File name:

2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe

Full analysis: https://app.any.run/tasks/dda934a6-d6cc-40e8-a64e-26ebb2436c3c
Verdict: Malicious activity
Analysis date: July 18, 2025, 02:23:37
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
python
pyinstaller
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 7 sections
MD5:

8BFFB36D6944DD025A63969AA9F64555

SHA1:

0D62D326EDDDB522CF2EA027ACBE602125C64B84

SHA256:

27390A6E46C43846FF62E4A885BDDAE4BFFB347203C56B342E15D542A7F20201

SSDEEP:

196608:2PuAAZYTeRi/BqhvTfnVy2olQvzJcmjK5AS:2PMZYKRi5qpTt3vVcmT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Downloads the requested resource (POWERSHELL)

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 2192)

  • SUSPICIOUS

    • The process drops C-runtime libraries

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 5552)

    • Process drops python dynamic module

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 5552)

    • Process drops legitimate windows executable

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 5552)

    • Executable content was dropped or overwritten

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 5552)

    • Application launched itself

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 5552)
      • updater.exe (PID: 5768)

    • Starts CMD.EXE for commands execution

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 2192)

    • Loads Python modules

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 2192)

    • Reads security settings of Internet Explorer

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 2192)

    • The process executes via Task Scheduler

      • updater.exe (PID: 5768)

  • INFO

    • Reads the computer name

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 5552)
      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 2192)
      • updater.exe (PID: 5768)

    • Checks supported languages

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 5552)
      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 2192)
      • updater.exe (PID: 5768)
      • updater.exe (PID: 1212)

    • The sample compiled with english language support

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 5552)

    • Create files in a temporary directory

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 5552)
      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 2192)

    • Checks operating system version

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 2192)

    • Reads the machine GUID from the registry

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 2192)

    • Reads Environment values

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 2192)

    • Checks proxy server information

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 2192)
      • slui.exe (PID: 4864)

    • Disables trace logs

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 2192)

    • PyInstaller has been detected (YARA)

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 2192)
      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 5552)

    • Reads the software policy settings

      • slui.exe (PID: 4864)
      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 2192)

    • Process checks whether UAC notifications are on

      • updater.exe (PID: 5768)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:07:16 15:55:03+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.36
CodeSize: 166400
InitializedDataSize: 152576
UninitializedDataSize: -
EntryPoint: 0xa6b0
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows command line
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
7
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe conhost.exe no specs 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe cmd.exe no specs slui.exe updater.exe no specs updater.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1212"C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=134.0.6985.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x111c460,0x111c46c,0x111c478C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe—updater.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
134.0.6985.0
Modules
Images
c:\program files (x86)\google\googleupdater\134.0.6985.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
2192"C:\Users\admin\Desktop\2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe" C:\Users\admin\Desktop\2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe
2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3028\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4864C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5552"C:\Users\admin\Desktop\2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe" C:\Users\admin\Desktop\2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5768"C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe" --wake --systemC:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe—svchost.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
134.0.6985.0
Modules
Images
c:\program files (x86)\google\googleupdater\134.0.6985.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
6876C:\WINDOWS\system32\cmd.exe /c "ver"C:\Windows\System32\cmd.exe—2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
Total events
8 208
Read events
8 194
Write events
14
Delete events
0

Modification events

(PID) Process:(2192) 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2192) 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(2192) 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2192) 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2192) 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(2192) 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2192) 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2192) 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2192) 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(2192) 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
76
Suspicious files
1
Text files
17
Unknown types
0

Dropped files

PID
Process
Filename
Type
55522025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeC:\Users\admin\AppData\Local\Temp\_MEI55522\Pythonwin\win32ui.pydexecutable
MD5:0E96B5724C2213300864CEB36363097A
SHA256:85CF3081B0F1ADAFDBDCF164D7788A7F00E52BACDF02D1505812DE4FACFC962F
55522025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeC:\Users\admin\AppData\Local\Temp\_MEI55522\VCRUNTIME140.dllexecutable
MD5:F12681A472B9DD04A812E16096514974
SHA256:D66C3B47091CEB3F8D3CC165A43D285AE919211A0C0FCB74491EE574D8D464F8
55522025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeC:\Users\admin\AppData\Local\Temp\_MEI55522\VCRUNTIME140_1.dllexecutable
MD5:75E78E4BF561031D39F86143753400FF
SHA256:1758085A61527B427C4380F0C976D29A8BEE889F2AC480C356A3F166433BF70E
55522025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeC:\Users\admin\AppData\Local\Temp\_MEI55522\_ctypes.pydexecutable
MD5:6A9CA97C039D9BBB7ABF40B53C851198
SHA256:E662D2B35BB48C5F3432BDE79C0D20313238AF800968BA0FAA6EA7E7E5EF4535
55522025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeC:\Users\admin\AppData\Local\Temp\_MEI55522\_bz2.pydexecutable
MD5:4101128E19134A4733028CFAAFC2F3BB
SHA256:5843872D5E2B08F138A71FE9BA94813AFEE59C8B48166D4A8EB0F606107A7E80
55522025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeC:\Users\admin\AppData\Local\Temp\_MEI55522\_elementtree.pydexecutable
MD5:63629A705BFFCA85CE6A4539BFBDD760
SHA256:DF71D64818CFECD61AD0122BEA23B685D01BD241F1B06879A2999917818B0787
55522025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeC:\Users\admin\AppData\Local\Temp\_MEI55522\_socket.pydexecutable
MD5:8140BDC5803A4893509F0E39B67158CE
SHA256:39715EF8D043354F0AB15F62878530A38518FB6192BC48DA6A098498E8D35769
55522025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeC:\Users\admin\AppData\Local\Temp\_MEI55522\_decimal.pydexecutable
MD5:D47E6ACF09EAD5774D5B471AB3AB96FF
SHA256:D0DF57988A74ACD50B2D261E8B5F2C25DA7B940EC2AAFBEE444C277552421E6E
55522025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeC:\Users\admin\AppData\Local\Temp\_MEI55522\_ssl.pydexecutable
MD5:069BCCC9F31F57616E88C92650589BDD
SHA256:CB42E8598E3FA53EEEBF63F2AF1730B9EC64614BDA276AB2CD1F1C196B3D7E32
55522025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeC:\Users\admin\AppData\Local\Temp\_MEI55522\_overlapped.pydexecutable
MD5:01AD7CA8BC27F92355FD2895FC474157
SHA256:A083E83F609ED7A2FC18A95D44D8F91C9DC74842F33E19E91988E84DB94C3B5B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
22
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3852
RUXIMICS.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
45.15.156.24:443
https://goodhillsenterprise.com/captcha
unknown
text
6.25 Mb
unknown
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5944
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3852
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5944
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3852
RUXIMICS.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
google.com
  • 142.250.184.206
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
goodhillsenterprise.com
  • 45.15.156.24
unknown
self.events.data.microsoft.com
  • 20.189.173.25
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe