download:

/downloads/rookie/rookie_2.32_portable.zip

Full analysis: https://app.any.run/tasks/1a913e9c-75ae-4adf-b6d8-a654b825492e
Verdict: Malicious activity
Analysis date: January 27, 2025, 06:06:04
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
arch-scr
github
arch-doc
rclone
tool
antivm
golang
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

BBFC3B69AAFDC0DC459DDCAB949EE998

SHA1:

96F26DEDB42C4D1EA582FF544D35FF54EE24E61A

SHA256:

FB79B00054E8ED1FB900C114E9E0610D3DA5B98AABF026771FA99352EDED9201

SSDEEP:

49152:aBY/MytD2RiE6oRtZDdKgviNWUxcA0fYilCaU9Rkdxli6txH+3KVKvnlokLge568:aBY0C2vddXvK0EaARkdpuBvnqcnLGLJk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6584)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • AndroidSideloader.exe (PID: 128)
      • AndroidSideloader.exe (PID: 6748)
      • Sideloader Launcher.exe (PID: 5200)
      • AndroidSideloader.exe (PID: 3584)

    • Executable content was dropped or overwritten

      • AndroidSideloader.exe (PID: 128)
      • 7z.exe (PID: 4400)

    • Drops 7-zip archiver for unpacking

      • AndroidSideloader.exe (PID: 128)

    • RCLONE has been detected

      • rclone.exe (PID: 6860)
      • rclone.exe (PID: 7104)
      • rclone.exe (PID: 1304)
      • rclone.exe (PID: 4592)
      • rclone.exe (PID: 4668)
      • rclone.exe (PID: 5036)
      • rclone.exe (PID: 1520)

    • Application launched itself

      • adb.exe (PID: 3620)
      • adb.exe (PID: 1344)
      • adb.exe (PID: 6060)

    • There is functionality for VM detection antiVM strings (YARA)

      • rclone.exe (PID: 1304)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6584)

    • Reads the computer name

      • AndroidSideloader.exe (PID: 128)
      • 7z.exe (PID: 4400)
      • adb.exe (PID: 6792)
      • rclone.exe (PID: 6860)
      • rclone.exe (PID: 7104)
      • 7z.exe (PID: 4672)
      • 7z.exe (PID: 2736)
      • rclone.exe (PID: 1304)
      • 7z.exe (PID: 6244)
      • AndroidSideloader.exe (PID: 6748)
      • rclone.exe (PID: 4592)
      • rclone.exe (PID: 4668)
      • adb.exe (PID: 4076)
      • AndroidSideloader.exe (PID: 3584)
      • adb.exe (PID: 6924)
      • 7z.exe (PID: 936)
      • Sideloader Launcher.exe (PID: 5200)
      • rclone.exe (PID: 1520)
      • rclone.exe (PID: 5036)
      • 7z.exe (PID: 2728)

    • Disables trace logs

      • AndroidSideloader.exe (PID: 128)
      • AndroidSideloader.exe (PID: 6748)
      • AndroidSideloader.exe (PID: 3584)

    • Checks proxy server information

      • AndroidSideloader.exe (PID: 128)
      • AndroidSideloader.exe (PID: 6748)
      • AndroidSideloader.exe (PID: 3584)

    • Reads the software policy settings

      • AndroidSideloader.exe (PID: 128)
      • rclone.exe (PID: 7104)
      • rclone.exe (PID: 1304)
      • AndroidSideloader.exe (PID: 6748)
      • rclone.exe (PID: 4668)
      • AndroidSideloader.exe (PID: 3584)
      • rclone.exe (PID: 1520)

    • Reads the machine GUID from the registry

      • AndroidSideloader.exe (PID: 128)
      • rclone.exe (PID: 7104)
      • AndroidSideloader.exe (PID: 6748)
      • rclone.exe (PID: 1304)
      • rclone.exe (PID: 4668)
      • AndroidSideloader.exe (PID: 3584)
      • rclone.exe (PID: 1520)

    • Manual execution by a user

      • AndroidSideloader.exe (PID: 128)
      • WinRAR.exe (PID: 6344)
      • AndroidSideloader.exe (PID: 6748)
      • Sideloader Launcher.exe (PID: 5200)

    • The sample compiled with english language support

      • AndroidSideloader.exe (PID: 128)
      • 7z.exe (PID: 4400)

    • Checks supported languages

      • AndroidSideloader.exe (PID: 128)
      • 7z.exe (PID: 4400)
      • adb.exe (PID: 3620)
      • rclone.exe (PID: 6860)
      • rclone.exe (PID: 7104)
      • 7z.exe (PID: 4672)
      • adb.exe (PID: 6156)
      • adb.exe (PID: 6792)
      • adb.exe (PID: 4944)
      • adb.exe (PID: 6428)
      • adb.exe (PID: 236)
      • adb.exe (PID: 4136)
      • adb.exe (PID: 5912)
      • adb.exe (PID: 5652)
      • adb.exe (PID: 1904)
      • adb.exe (PID: 3040)
      • adb.exe (PID: 6152)
      • rclone.exe (PID: 1304)
      • 7z.exe (PID: 2736)
      • adb.exe (PID: 1080)
      • adb.exe (PID: 6856)
      • 7z.exe (PID: 6244)
      • AndroidSideloader.exe (PID: 6748)
      • adb.exe (PID: 6532)
      • adb.exe (PID: 6912)
      • rclone.exe (PID: 4592)
      • rclone.exe (PID: 4668)
      • adb.exe (PID: 1344)
      • adb.exe (PID: 4076)
      • Sideloader Launcher.exe (PID: 5200)
      • adb.exe (PID: 6060)
      • 7z.exe (PID: 936)
      • adb.exe (PID: 3612)
      • AndroidSideloader.exe (PID: 3584)
      • adb.exe (PID: 1144)
      • adb.exe (PID: 6924)
      • rclone.exe (PID: 1520)
      • 7z.exe (PID: 2728)
      • rclone.exe (PID: 5036)

    • Create files in a temporary directory

      • adb.exe (PID: 6792)
      • rclone.exe (PID: 1304)
      • rclone.exe (PID: 7104)
      • rclone.exe (PID: 4668)
      • rclone.exe (PID: 1520)

    • Reads Microsoft Office registry keys

      • OpenWith.exe (PID: 4400)

    • Application based on Golang

      • rclone.exe (PID: 1304)

    • Process checks computer location settings

      • Sideloader Launcher.exe (PID: 5200)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xpi | Mozilla Firefox browser extension (66.6)
.zip | ZIP compressed archive (33.3)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2024:07:16 13:27:44
ZipCRC: 0x418e997e
ZipCompressedSize: 138
ZipUncompressedSize: 190
ZipFileName: Rookie Offline.cmd
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
205
Monitored processes
75
Malicious processes
1
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe androidsideloader.exe 7z.exe conhost.exe no specs 7z.exe no specs conhost.exe no specs adb.exe no specs conhost.exe no specs adb.exe no specs conhost.exe no specs adb.exe THREAT rclone.exe no specs conhost.exe no specs THREAT rclone.exe conhost.exe no specs 7z.exe no specs conhost.exe no specs adb.exe no specs conhost.exe no specs adb.exe no specs adb.exe no specs conhost.exe no specs conhost.exe no specs adb.exe no specs conhost.exe no specs adb.exe no specs conhost.exe no specs adb.exe no specs conhost.exe no specs adb.exe no specs adb.exe no specs conhost.exe no specs conhost.exe no specs adb.exe no specs adb.exe no specs conhost.exe no specs conhost.exe no specs THREAT rclone.exe conhost.exe no specs 7z.exe no specs conhost.exe no specs adb.exe no specs conhost.exe no specs adb.exe no specs conhost.exe no specs rundll32.exe no specs openwith.exe no specs winrar.exe no specs androidsideloader.exe adb.exe no specs conhost.exe no specs adb.exe no specs conhost.exe no specs adb.exe THREAT rclone.exe no specs conhost.exe no specs THREAT rclone.exe conhost.exe no specs 7z.exe no specs conhost.exe no specs adb.exe no specs conhost.exe no specs sideloader launcher.exe no specs androidsideloader.exe adb.exe no specs conhost.exe no specs adb.exe no specs conhost.exe no specs adb.exe THREAT rclone.exe no specs conhost.exe no specs THREAT rclone.exe conhost.exe no specs 7z.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
128"C:\Users\admin\Desktop\AndroidSideloader.exe" C:\Users\admin\Desktop\AndroidSideloader.exe
explorer.exe
User:
admin
Company:
Rookie.AndroidSideloader
Integrity Level:
MEDIUM
Description:
AndroidSideloader
Exit code:
0
Version:
2.0.0.0
Modules
Images
c:\users\admin\desktop\androidsideloader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
236"C:\RSL\platform-tools\adb.exe" devicesC:\RSL\platform-tools\adb.exe—AndroidSideloader.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\rsl\platform-tools\adb.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
372\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—7z.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
488C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
644\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—7z.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
936"7z.exe" x "C:\Users\admin\Desktop\meta.7z" -y -o"C:\Users\admin\Desktop\meta" -p"gL59VfgPxoHR" -bsp1C:\Users\admin\Desktop\7z.exe—AndroidSideloader.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip Console
Version:
24.09
Modules
Images
c:\users\admin\desktop\7z.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
1080"C:\RSL\platform-tools\adb.exe" devicesC:\RSL\platform-tools\adb.exe—AndroidSideloader.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\rsl\platform-tools\adb.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1144"C:\RSL\platform-tools\adb.exe" kill-serverC:\RSL\platform-tools\adb.exe—AndroidSideloader.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\rsl\platform-tools\adb.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1304"C:\Users\admin\Desktop\rclone\rclone.exe" copy ":http:/8c621d6563ab6bbb1145f83c652fbd8d/" "C:\Users\admin\Desktop\8c621d6563ab6bbb1145f83c652fbd8d" --transfers 1 --multi-thread-streams 0 --progress --rc --inplace --http-url https://go.vrpyourself.online/ --tpslimit 1.0 --tpslimit-burst 3C:\Users\admin\Desktop\rclone\rclone.exe
AndroidSideloader.exe
User:
admin
Company:
https://rclone.org
Integrity Level:
MEDIUM
Description:
Rclone
Exit code:
0
Version:
1.68.2
Modules
Images
c:\users\admin\desktop\rclone\rclone.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\umpdc.dll
1328\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—rclone.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
37 282
Read events
37 243
Write events
39
Delete events
0

Modification events

(PID) Process:(6584) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6584) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6584) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6584) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\rookie_2.32_portable.zip
(PID) Process:(6584) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6584) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6584) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6584) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6584) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(6584) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
Executable files
17
Suspicious files
3
Text files
4 112
Unknown types
0

Dropped files

PID
Process
Filename
Type
128AndroidSideloader.exeC:\Users\admin\Desktop\dependencies.7z —
MD5:—
SHA256:—
6584WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6584.31885\AddDefenderExceptions.ps1text
MD5:EDDAAD261ACC56C1F0FC2467954A9267
SHA256:947EA0B0397B44D41DE337A82A93E8C1260B08818F21FAB5A488610427A0EC62
44007z.exeC:\RSL\platform-tools\source.propertiestext
MD5:1A480C948B05FCA5F21C2FDC3E5D3898
SHA256:A2ABC4B12C27A0661FF872EB090C23BDC8D3CACE2809359D21F30FF247153DFA
44007z.exeC:\RSL\platform-tools\NOTICE.txttext
MD5:9CDED652743B8C71C2197F92986F69A0
SHA256:51FAD5F1496AAD5B898F3E2526C433FD6A996D7A11E78A3B35879F4807E3AE00
44007z.exeC:\RSL\platform-tools\aapt.exeexecutable
MD5:0DD164F26A0485592B34F302D7631493
SHA256:DB0BA2050B8F6B37185D2BA458D6E25B565AEFA3F3B96040ADF0A82C3469CE3C
44007z.exeC:\RSL\platform-tools\package.xmlxml
MD5:7249F82E3BEB8611AD2EF847D08220AA
SHA256:CB808450DB3503B2600270EDB265544D4BDF4516A364F56E59F93E4C0C27F43E
128AndroidSideloader.exeC:\Users\admin\Desktop\Sideloader Launcher.exeexecutable
MD5:A53A5E70248EB3DA58DEFA74B0554704
SHA256:98BC8CF1C6A59EF70D6431E1E92887984E5B21C8FBC85B4AD23CCC70589C4B1F
44007z.exeC:\RSL\platform-tools\adb.exeexecutable
MD5:AE6975E7C2211152F5FA54A1FDDF414D
SHA256:0E606318957BAAC81B997CCD8EE4BCDFF79964A9921DA07C716AEA3E8D856AF7
6584WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6584.31885\Rookie Offline.cmdtext
MD5:83B85F3A19C77666117DB1DFBBFD782B
SHA256:5286FC09CBBC098A5DA63096676B180BD7FD28DCD96A79F41F4D92784CC262D1
128AndroidSideloader.exeC:\Users\admin\Desktop\7z.exeexecutable
MD5:B6D5860F368B28CAA9DD14A51666A5CD
SHA256:E2CA3EC168AE9C0B4115CD4FE220145EA9B2DC4B6FC79D765E91F415B34D00DE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
53
DNS requests
27
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.40:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6552
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6412
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6412
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2040
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5064
SearchApp.exe
104.126.37.170:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
—
—
23.216.77.40:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
20.190.159.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 104.126.37.170
  • 104.126.37.171
  • 104.126.37.160
  • 104.126.37.162
  • 104.126.37.130
  • 104.126.37.128
  • 104.126.37.129
  • 104.126.37.163
  • 104.126.37.178
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
crl.microsoft.com
  • 23.216.77.40
  • 23.216.77.17
  • 23.216.77.25
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.186.46
whitelisted
login.live.com
  • 20.190.159.4
  • 20.190.159.71
  • 20.190.159.23
  • 20.190.159.64
  • 20.190.159.68
  • 20.190.159.0
  • 20.190.159.73
  • 40.126.31.69
whitelisted
go.microsoft.com
  • 23.193.33.163
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
arc.msn.com
  • 20.223.35.26
  • 20.199.58.43
whitelisted
fd.api.iris.microsoft.com
  • 20.199.58.43
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
128
AndroidSideloader.exe
Misc activity
ET INFO Observed ZeroSSL SSL/TLS Certificate
128
AndroidSideloader.exe
Misc activity
ET INFO Observed ZeroSSL SSL/TLS Certificate
6748
AndroidSideloader.exe
Misc activity
ET INFO Observed ZeroSSL SSL/TLS Certificate
3584
AndroidSideloader.exe
Misc activity
ET INFO Observed ZeroSSL SSL/TLS Certificate
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/downloads/rookie/rookie_2.32_portable.zip