File name:

ra02W4S.exe

Full analysis: https://app.any.run/tasks/b4d71fa4-aa87-4ecb-a682-e4e494ee1e7c
Verdict: Malicious activity
Threats:

GCleaner is a type of malware loader that has the capability to deliver numerous malicious software programs, which differ based on the location of the targeted victim. This malware is commonly spread through fraudulent websites that advertise free PC optimization tools

Malware Trends Tracker     >>>
Analysis date: May 10, 2025, 06:24:02
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
gcleaner
loader
telegram
stealer
lumma
inno
installer
delphi
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

B31CB70FB3A9A5978F70ECE692A9F006

SHA1:

DBB9E95468306F32F31BAA90589E4128E4C24962

SHA256:

E596BEA77A032D4D8887EB905DB0ECFC3B5BB4B90B70913DCBB19FBAF909B7B5

SSDEEP:

98304:be3m5fNgME+YXs/JxDMXEB1KXWUNVRV6g3mlVgIL2XNmxfzR7Xl:Z

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • ra02W4S.exe (PID: 2088)

    • GCLEANER has been detected (SURICATA)

      • ra02W4S.exe (PID: 2088)

    • Actions looks like stealing of personal data

      • 45PRJLxwQ7Ssz.exe (PID: 1012)

    • LUMMA mutex has been found

      • 45PRJLxwQ7Ssz.exe (PID: 1012)

    • Steals credentials from Web Browsers

      • 45PRJLxwQ7Ssz.exe (PID: 1012)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • ra02W4S.exe (PID: 2088)
      • ramdriveplugin33.exe (PID: 1056)

    • Connects to the server without a host name

      • ra02W4S.exe (PID: 2088)

    • Executable content was dropped or overwritten

      • RQSuasSkqSK.exe (PID: 6436)
      • ra02W4S.exe (PID: 2088)
      • RQSuasSkqSK.tmp (PID: 5452)
      • ramdriveplugin33.exe (PID: 1056)

    • Potential Corporate Privacy Violation

      • ra02W4S.exe (PID: 2088)

    • Reads the Windows owner or organization settings

      • RQSuasSkqSK.tmp (PID: 5452)

    • The process drops C-runtime libraries

      • RQSuasSkqSK.tmp (PID: 5452)

    • Starts POWERSHELL.EXE for commands execution

      • ramdriveplugin33.exe (PID: 1056)

    • Process drops legitimate windows executable

      • RQSuasSkqSK.tmp (PID: 5452)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • 45PRJLxwQ7Ssz.exe (PID: 1012)

    • Searches for installed software

      • 45PRJLxwQ7Ssz.exe (PID: 1012)

  • INFO

    • The sample compiled with english language support

      • ra02W4S.exe (PID: 2088)
      • RQSuasSkqSK.tmp (PID: 5452)

    • Reads the computer name

      • ra02W4S.exe (PID: 2088)
      • RQSuasSkqSK.tmp (PID: 5452)
      • ramdriveplugin33.exe (PID: 1056)
      • O3sQrxgsIYa.exe (PID: 5556)
      • Gz172gOQT.exe (PID: 736)
      • RAMDrivePlugin.exe (PID: 3332)
      • 45PRJLxwQ7Ssz.exe (PID: 1012)

    • Checks proxy server information

      • ra02W4S.exe (PID: 2088)
      • slui.exe (PID: 1324)

    • Reads the machine GUID from the registry

      • ra02W4S.exe (PID: 2088)

    • Reads the software policy settings

      • ra02W4S.exe (PID: 2088)
      • 45PRJLxwQ7Ssz.exe (PID: 1012)

    • Creates files or folders in the user directory

      • ra02W4S.exe (PID: 2088)
      • RQSuasSkqSK.tmp (PID: 5452)

    • Checks supported languages

      • ra02W4S.exe (PID: 2088)
      • RQSuasSkqSK.exe (PID: 6436)
      • RQSuasSkqSK.tmp (PID: 5452)
      • ramdriveplugin33.exe (PID: 1056)
      • Gz172gOQT.exe (PID: 736)
      • 45PRJLxwQ7Ssz.exe (PID: 1012)
      • O3sQrxgsIYa.exe (PID: 5556)
      • RAMDrivePlugin.exe (PID: 3332)

    • Create files in a temporary directory

      • RQSuasSkqSK.exe (PID: 6436)
      • RQSuasSkqSK.tmp (PID: 5452)

    • Creates a software uninstall entry

      • RQSuasSkqSK.tmp (PID: 5452)

    • Creates files in the program directory

      • ramdriveplugin33.exe (PID: 1056)

    • Changes the registry key values via Powershell

      • ramdriveplugin33.exe (PID: 1056)

    • Process checks computer location settings

      • ramdriveplugin33.exe (PID: 1056)

    • Detects InnoSetup installer (YARA)

      • RQSuasSkqSK.tmp (PID: 5452)
      • RQSuasSkqSK.exe (PID: 6436)

    • Compiled with Borland Delphi (YARA)

      • RQSuasSkqSK.tmp (PID: 5452)

    • Attempting to use instant messaging service

      • 45PRJLxwQ7Ssz.exe (PID: 1012)

    • Manual execution by a user

      • RAMDrivePlugin.exe (PID: 3332)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (42.5)
.exe | Win64 Executable (generic) (27.2)
.cpl | Win 9x/ME Control Panel applet (15.3)
.dll | Win32 Dynamic Link Library (generic) (6.4)
.exe | Win32 Executable (generic) (4.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:02:09 08:48:01+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 1854976
InitializedDataSize: 567296
UninitializedDataSize: -
EntryPoint: 0x18c4f2
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.1845
ProductVersionNumber: 1.0.0.1845
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Qihoo 360 Technology Co. Ltd.
FileVersion: 1, 0, 0, 1845
InternalName: SoftMgrLite.exe
LegalCopyright: (C) Qihoo 360 Technology Co. Ltd., All rights reserved.
OriginalFileName: SoftMgrLite.exe
ProductName: 360 Total Security
ProductVersion: 1, 0, 0, 1845
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
11
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #GCLEANER ra02w4s.exe rqsuasskqsk.exe rqsuasskqsk.tmp ramdriveplugin33.exe powershell.exe no specs conhost.exe no specs #LUMMA 45prjlxwq7ssz.exe gz172goqt.exe no specs o3sqrxgsiya.exe no specs ramdriveplugin.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
736"C:\Users\admin\AppData\Roaming\raQuUaD2Upy\Gz172gOQT.exe"C:\Users\admin\AppData\Roaming\raQuUaD2Upy\Gz172gOQT.exe—ra02W4S.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Gcleanerapp
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\raquuad2upy\gz172goqt.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
812"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "ramDriveP" -Value "C:\ProgramData\RAMDrivePlugin\RAMDrivePlugin.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—ramdriveplugin33.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1012"C:\Users\admin\AppData\Roaming\sJIonvnT0\45PRJLxwQ7Ssz.exe"C:\Users\admin\AppData\Roaming\sJIonvnT0\45PRJLxwQ7Ssz.exe
ra02W4S.exe
User:
admin
Company:
Automated Workflow LLC
Integrity Level:
MEDIUM
Description:
Application for Prototype Element
Version:
3.9.692.2529
Modules
Images
c:\users\admin\appdata\roaming\sjionvnt0\45prjlxwq7ssz.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1056"C:\Users\admin\AppData\Local\RAM Drive Plugin 1.3.3\ramdriveplugin33.exe" -iC:\Users\admin\AppData\Local\RAM Drive Plugin 1.3.3\ramdriveplugin33.exe
RQSuasSkqSK.tmp
User:
admin
Integrity Level:
MEDIUM
Version:
0.1.3.3
Modules
Images
c:\users\admin\appdata\local\ram drive plugin 1.3.3\ramdriveplugin33.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1324C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2088"C:\Users\admin\AppData\Local\Temp\ra02W4S.exe" C:\Users\admin\AppData\Local\Temp\ra02W4S.exe
explorer.exe
User:
admin
Company:
Qihoo 360 Technology Co. Ltd.
Integrity Level:
MEDIUM
Exit code:
0
Version:
1, 0, 0, 1845
Modules
Images
c:\users\admin\appdata\local\temp\ra02w4s.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3332C:\ProgramData\RAMDrivePlugin\RAMDrivePlugin.exeC:\ProgramData\RAMDrivePlugin\RAMDrivePlugin.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Version:
0.1.3.3
Modules
Images
c:\programdata\ramdriveplugin\ramdriveplugin.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
5384\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5452"C:\Users\admin\AppData\Local\Temp\is-LJTI2.tmp\RQSuasSkqSK.tmp" /SL5="$5027C,3729689,54272,C:\Users\admin\AppData\Roaming\RP1UrV\RQSuasSkqSK.exe" C:\Users\admin\AppData\Local\Temp\is-LJTI2.tmp\RQSuasSkqSK.tmp
RQSuasSkqSK.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-ljti2.tmp\rqsuasskqsk.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5556"C:\Users\admin\AppData\Roaming\d8SR6I4\O3sQrxgsIYa.exe"C:\Users\admin\AppData\Roaming\d8SR6I4\O3sQrxgsIYa.exe—ra02W4S.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Gcleanerapp
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\d8sr6i4\o3sqrxgsiya.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
6 340
Read events
6 323
Write events
17
Delete events
0

Modification events

(PID) Process:(2088) ra02W4S.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2088) ra02W4S.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2088) ra02W4S.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5452) RQSuasSkqSK.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RAM Drive Plugin_is1
Operation:writeName:UninstallString
Value:
"C:\Users\admin\AppData\Local\RAM Drive Plugin 1.3.3\uninstall\unins000.exe"
(PID) Process:(5452) RQSuasSkqSK.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RAM Drive Plugin_is1
Operation:writeName:QuietUninstallString
Value:
"C:\Users\admin\AppData\Local\RAM Drive Plugin 1.3.3\uninstall\unins000.exe" /SILENT
(PID) Process:(5452) RQSuasSkqSK.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RAM Drive Plugin_is1
Operation:writeName:NoModify
Value:
1
(PID) Process:(5452) RQSuasSkqSK.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RAM Drive Plugin_is1
Operation:writeName:NoRepair
Value:
1
(PID) Process:(5452) RQSuasSkqSK.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RAM Drive Plugin_is1
Operation:writeName:InstallDate
Value:
20250510
(PID) Process:(5452) RQSuasSkqSK.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RAM Drive Plugin_is1
Operation:writeName:EstimatedSize
Value:
8858
(PID) Process:(5452) RQSuasSkqSK.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RAM Drive Plugin_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.5.0 (a)
Executable files
35
Suspicious files
14
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
2088ra02W4S.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:D6E40146184D0768CDBC6F9CA06D3308
SHA256:5C8C1CA4B9B4C6A26D217DB3B479F156575F01919566DFA3A20C046D4BFA344C
2088ra02W4S.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:1C7035AF12E6C6E1C7630FAE0BDFF54F
SHA256:9975BEA509759AFE64B29515FDCA47ACE21811C0C36CC1857CACDC081BB09E28
2088ra02W4S.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:1FBB37F79B317A9A248E7C4CE4F5BAC5
SHA256:9BF639C595FE335B6F694EE35990BEFD2123F5E07FD1973FF619E3FC88F5F49F
2088ra02W4S.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:4A90329071AE30B759D279CCA342B0A6
SHA256:4F544379EDA8E2653F71472AB968AEFD6B5D1F4B3CE28A5EDB14196184ED3B60
2088ra02W4S.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\success[1].htmbinary
MD5:CFCD208495D565EF66E7DFF9F98764DA
SHA256:5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
2088ra02W4S.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\fuckingdllENCR[1].dllbinary
MD5:4BC1EF6688690AF3DD8D3D70906A9F98
SHA256:7703A6B77C0B0935F5900A2D846CFA3AB59B46D03A1A0844F6BCB5CF9496B2FE
2088ra02W4S.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\text[1]text
MD5:5E847B1CC501E8A09997640FED7DB52F
SHA256:C06903CB5A25E63794907092B488A8580074C872272A9FC51CEF5E76EEECF7A2
2088ra02W4S.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\ONE[1].fileexecutable
MD5:1433B58DEA2215937FDC538A84A147C5
SHA256:7764AD7E5BE0297986D47450F154453515D5C557B620CD6E0FA505AFDACCF87D
5452RQSuasSkqSK.tmpC:\Users\admin\AppData\Local\Temp\is-2APT9.tmp\_isetup\_setup64.tmpexecutable
MD5:4FF75F505FDDCC6A9AE62216446205D9
SHA256:A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81
6436RQSuasSkqSK.exeC:\Users\admin\AppData\Local\Temp\is-LJTI2.tmp\RQSuasSkqSK.tmpexecutable
MD5:C711043767D7E6F66051C198FF6FC352
SHA256:0C46A2F3C200A7E72AAB1ED8221FC0DF709F5B0A67399F54FD6D97E809BD5AEF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
32
DNS requests
19
Threats
13

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.164.112:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2088
ra02W4S.exe
GET
200
172.217.16.195:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
2088
ra02W4S.exe
GET
200
172.217.16.195:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
2088
ra02W4S.exe
GET
200
142.250.185.99:80
http://o.pki.goog/we2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCEH0th7t%2BrhK7Cmbia6iF80g%3D
unknown
—
—
whitelisted
2088
ra02W4S.exe
GET
200
185.156.72.196:80
http://185.156.72.196/success?substr=mixtwelve&s=three&sub=none
unknown
—
—
malicious
2088
ra02W4S.exe
GET
200
185.156.72.196:80
http://185.156.72.196/service
unknown
—
—
malicious
6132
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2088
ra02W4S.exe
GET
200
185.156.72.196:80
http://185.156.72.196/info
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5176
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.164.112:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 2.16.164.112
  • 2.16.164.113
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.130
  • 20.190.160.5
  • 40.126.32.140
  • 20.190.160.67
  • 20.190.160.64
  • 40.126.32.74
  • 40.126.32.133
  • 20.190.160.132
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
drive.usercontent.google.com
  • 172.217.16.129
whitelisted
c.pki.goog
  • 172.217.16.195
whitelisted
o.pki.goog
  • 142.250.185.99
whitelisted

Threats

PID
Process
Class
Message
2088
ra02W4S.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 33
2088
ra02W4S.exe
A Network Trojan was detected
LOADER [ANY.RUN] GCleaner HTTP Header
2088
ra02W4S.exe
A Network Trojan was detected
LOADER [ANY.RUN] GCleaner HTTP Header
2088
ra02W4S.exe
A Network Trojan was detected
LOADER [ANY.RUN] GCleaner HTTP Header
2088
ra02W4S.exe
A Network Trojan was detected
LOADER [ANY.RUN] GCleaner HTTP Header
2088
ra02W4S.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
2088
ra02W4S.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
2088
ra02W4S.exe
Misc activity
ET INFO EXE - Served Attached HTTP
2088
ra02W4S.exe
A Network Trojan was detected
LOADER [ANY.RUN] GCleaner HTTP Header
2088
ra02W4S.exe
A Network Trojan was detected
LOADER [ANY.RUN] GCleaner HTTP Header
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ra02W4S.exe