File name:

Ratnik.exe

Full analysis: https://app.any.run/tasks/d5c2172b-320b-4116-9818-617305385117
Verdict: Malicious activity
Analysis date: November 18, 2024, 10:10:39
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
confuser
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

D337130383DCDD5535D213C96DB4A56C

SHA1:

6B8AAB617AC6B00212F5BBD297DE00BC8C5A7855

SHA256:

B3FA222881409E705D6BA038C8B17CB51F78AEB1099191E51C00ADE536EB72BE

SSDEEP:

1536:uOzalwFMRaeGSOvtjBdFzkzTZkW7WkMRqXwUC7vozGvbk62I4ycq1e:J2wFEa7jBSZBwcC7AMg6Cyh1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • The process drops C-runtime libraries

      • micmw2yi.205.exe (PID: 4040)

    • Executable content was dropped or overwritten

      • micmw2yi.205.exe (PID: 4040)
      • svchost.exe (PID: 6524)
      • L7E0inNwTV2.exe (PID: 1332)

    • Process drops legitimate windows executable

      • micmw2yi.205.exe (PID: 4040)

    • Drops a system driver (possible attempt to evade defenses)

      • micmw2yi.205.exe (PID: 4040)
      • L7E0inNwTV2.exe (PID: 1332)
      • svchost.exe (PID: 6524)

    • The process verifies whether the antivirus software is installed

      • Ratnik.exe (PID: 1732)

    • Executing commands from ".cmd" file

      • ecd20d3a.exe (PID: 4792)

    • Starts CMD.EXE for commands execution

      • ecd20d3a.exe (PID: 4792)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 4464)

  • INFO

    • Disables trace logs

      • Ratnik.exe (PID: 1732)

    • Reads the computer name

      • Ratnik.exe (PID: 1732)

    • Checks supported languages

      • Ratnik.exe (PID: 1732)

    • Checks proxy server information

      • Ratnik.exe (PID: 1732)

    • Confuser has been detected (YARA)

      • Ratnik.exe (PID: 1732)

    • Sends debugging messages

      • gWO5RyEuquORSL7.exe (PID: 5748)

    • Reads the machine GUID from the registry

      • Ratnik.exe (PID: 1732)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:10:18 18:15:43+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 71680
InitializedDataSize: 5120
UninitializedDataSize: -
EntryPoint: 0x137ae
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.1.1.9
ProductVersionNumber: 3.1.1.9
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: -
FileVersion: 3.1.1.9
InternalName: CouitaTools3.exe
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: CouitaTools3.exe
ProductName: -
ProductVersion: 3.1.1.9
AssemblyVersion: 3.1.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
151
Monitored processes
15
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start ratnik.exe sppextcomobj.exe no specs slui.exe micmw2yi.205.exe ecd20d3a.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs slui.exe svchost.exe r4erihaax9ry5x.exe no specs gwo5ryeuquorsl7.exe l7e0innwtv2.exe conhost.exe no specs ratnik.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
528\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—L7E0inNwTV2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1332"C:\Users\admin\AppData\Local\Temp\113FEDC0-C2818A30-6F070680-5524E3A0\L7E0inNwTV2.exe" -arkdll:E32GCDcw7dUHysO.dll -arkpipe:\pipe\A1A026F11731924832 -mode:1C:\Users\admin\AppData\Local\Temp\113FEDC0-C2818A30-6F070680-5524E3A0\L7E0inNwTV2.exe
R4ErIHAAx9ry5x.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\113fedc0-c2818a30-6f070680-5524e3a0\l7e0innwtv2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\113fedc0-c2818a30-6f070680-5524e3a0\ccsdk.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1732"C:\Users\admin\AppData\Local\Temp\Ratnik.exe" C:\Users\admin\AppData\Local\Temp\Ratnik.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Version:
3.1.1.9
Modules
Images
c:\users\admin\appdata\local\temp\ratnik.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2132C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
2432"C:\Users\admin\AppData\Local\Temp\Ratnik.exe" C:\Users\admin\AppData\Local\Temp\Ratnik.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Version:
3.1.1.9
Modules
Images
c:\users\admin\appdata\local\temp\ratnik.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
3844reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v 6b183f4c-43c4-4b5a-b517-f558d1fa2e57 /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
4040"C:\Windows\SysWOW64\directx\micmw2yi.205.exe" C:\Windows\SysWOW64\directx\micmw2yi.205.exe
Ratnik.exe
User:
admin
Company:
AO Kaspersky Lab
Integrity Level:
HIGH
Description:
Kaspersky Virus Removal Tool
Exit code:
0
Version:
20.0.12.0
Modules
Images
c:\windows\syswow64\directx\micmw2yi.205.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4464C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\{2b3e2468-1c43-41ce-a567-5661dede3b87}\6b183f4c-43c4-4b5a-b517-f558d1fa2e57.cmd" "C:\Windows\System32\cmd.exe—ecd20d3a.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
4508C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4792C:/Users/admin/AppData/Local/Temp/{449e439a-c95a-4cda-bdc4-b541f25ca8d1}/\ecd20d3a.exe C:\Users\admin\AppData\Local\Temp\{449e439a-c95a-4cda-bdc4-b541f25ca8d1}\ecd20d3a.exe—micmw2yi.205.exe
User:
admin
Company:
AO Kaspersky Lab
Integrity Level:
HIGH
Description:
Kaspersky Virus Removal Tool
Exit code:
4294967295
Version:
20.0.12.0
Modules
Images
c:\users\admin\appdata\local\temp\{449e439a-c95a-4cda-bdc4-b541f25ca8d1}\ecd20d3a.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
Total events
3 938
Read events
3 888
Write events
42
Delete events
8

Modification events

(PID) Process:(1732) Ratnik.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Ratnik_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1732) Ratnik.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Ratnik_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(1732) Ratnik.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Ratnik_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(1732) Ratnik.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Ratnik_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(1732) Ratnik.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Ratnik_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(1732) Ratnik.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Ratnik_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(1732) Ratnik.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Ratnik_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(1732) Ratnik.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Ratnik_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1732) Ratnik.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Ratnik_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(1732) Ratnik.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Ratnik_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
96
Suspicious files
107
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
1732Ratnik.exeC:\Windows\SysWOW64\directx\micmw2yi.205.exe —
MD5:—
SHA256:—
4040micmw2yi.205.exeC:\Users\admin\AppData\Local\Temp\{449e439a-c95a-4cda-bdc4-b541f25ca8d1}\app_core.dllexecutable
MD5:FE0964663CF9C5E4FF493198E035CC1F
SHA256:DDD70011D86B8EC909295EF45F94B48B0252229B6182AF9EF8A6029C30DAAF39
4040micmw2yi.205.exeC:\Users\admin\AppData\Local\Temp\{449e439a-c95a-4cda-bdc4-b541f25ca8d1}\instrumental_meta.dllexecutable
MD5:69B763EB87E26A89812D6B40B4977B2B
SHA256:E01F839DB429BC2232E5BEBE5B3F754D07ACC963D5A2948223B818097C032565
4040micmw2yi.205.exeC:\Users\admin\AppData\Local\Temp\{449e439a-c95a-4cda-bdc4-b541f25ca8d1}\x86\redist.tar —
MD5:—
SHA256:—
4040micmw2yi.205.exeC:\Users\admin\AppData\Local\Temp\{449e439a-c95a-4cda-bdc4-b541f25ca8d1}\crypto_components_meta.dllexecutable
MD5:3D9D1753ED0F659E4DB02E776A121862
SHA256:B6163EC9D4825102E3D423E02FB026259A6A17E7D7696AE060EC2B0BA97F54F2
4040micmw2yi.205.exeC:\Users\admin\AppData\Local\Temp\{449e439a-c95a-4cda-bdc4-b541f25ca8d1}\key_value_storage.dllexecutable
MD5:9BF7F895CFF1F0B9DDF5FC077BAC314C
SHA256:D03E0AF01FBCD9CE714CAF3DB5CA2AB3CA4A717D5FDA5C99B77E09B5672498A4
4040micmw2yi.205.exeC:\Users\admin\AppData\Local\Temp\{449e439a-c95a-4cda-bdc4-b541f25ca8d1}\instrumental_services.dllexecutable
MD5:C6ACD1D9A80740F8A416B0A78E3FA546
SHA256:DB8ACD14ACE6D4C8D4D61016DEBE3C0D72677416661CAF0D36E7306ED020920F
4040micmw2yi.205.exeC:\Users\admin\AppData\Local\Temp\{449e439a-c95a-4cda-bdc4-b541f25ca8d1}\app_core_meta.dllexecutable
MD5:81172E3CF5FC6DF072B45C4F1FB6EB34
SHA256:2A272A1990A3DFA35693ADF0689512B068A831283A852F8F805CB28153115F57
4040micmw2yi.205.exeC:\Users\admin\AppData\Local\Temp\{449e439a-c95a-4cda-bdc4-b541f25ca8d1}\ksn_facade.dllexecutable
MD5:E6DB25447957C55F3D9DAC2A9A55A0F0
SHA256:6C6305C220444294179DA749D639C91BB97AFD507D30A322D7C1C16CCF0AC9FC
4040micmw2yi.205.exeC:\Users\admin\AppData\Local\Temp\{449e439a-c95a-4cda-bdc4-b541f25ca8d1}\Bases\KLAVA\log0 —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
35
TCP/UDP connections
83
DNS requests
36
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1332
L7E0inNwTV2.exe
GET
200
88.221.110.147:80
http://www.msftconnecttest.com/connecttest.txt
unknown
—
—
whitelisted
1332
L7E0inNwTV2.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl
unknown
—
—
whitelisted
1332
L7E0inNwTV2.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/certs/Microsoft%20Certificate%20Trust%20List%20PCA(3).crt
unknown
—
—
whitelisted
1332
L7E0inNwTV2.exe
GET
200
2.16.164.106:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
1332
L7E0inNwTV2.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl%20
unknown
—
—
whitelisted
1332
L7E0inNwTV2.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl
unknown
—
—
whitelisted
1732
Ratnik.exe
GET
301
77.88.44.242:80
http://ya.ru/
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
2.16.164.106:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3676
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6944
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4816
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5488
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1732
Ratnik.exe
77.88.44.242:80
ya.ru
YANDEX LLC
RU
whitelisted
1732
Ratnik.exe
77.88.44.242:443
ya.ru
YANDEX LLC
RU
whitelisted
4360
SearchApp.exe
2.23.209.137:443
www.bing.com
Akamai International B.V.
GB
whitelisted
3676
svchost.exe
40.126.32.136:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4360
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.110
whitelisted
ya.ru
  • 77.88.44.242
  • 5.255.255.242
  • 77.88.55.242
whitelisted
www.bing.com
  • 2.23.209.137
  • 2.23.209.189
  • 2.23.209.135
  • 2.23.209.141
  • 2.23.209.130
  • 2.23.209.185
  • 2.23.209.186
  • 2.23.209.131
  • 2.23.209.133
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.136
  • 40.126.32.140
  • 40.126.32.72
  • 40.126.32.133
  • 40.126.32.134
  • 20.190.160.20
  • 40.126.32.76
  • 20.190.160.14
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
th.bing.com
  • 2.23.209.143
  • 2.23.209.150
  • 2.23.209.135
  • 2.23.209.142
  • 2.23.209.149
  • 2.23.209.137
  • 2.23.209.141
  • 2.23.209.151
  • 2.23.209.144
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.16.164.106
  • 2.16.164.49
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted

Threats

PID
Process
Class
Message
1332
L7E0inNwTV2.exe
Misc activity
ET INFO Microsoft Connection Test
Process
Message
gWO5RyEuquORSL7.exe
gWO5RyEuquORSL7.exe
sortable-grid
gWO5RyEuquORSL7.exe
[BEHAVIOR] Create:
gWO5RyEuquORSL7.exe
gWO5RyEuquORSL7.exe
[BEHAVIOR] Create:
gWO5RyEuquORSL7.exe
gWO5RyEuquORSL7.exe
[BEHAVIOR] Create:
gWO5RyEuquORSL7.exe
virtual-file-icon
gWO5RyEuquORSL7.exe
gWO5RyEuquORSL7.exe
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Ratnik.exe