File name:

ArboreaReborn_Launcher.zip

Full analysis: https://app.any.run/tasks/2011196d-aa2e-4420-8b99-9dc545f65b1e
Verdict: Malicious activity
Analysis date: June 02, 2025, 02:08:29
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-scr
arch-doc
arch-html
github
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

A8B99CE209A25C0ECED03CAA735E5D20

SHA1:

9A9D32AC48F1E2CFCA095A66ECEFF25FE13D1C2E

SHA256:

D8A7A2F5C0584E5CD5E3C541E4285BE77E6ADBC98297952C8B4C55AEFDCAB4B5

SSDEEP:

1572864:9EcErwMj/A8YrygMjj1XkJsFYcSiZMyvd92aO0wn:9EcEU6YGgMjj10JsFYcTJvd92Cwn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 2616)

    • Changes the autorun value in the registry

      • windowsdesktop-runtime-8.0.16-win-x64.exe (PID: 7544)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 2616)
      • windowsdesktop-runtime-8.0.16-win-x64.exe (PID: 7320)
      • windowsdesktop-runtime-8.0.16-win-x64.exe (PID: 872)
      • windowsdesktop-runtime-8.0.16-win-x64.exe (PID: 7544)
      • msiexec.exe (PID: 6384)
      • Arborea Reborn.exe (PID: 872)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 2616)
      • Arborea Reborn.exe (PID: 6840)
      • windowsdesktop-runtime-8.0.16-win-x64.exe (PID: 872)

    • Executable content was dropped or overwritten

      • windowsdesktop-runtime-8.0.16-win-x64.exe (PID: 7320)
      • windowsdesktop-runtime-8.0.16-win-x64.exe (PID: 872)
      • windowsdesktop-runtime-8.0.16-win-x64.exe (PID: 7544)
      • Arborea Reborn.exe (PID: 872)

    • Starts a Microsoft application from unusual location

      • windowsdesktop-runtime-8.0.16-win-x64.exe (PID: 872)
      • windowsdesktop-runtime-8.0.16-win-x64.exe (PID: 7544)

    • Starts itself from another location

      • windowsdesktop-runtime-8.0.16-win-x64.exe (PID: 872)

    • Creates a software uninstall entry

      • windowsdesktop-runtime-8.0.16-win-x64.exe (PID: 7544)

    • Searches for installed software

      • windowsdesktop-runtime-8.0.16-win-x64.exe (PID: 872)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 6384)

    • The process creates files with name similar to system file names

      • msiexec.exe (PID: 6384)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 6384)

    • Application launched itself

      • electron.exe (PID: 8184)

    • Starts CMD.EXE for commands execution

      • electron.exe (PID: 8184)

  • INFO

    • The sample compiled with english language support

      • WinRAR.exe (PID: 2616)
      • windowsdesktop-runtime-8.0.16-win-x64.exe (PID: 7320)
      • windowsdesktop-runtime-8.0.16-win-x64.exe (PID: 872)
      • windowsdesktop-runtime-8.0.16-win-x64.exe (PID: 7544)
      • msiexec.exe (PID: 6384)
      • Arborea Reborn.exe (PID: 872)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2616)
      • msedge.exe (PID: 7292)
      • msiexec.exe (PID: 6384)

    • Reads the computer name

      • Arborea Reborn.exe (PID: 6840)
      • identity_helper.exe (PID: 6676)
      • windowsdesktop-runtime-8.0.16-win-x64.exe (PID: 872)
      • windowsdesktop-runtime-8.0.16-win-x64.exe (PID: 7544)
      • msiexec.exe (PID: 6384)
      • msiexec.exe (PID: 6060)
      • msiexec.exe (PID: 6644)

    • Checks supported languages

      • Arborea Reborn.exe (PID: 6840)
      • identity_helper.exe (PID: 6676)
      • windowsdesktop-runtime-8.0.16-win-x64.exe (PID: 7320)
      • windowsdesktop-runtime-8.0.16-win-x64.exe (PID: 7544)
      • windowsdesktop-runtime-8.0.16-win-x64.exe (PID: 872)
      • msiexec.exe (PID: 6060)
      • msiexec.exe (PID: 6384)
      • msiexec.exe (PID: 6644)

    • Manual execution by a user

      • Arborea Reborn.exe (PID: 6840)
      • Arborea Reborn.exe (PID: 872)
      • TR.exe (PID: 5332)
      • TeraToolboxCLI.exe (PID: 6300)
      • TeraToolboxCLI.exe (PID: 7752)
      • TR.exe (PID: 6464)

    • Application launched itself

      • msedge.exe (PID: 7292)
      • msedge.exe (PID: 5072)

    • Reads Environment values

      • identity_helper.exe (PID: 6676)

    • Create files in a temporary directory

      • windowsdesktop-runtime-8.0.16-win-x64.exe (PID: 7320)
      • windowsdesktop-runtime-8.0.16-win-x64.exe (PID: 872)
      • windowsdesktop-runtime-8.0.16-win-x64.exe (PID: 7544)

    • Process checks computer location settings

      • windowsdesktop-runtime-8.0.16-win-x64.exe (PID: 872)

    • Creates files in the program directory

      • windowsdesktop-runtime-8.0.16-win-x64.exe (PID: 7544)

    • Launch of the file from Registry key

      • windowsdesktop-runtime-8.0.16-win-x64.exe (PID: 7544)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 6384)
      • windowsdesktop-runtime-8.0.16-win-x64.exe (PID: 7544)

    • Reads the software policy settings

      • msiexec.exe (PID: 6384)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 6384)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (36.3)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2025:05:28 12:04:30
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: launcher/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
208
Monitored processes
79
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe rundll32.exe no specs arborea reborn.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs slui.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs windowsdesktop-runtime-8.0.16-win-x64.exe windowsdesktop-runtime-8.0.16-win-x64.exe windowsdesktop-runtime-8.0.16-win-x64.exe msiexec.exe msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msiexec.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs arborea reborn.exe msedge.exe no specs msedge.exe no specs teratoolboxcli.exe no specs teratoolboxcli.exe msedge.exe no specs tr.exe no specs tr.exe electron.exe electron.exe no specs electron.exe no specs electron.exe no specs comppkgsrv.exe no specs cmd.exe no specs conhost.exe no specs fsutil.exe no specs electron.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
656"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5788 --field-trial-handle=2336,i,8163630410439165594,339357653131616177,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
872"C:\Users\admin\AppData\Local\Temp\{CE22AF7F-6322-474A-A134-9CD98ACF2C5D}\.cr\windowsdesktop-runtime-8.0.16-win-x64.exe" -burn.clean.room="C:\Users\admin\Downloads\windowsdesktop-runtime-8.0.16-win-x64.exe" -burn.filehandle.attached=576 -burn.filehandle.self=584 C:\Users\admin\AppData\Local\Temp\{CE22AF7F-6322-474A-A134-9CD98ACF2C5D}\.cr\windowsdesktop-runtime-8.0.16-win-x64.exe
windowsdesktop-runtime-8.0.16-win-x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Windows Desktop Runtime - 8.0.16 (x64)
Exit code:
0
Version:
8.0.16.34817
Modules
Images
c:\users\admin\appdata\local\temp\{ce22af7f-6322-474a-a134-9cd98acf2c5d}\.cr\windowsdesktop-runtime-8.0.16-win-x64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
872"C:\Users\admin\Desktop\New folder\launcher\Arborea Reborn.exe" C:\Users\admin\Desktop\New folder\launcher\Arborea Reborn.exe
explorer.exe
User:
admin
Company:
Arborea Reborn
Integrity Level:
MEDIUM
Description:
Arborea Reborn
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\new folder\launcher\arborea reborn.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
896"C:\Users\admin\Desktop\New folder\Toolbox\Binaries\node_modules\electron\dist\electron.exe" --type=renderer --autoplay-policy=no-user-gesture-required --js-flags=--use-strict --field-trial-handle=1612,4228171128583667842,1449240391158582893,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --app-path="C:\Users\admin\Desktop\New folder\Toolbox\Binaries\bin" --node-integration --no-sandbox --no-zygote --enable-remote-module --background-color=#292F33 --enable-websql --disable-electron-site-instance-overrides --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2336 /prefetch:1C:\Users\admin\Desktop\New folder\Toolbox\Binaries\node_modules\electron\dist\electron.exe—electron.exe
User:
admin
Company:
GitHub, Inc.
Integrity Level:
HIGH
Description:
Electron
Exit code:
0
Version:
11.0.5
Modules
Images
c:\users\admin\desktop\new folder\toolbox\binaries\node_modules\electron\dist\electron.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\users\admin\desktop\new folder\toolbox\binaries\node_modules\electron\dist\ffmpeg.dll
1056"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=2584 --field-trial-handle=2388,i,11952814265321236773,3677741760789427999,262144 --variations-seed-version /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1072"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=6116 --field-trial-handle=2336,i,8163630410439165594,339357653131616177,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1132"C:\Users\admin\Desktop\New folder\Toolbox\Binaries\node_modules\electron\dist\electron.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1612,4228171128583667842,1449240391158582893,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2100 /prefetch:8C:\Users\admin\Desktop\New folder\Toolbox\Binaries\node_modules\electron\dist\electron.exe—electron.exe
User:
admin
Company:
GitHub, Inc.
Integrity Level:
HIGH
Description:
Electron
Exit code:
0
Version:
11.0.5
Modules
Images
c:\users\admin\desktop\new folder\toolbox\binaries\node_modules\electron\dist\electron.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1324"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5216 --field-trial-handle=2336,i,8163630410439165594,339357653131616177,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1324"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=7148 --field-trial-handle=2336,i,8163630410439165594,339357653131616177,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1532"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5968 --field-trial-handle=2336,i,8163630410439165594,339357653131616177,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
Total events
27 580
Read events
26 576
Write events
929
Delete events
75

Modification events

(PID) Process:(2616) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(2616) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(2616) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2616) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\ArboreaReborn_Launcher.zip
(PID) Process:(2616) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2616) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2616) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2616) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2616) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
(PID) Process:(2616) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:size
Value:
80
Executable files
576
Suspicious files
375
Text files
149
Unknown types
2

Dropped files

PID
Process
Filename
Type
2616WinRAR.exeC:\Users\admin\Desktop\Toolbox\Binaries\node_modules\electron\dist\resources.pak —
MD5:—
SHA256:—
2616WinRAR.exeC:\Users\admin\Desktop\launcher\files.jsonbinary
MD5:BD587EAF521DD89B551F291745254A25
SHA256:840180F2FED909951B767BD56F229BF279F629E902ECF81585FD3F1595EF5F61
2616WinRAR.exeC:\Users\admin\Desktop\Toolbox\Binaries\TeraToolboxCLI.exeexecutable
MD5:970EBE0C8BDA615F4812F82D36DE6467
SHA256:AF4DD88CE3913BB595DDA072282CAC98E65075D576C8E68F3A42270C56EF74EB
2616WinRAR.exeC:\Users\admin\Desktop\Toolbox\manifest.jsonbinary
MD5:16FF1CCA9A97BCE15B33960B67F20AED
SHA256:8720A2F71555573E2727CF1223F86DCB7D7B50A665B8B641B4E5B1F0DCE806B0
2616WinRAR.exeC:\Users\admin\Desktop\Toolbox\Binaries\TeraToolboxCLI_NoAdmin.exeexecutable
MD5:20EE79A2091657F2FE57D02A37BF9AF8
SHA256:E4E9306F858B1AFB4A3A21DACDCB38DC0F33F8AE6DCCAAF106F3860FCACA0AC7
2616WinRAR.exeC:\Users\admin\Desktop\Toolbox\Binaries\package.jsonbinary
MD5:BDEB898781794A54F53AB97E9FFA8C3D
SHA256:8BC2FEE8538908FFC319367E89A321A25D3DEE05A7527042401397DA706B363D
2616WinRAR.exeC:\Users\admin\Desktop\Toolbox\Binaries\README.mdtext
MD5:29A8EE84BE2554E724945AD2307EF1AE
SHA256:1055EF89CFE60ED82DB72CCFF7185929EB1F25173F877FD4B97EC289D18E5AFE
2616WinRAR.exeC:\Users\admin\Desktop\Toolbox\Binaries\config.jsonbinary
MD5:7089D99E76C90E5974CFA1464A882DE2
SHA256:1118E466ABE43EA4F02D028C848823AE4FBE621C869690C09077012674B6B82B
2616WinRAR.exeC:\Users\admin\Desktop\launcher\Arborea Reborn.exeexecutable
MD5:8D1C5071FDBD7D3381AD0BDAA004430A
SHA256:B8CDE0F79ED548789C13632DBEE7DAF98076E5019501C5D46683CC7D8F91B86C
2616WinRAR.exeC:\Users\admin\Desktop\Toolbox\Binaries\node_modules\electron\dist\chrome_200_percent.pakbinary
MD5:57C27201E7CD33471DA7EC205FE9973C
SHA256:DD8146B2EE289E4D54A4A0F1FD3B2F61B979C6A2BAABA96A406D96C3F4FDB33B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
67
DNS requests
81
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3192
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3192
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7292
msedge.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7292
msedge.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
8076
RUXIMICS.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5496
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
40.126.31.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
google.com
  • 142.250.185.110
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
login.live.com
  • 40.126.31.0
  • 20.190.159.128
  • 20.190.159.130
  • 20.190.159.75
  • 40.126.31.131
  • 40.126.31.3
  • 40.126.31.2
  • 20.190.159.71
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ArboreaReborn_Launcher.zip