File name:

Rattle.exe

Full analysis: https://app.any.run/tasks/0f7c1461-1b59-4611-a13e-cc1de8c1c112
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: June 19, 2025, 22:38:18
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
uac
pyinstaller
susp-powershell
discordgrabber
generic
stealer
ims-api
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, 10 sections
MD5:

505EA6AD5A7FCFC0F07628EF63A94542

SHA1:

FC915F5D63568FB69F4EAF5A3B486C261A5252FA

SHA256:

4AB943562558F968C658E82D89665A28CEF86BAB9BACA03F5588365AF679050D

SSDEEP:

98304:Of39MQrNOzhJ8QKCt7bm6GpJ0SDaF9XLDbenkuA83wpYp2twLb163At/pDuKFd7Z:OV4ZoO8YNW49rjfnm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • Rattle.exe (PID: 4884)
      • Rattle.exe (PID: 2648)
      • Rattle.exe (PID: 5232)
      • Rattle.exe (PID: 4020)

    • Bypass User Account Control (Modify registry)

      • reg.exe (PID: 3924)

    • Bypass User Account Control (ComputerDefaults)

      • ComputerDefaults.exe (PID: 7056)

    • Adds path to the Windows Defender exclusion list

      • Rattle.exe (PID: 4020)
      • cmd.exe (PID: 4236)

    • Antivirus name has been found in the command line (generic signature)

      • cmd.exe (PID: 6940)

    • Changes Windows Defender settings

      • cmd.exe (PID: 6940)
      • cmd.exe (PID: 4236)

    • Changes Controlled Folder Access settings

      • powershell.exe (PID: 4100)

    • Changes antivirus protection settings for downloading files from the Internet (IOAVProtection)

      • powershell.exe (PID: 4100)

    • Changes settings for checking scripts for malicious actions

      • powershell.exe (PID: 4100)

    • Changes settings for reporting to Microsoft Active Protection Service (MAPS)

      • powershell.exe (PID: 4100)

    • Changes settings for real-time protection

      • powershell.exe (PID: 4100)

    • Changes settings for sending potential threat samples to Microsoft servers

      • powershell.exe (PID: 4100)

    • Changes settings for protection against network attacks (IPS)

      • powershell.exe (PID: 4100)

    • Resets Windows Defender malware definitions to the base version

      • MpCmdRun.exe (PID: 4196)

    • Steals Growtopia credentials and data (YARA)

      • Rattle.exe (PID: 4020)

    • DISCORDGRABBER has been detected (YARA)

      • Rattle.exe (PID: 4020)

  • SUSPICIOUS

    • Starts a Microsoft application from unusual location

      • Rattle.exe (PID: 4884)
      • Rattle.exe (PID: 2648)
      • Rattle.exe (PID: 5232)
      • Rattle.exe (PID: 4020)

    • Process drops legitimate windows executable

      • Rattle.exe (PID: 4884)
      • Rattle.exe (PID: 5232)

    • Process drops python dynamic module

      • Rattle.exe (PID: 4884)
      • Rattle.exe (PID: 5232)

    • Executable content was dropped or overwritten

      • Rattle.exe (PID: 4884)
      • Rattle.exe (PID: 5232)

    • The process drops C-runtime libraries

      • Rattle.exe (PID: 4884)
      • Rattle.exe (PID: 5232)

    • Application launched itself

      • Rattle.exe (PID: 4884)
      • Rattle.exe (PID: 5232)

    • Starts CMD.EXE for commands execution

      • Rattle.exe (PID: 2648)
      • Rattle.exe (PID: 4020)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 6948)
      • cmd.exe (PID: 6172)
      • cmd.exe (PID: 4192)

    • Changes default file association

      • reg.exe (PID: 3924)

    • Found strings related to reading or modifying Windows Defender settings

      • Rattle.exe (PID: 2648)
      • Rattle.exe (PID: 4020)

    • Uses WEVTUTIL.EXE to query events from a log or log file

      • cmd.exe (PID: 4644)
      • cmd.exe (PID: 768)

    • Script disables Windows Defender's IPS

      • cmd.exe (PID: 6940)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 6940)
      • cmd.exe (PID: 4236)

    • Script adds exclusion path to Windows Defender

      • cmd.exe (PID: 4236)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • Rattle.exe (PID: 4020)

    • Script disables Windows Defender's real-time protection

      • cmd.exe (PID: 6940)

  • INFO

    • The sample compiled with english language support

      • Rattle.exe (PID: 4884)
      • Rattle.exe (PID: 5232)

    • Reads the computer name

      • Rattle.exe (PID: 4884)
      • Rattle.exe (PID: 5232)
      • Rattle.exe (PID: 4020)
      • MpCmdRun.exe (PID: 4196)

    • Checks supported languages

      • Rattle.exe (PID: 4884)
      • Rattle.exe (PID: 2648)
      • Rattle.exe (PID: 5232)
      • Rattle.exe (PID: 4020)
      • MpCmdRun.exe (PID: 4196)

    • Create files in a temporary directory

      • Rattle.exe (PID: 4884)
      • Rattle.exe (PID: 2648)
      • Rattle.exe (PID: 5232)
      • Rattle.exe (PID: 4020)
      • MpCmdRun.exe (PID: 4196)

    • Reads security settings of Internet Explorer

      • ComputerDefaults.exe (PID: 7056)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 5284)
      • powershell.exe (PID: 4100)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 5284)
      • powershell.exe (PID: 4100)

    • PyInstaller has been detected (YARA)

      • Rattle.exe (PID: 5232)
      • Rattle.exe (PID: 4020)

    • Found Base64 encoded reflection usage via PowerShell (YARA)

      • Rattle.exe (PID: 4020)

    • Reads the software policy settings

      • slui.exe (PID: 856)

    • Checks proxy server information

      • slui.exe (PID: 856)

    • UPX packer has been detected

      • Rattle.exe (PID: 4020)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

ims-api

(PID) Process(4020) Rattle.exe
Discord-Webhook-Tokens (1)1385387077885100183/nsAeFSdF_TIzY_udU4g14VMe1US2iJ7Vh1Ezive7bl3ktcDntgADcV-xbfuLhDjo-lvw
Discord-Info-Links
1385387077885100183/nsAeFSdF_TIzY_udU4g14VMe1US2iJ7Vh1Ezive7bl3ktcDntgADcV-xbfuLhDjo-lvw
Get Webhook Infohttps://discord.com/api/webhooks/1385387077885100183/nsAeFSdF_TIzY_udU4g14VMe1US2iJ7Vh1Ezive7bl3ktcDntgADcV-xbfuLhDjo-lvw
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:06:19 22:35:24+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Large address aware, No debug
PEType: PE32+
LinkerVersion: 2.44
CodeSize: 80384
InitializedDataSize: 118784
UninitializedDataSize: 15872
EntryPoint: 0x12ff
OSVersion: 4
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
FileVersionNumber: 10.0.26100.3323
ProductVersionNumber: 10.0.26100.3323
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Microsoft® Group Policy Update Utility
FileVersion: 10.0.26100.3323 (WinBuild.160101.0800)
InternalName: GPUpdate.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: GPUpdate.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 10.0.26100.3323
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
166
Monitored processes
32
Malicious processes
10
Suspicious processes
2

Behavior graph

Click at the process to see the details
start rattle.exe rattle.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs wevtutil.exe no specs cmd.exe no specs conhost.exe no specs computerdefaults.exe no specs computerdefaults.exe no specs computerdefaults.exe rattle.exe cmd.exe no specs conhost.exe no specs wevtutil.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs #DISCORDGRABBER rattle.exe cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs mpcmdrun.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
760\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
768C:\WINDOWS\system32\cmd.exe /c "wevtutil qe "Microsoft-Windows-Windows Defender/Operational" /f:text"C:\Windows\System32\cmd.exe—Rattle.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
856C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1520\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1568\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1728C:\WINDOWS\system32\cmd.exe /c "computerdefaults --nouacbypass"C:\Windows\System32\cmd.exe—Rattle.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1932computerdefaults --nouacbypassC:\Windows\System32\ComputerDefaults.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Set Program Access and Computer Defaults Control Panel
Exit code:
3221226540
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\computerdefaults.exe
c:\windows\system32\ntdll.dll
2216reg delete hkcu\Software\Classes\ms-settings /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2648"C:\Users\admin\Desktop\Rattle.exe" C:\Users\admin\Desktop\Rattle.exe—Rattle.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Group Policy Update Utility
Exit code:
0
Version:
10.0.26100.3323 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\desktop\rattle.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3196reg add hkcu\Software\Classes\ms-settings\shell\open\command /d "C:\Users\admin\Desktop\Rattle.exe" /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
58 806
Read events
58 797
Write events
5
Delete events
4

Modification events

(PID) Process:(3924) reg.exeKey:HKEY_CLASSES_ROOT\ms-settings\shell\open\command
Operation:writeName:DelegateExecute
Value:
(PID) Process:(7056) ComputerDefaults.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(7056) ComputerDefaults.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7056) ComputerDefaults.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7056) ComputerDefaults.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2216) reg.exeKey:HKEY_CLASSES_ROOT\ms-settings\shell\open\command
Operation:delete keyName:(default)
Value:
(PID) Process:(2216) reg.exeKey:HKEY_CLASSES_ROOT\ms-settings\shell\open
Operation:delete keyName:(default)
Value:
(PID) Process:(2216) reg.exeKey:HKEY_CLASSES_ROOT\ms-settings\shell
Operation:delete keyName:(default)
Value:
(PID) Process:(2216) reg.exeKey:HKEY_CLASSES_ROOT\ms-settings
Operation:delete keyName:(default)
Value:
Executable files
122
Suspicious files
5
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
4884Rattle.exeC:\Users\admin\AppData\Local\Temp\_MEI48842\_bz2.pydexecutable
MD5:0C13627F114F346604B0E8CBC03BAF29
SHA256:DF1E666B55AAE6EDE59EF672D173BD0D64EF3E824A64918E081082B8626A5861
4884Rattle.exeC:\Users\admin\AppData\Local\Temp\_MEI48842\VCRUNTIME140.dllexecutable
MD5:F12681A472B9DD04A812E16096514974
SHA256:D66C3B47091CEB3F8D3CC165A43D285AE919211A0C0FCB74491EE574D8D464F8
4884Rattle.exeC:\Users\admin\AppData\Local\Temp\_MEI48842\_hashlib.pydexecutable
MD5:596DF8ADA4B8BC4AE2C2E5BBB41A6C2E
SHA256:54348CFBF95FD818D74014C16343D9134282D2CF238329EEC2CDA1E2591565EC
4884Rattle.exeC:\Users\admin\AppData\Local\Temp\_MEI48842\_queue.pydexecutable
MD5:FBBBFBCDCF0A7C1611E27F4B3B71079E
SHA256:699C1F0F0387511EF543C0DF7EF81A13A1CFFDE4CE4CD43A1BAF47A893B99163
4884Rattle.exeC:\Users\admin\AppData\Local\Temp\_MEI48842\api-ms-win-core-console-l1-1-0.dllexecutable
MD5:9F746F4F7D845F063FEA3C37DCEBC27C
SHA256:88ACE577A9C51061CB7D1A36BABBBEFA48212FADC838FFDE98FDFFF60DE18386
4884Rattle.exeC:\Users\admin\AppData\Local\Temp\_MEI48842\_socket.pydexecutable
MD5:4351D7086E5221398B5B78906F4E84AC
SHA256:A0FA25EEF91825797F01754B7D7CF5106E355CF21322E926632F90AF01280ABE
4884Rattle.exeC:\Users\admin\AppData\Local\Temp\_MEI48842\_lzma.pydexecutable
MD5:8D9E1BB65A192C8446155A723C23D4C5
SHA256:1549FE64B710818950AA9BF45D43FE278CE59F3B87B3497D2106FF793EFA6CF7
4884Rattle.exeC:\Users\admin\AppData\Local\Temp\_MEI48842\_ctypes.pydexecutable
MD5:38FB83BD4FEBED211BD25E19E1CAE555
SHA256:CD31AF70CBCFE81B01A75EBEB2DE86079F4CBE767B75C3B5799EF8B9F0392D65
4884Rattle.exeC:\Users\admin\AppData\Local\Temp\_MEI48842\_sqlite3.pydexecutable
MD5:D678600C8AF1EEEAA5D8C1D668190608
SHA256:D6960F4426C09A12488EB457E62506C49A58D62A1CB16FBC3AE66B260453C2ED
4884Rattle.exeC:\Users\admin\AppData\Local\Temp\_MEI48842\_ssl.pydexecutable
MD5:156B1FA2F11C73ED25F63EE20E6E4B26
SHA256:A9B5F6C7A94FB6BFAF82024F906465FF39F9849E4A72A98A9B03FC07BF26DA51
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
34
TCP/UDP connections
50
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
—
20.190.160.64:443
https://login.live.com/RST2.srf
unknown
—
—
whitelisted
—
—
POST
—
20.190.160.64:443
https://login.live.com/RST2.srf
unknown
—
—
whitelisted
—
—
POST
—
40.126.32.134:443
https://login.live.com/RST2.srf
unknown
—
—
whitelisted
—
—
GET
—
142.250.186.163:443
https://gstatic.com/generate_204
unknown
—
—
—
—
—
GET
—
142.250.186.163:443
https://gstatic.com/generate_204
unknown
—
—
—
—
—
POST
—
40.126.32.134:443
https://login.live.com/RST2.srf
unknown
—
—
whitelisted
—
—
GET
—
4.175.87.197:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
—
—
GET
—
4.175.87.197:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
—
—
GET
—
52.165.164.15:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
—
—
—
—
—
GET
—
142.250.186.163:443
https://gstatic.com/generate_204
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2368
RUXIMICS.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5944
MoUsoCoreWorker.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6024
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2336
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
436
svchost.exe
40.126.32.74:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.110
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.32.74
  • 40.126.32.72
  • 20.190.160.17
  • 20.190.160.3
  • 20.190.160.22
  • 20.190.160.132
  • 20.190.160.67
  • 20.190.160.65
whitelisted
gstatic.com
  • 142.250.184.195
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.19
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
x1.c.lencr.org
  • 23.209.209.135
  • 69.192.161.44
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Rattle.exe