File name:

2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe

Full analysis: https://app.any.run/tasks/dda934a6-d6cc-40e8-a64e-26ebb2436c3c
Verdict: Malicious activity
Analysis date: July 18, 2025, 02:23:37
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
python
pyinstaller
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 7 sections
MD5:

8BFFB36D6944DD025A63969AA9F64555

SHA1:

0D62D326EDDDB522CF2EA027ACBE602125C64B84

SHA256:

27390A6E46C43846FF62E4A885BDDAE4BFFB347203C56B342E15D542A7F20201

SSDEEP:

196608:2PuAAZYTeRi/BqhvTfnVy2olQvzJcmjK5AS:2PMZYKRi5qpTt3vVcmT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Downloads the requested resource (POWERSHELL)

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 2192)

  • SUSPICIOUS

    • The process drops C-runtime libraries

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 5552)

    • Process drops legitimate windows executable

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 5552)

    • Process drops python dynamic module

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 5552)

    • Application launched itself

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 5552)
      • updater.exe (PID: 5768)

    • Executable content was dropped or overwritten

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 5552)

    • Starts CMD.EXE for commands execution

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 2192)

    • Loads Python modules

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 2192)

    • The process executes via Task Scheduler

      • updater.exe (PID: 5768)

    • Reads security settings of Internet Explorer

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 2192)

  • INFO

    • Checks supported languages

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 5552)
      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 2192)
      • updater.exe (PID: 5768)
      • updater.exe (PID: 1212)

    • Create files in a temporary directory

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 5552)
      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 2192)

    • Reads the computer name

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 5552)
      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 2192)
      • updater.exe (PID: 5768)

    • The sample compiled with english language support

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 5552)

    • Checks operating system version

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 2192)

    • Reads the machine GUID from the registry

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 2192)

    • Reads Environment values

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 2192)

    • Reads the software policy settings

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 2192)
      • slui.exe (PID: 4864)

    • PyInstaller has been detected (YARA)

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 2192)
      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 5552)

    • Process checks whether UAC notifications are on

      • updater.exe (PID: 5768)

    • Checks proxy server information

      • slui.exe (PID: 4864)
      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 2192)

    • Disables trace logs

      • 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe (PID: 2192)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:07:16 15:55:03+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.36
CodeSize: 166400
InitializedDataSize: 152576
UninitializedDataSize: -
EntryPoint: 0xa6b0
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows command line
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
7
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe conhost.exe no specs 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe cmd.exe no specs slui.exe updater.exe no specs updater.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1212"C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=134.0.6985.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x111c460,0x111c46c,0x111c478C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe—updater.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
134.0.6985.0
Modules
Images
c:\program files (x86)\google\googleupdater\134.0.6985.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
2192"C:\Users\admin\Desktop\2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe" C:\Users\admin\Desktop\2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe
2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3028\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4864C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5552"C:\Users\admin\Desktop\2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe" C:\Users\admin\Desktop\2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5768"C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe" --wake --systemC:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe—svchost.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
134.0.6985.0
Modules
Images
c:\program files (x86)\google\googleupdater\134.0.6985.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
6876C:\WINDOWS\system32\cmd.exe /c "ver"C:\Windows\System32\cmd.exe—2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
Total events
8 208
Read events
8 194
Write events
14
Delete events
0

Modification events

(PID) Process:(2192) 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2192) 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(2192) 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2192) 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2192) 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(2192) 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2192) 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2192) 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2192) 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(2192) 2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
76
Suspicious files
1
Text files
17
Unknown types
0

Dropped files

PID
Process
Filename
Type
55522025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeC:\Users\admin\AppData\Local\Temp\_MEI55522\_decimal.pydexecutable
MD5:D47E6ACF09EAD5774D5B471AB3AB96FF
SHA256:D0DF57988A74ACD50B2D261E8B5F2C25DA7B940EC2AAFBEE444C277552421E6E
55522025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeC:\Users\admin\AppData\Local\Temp\_MEI55522\Pythonwin\win32ui.pydexecutable
MD5:0E96B5724C2213300864CEB36363097A
SHA256:85CF3081B0F1ADAFDBDCF164D7788A7F00E52BACDF02D1505812DE4FACFC962F
55522025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeC:\Users\admin\AppData\Local\Temp\_MEI55522\VCRUNTIME140_1.dllexecutable
MD5:75E78E4BF561031D39F86143753400FF
SHA256:1758085A61527B427C4380F0C976D29A8BEE889F2AC480C356A3F166433BF70E
55522025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeC:\Users\admin\AppData\Local\Temp\_MEI55522\_ctypes.pydexecutable
MD5:6A9CA97C039D9BBB7ABF40B53C851198
SHA256:E662D2B35BB48C5F3432BDE79C0D20313238AF800968BA0FAA6EA7E7E5EF4535
55522025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeC:\Users\admin\AppData\Local\Temp\_MEI55522\_asyncio.pydexecutable
MD5:2859C39887921DAD2FF41FEDA44FE174
SHA256:AEBC378DB08617EA81A0A3A3BC044BCC7E6303E314630392DD51BAB12F879BD9
55522025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeC:\Users\admin\AppData\Local\Temp\_MEI55522\_overlapped.pydexecutable
MD5:01AD7CA8BC27F92355FD2895FC474157
SHA256:A083E83F609ED7A2FC18A95D44D8F91C9DC74842F33E19E91988E84DB94C3B5B
55522025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeC:\Users\admin\AppData\Local\Temp\_MEI55522\_queue.pydexecutable
MD5:FF8300999335C939FCCE94F2E7F039C0
SHA256:2F71046891BA279B00B70EB031FE90B379DBE84559CF49CE5D1297EA6BF47A78
55522025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeC:\Users\admin\AppData\Local\Temp\_MEI55522\_cffi_backend.cp311-win_amd64.pydexecutable
MD5:739D352BD982ED3957D376A9237C9248
SHA256:9AEE90CF7980C8FF694BB3FFE06C71F87EB6A613033F73E3174A732648D39980
55522025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeC:\Users\admin\AppData\Local\Temp\_MEI55522\_elementtree.pydexecutable
MD5:63629A705BFFCA85CE6A4539BFBDD760
SHA256:DF71D64818CFECD61AD0122BEA23B685D01BD241F1B06879A2999917818B0787
55522025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exeC:\Users\admin\AppData\Local\Temp\_MEI55522\_hashlib.pydexecutable
MD5:DE4D104EA13B70C093B07219D2EFF6CB
SHA256:39BC615842A176DB72D4E0558F3CDCAE23AB0623AD132F815D21DCFBFD4B110E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
22
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5944
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3852
RUXIMICS.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
GET
200
45.15.156.24:443
https://goodhillsenterprise.com/captcha
unknown
text
6.25 Mb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5944
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3852
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5944
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3852
RUXIMICS.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
google.com
  • 142.250.184.206
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
goodhillsenterprise.com
  • 45.15.156.24
unknown
self.events.data.microsoft.com
  • 20.189.173.25
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-07-18_8bffb36d6944dd025a63969aa9f64555_black-basta_cobalt-strike_luca-stealer_satacom_vidar.exe