windows\System32\ieframe.dll,-10046
Value:
Internet Shortcut
(PID) Process:(2416) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
41
Suspicious files
5
Text files
240
Unknown types
8

Dropped files

PID
Process
Filename
Type
2416WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2416.32922\11 FBI Tools\1,200,000 proxie list\1,200,000 Proxies.txt —
MD5:—
SHA256:—
2416WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2416.32922\11 FBI Tools\ads locator 2004\adsdir.exeexecutable
MD5:1527FE92170874E5EEEB28F448A15725
SHA256:B773A0103F6DD7BF3C10885E11A5B1C6A5ADB04BFE6D6A6B2BE8A2B7BB07C07E
2416WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2416.32922\11 FBI Tools\ads locator 2004\ADSLocator.exeexecutable
MD5:C0912DE9D1E8E983DFC912C1501BE245
SHA256:03285ACFD2A1F2420C07DF58CA3739E8CA0AA7A7C2046E7CC8CA125EDBDF53FC
2416WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2416.32922\11 FBI Tools\historian 1.4\Historian.initext
MD5:D4C5C4298A44936244ECA6A1F4F294A7
SHA256:3D0F577EB6495908911AFBFB90355A7EA154C7D047FEF4DBFC5C68ABB02E16F6
2416WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2416.32922\11 FBI Tools\historian 1.4\Language\English_Templates\CSV table (semicolon)\GCHist.formattext
MD5:F55F3ECB74ABD63B1DC0765570FEA59A
SHA256:E7365132C8B7CADCA471028F446803FDB39D49D596054D518FEBC2EC79BBFF22
2416WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2416.32922\11 FBI Tools\historian 1.4\Language\English_Templates\CSV table (semicolon)\GCFav.formattext
MD5:B1621E525E358118EC83E1927B6B3650
SHA256:2E9676E48BFC82F8DA2381957F459697A1F138984F3AC1787F6584301865DFBE
2416WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2416.32922\11 FBI Tools\historian 1.4\Language\English.lngtext
MD5:FC2B455F931080CB86F5512FE8F4D5AB
SHA256:C33CF8E7A4F5AB7C8FB72A2887DC619D239059B8749F562B976D28CC3713923C
2416WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2416.32922\11 FBI Tools\historian 1.4\Language\English_Templates\CSV table (semicolon)\IECookie.formattext
MD5:ED4C2A306D16DC116D9BA092DDE43452
SHA256:1429E7F48E95BA0E783F67D693109AEE338E925BE3DC26B34116D76D58E95088
2416WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2416.32922\11 FBI Tools\disk investigator 1.4.exeexecutable
MD5:F0D956C8CF5DCC5B4416092E408E4909
SHA256:510FBDB0F5B510489E1426360861FA7765894E50C5870C4BD291D8026FCDADB2
2416WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2416.32922\11 FBI Tools\historian 1.4\Language\English_Templates\CSV table (semicolon)\GCDown.formattext
MD5:F825FA8908B42EC34166235588FF2984
SHA256:588703A8FD7BC3E98FD686D4519A3381F00ABD9DE796C968DB5803CE74E1E24C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
Process
Message
ADSLocator.exe
Initialization: pkMisc
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
11 FBI Tools.rar