File name:

2025-05-25_005854ba5854d09fbfca24fce2a16b7c_black-basta_cobalt-strike_luca-stealer_satacom

Full analysis: https://app.any.run/tasks/3e722a57-c9a5-4f26-9441-6dcd89d93bee
Verdict: Malicious activity
Analysis date: May 25, 2025, 12:03:42
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
xmrig
auto-sch
auto-reg
antivm
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 6 sections
MD5:

005854BA5854D09FBFCA24FCE2A16B7C

SHA1:

AD4382B15D4DF08FEC677B95E2F912BDBD6771CC

SHA256:

3D85216E5DAD8A7F384B160447E83614AE2313E7C1D930AE99A9CB648114F8B4

SSDEEP:

12288:vmalOYRoPewONDRZoehSYu2uuDNvlhQUUItyfO4S9yRW7H8UTt:vmalOYUONDRZoe7Gu5voDSARWj8wt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • XMRig has been detected

      • 2025-05-25_005854ba5854d09fbfca24fce2a16b7c_black-basta_cobalt-strike_luca-stealer_satacom.exe (PID: 7312)
      • WinTemp-v4.exe (PID: 7440)
      • Win-v42.exe (PID: 4120)
      • Win-v43.exe (PID: 5116)

    • Known privilege escalation attack

      • dllhost.exe (PID: 7392)

    • Changes Windows Defender settings

      • WinTemp-v4.exe (PID: 7440)

    • Adds process to the Windows Defender exclusion list

      • WinTemp-v4.exe (PID: 7440)

    • Uses Task Scheduler to autorun other applications

      • WinTemp-v4.exe (PID: 7440)

    • Changes the autorun value in the registry

      • WinTemp-v4.exe (PID: 7440)

    • Starts REAGENTC.EXE to disable the Windows Recovery Environment

      • ReAgentc.exe (PID: 1052)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 2025-05-25_005854ba5854d09fbfca24fce2a16b7c_black-basta_cobalt-strike_luca-stealer_satacom.exe (PID: 7312)
      • WinTemp-v4.exe (PID: 7440)

    • Starts POWERSHELL.EXE for commands execution

      • WinTemp-v4.exe (PID: 7440)

    • Executes application which crashes

      • 2025-05-25_005854ba5854d09fbfca24fce2a16b7c_black-basta_cobalt-strike_luca-stealer_satacom.exe (PID: 7312)
      • Win-v43.exe (PID: 5116)
      • Win-v42.exe (PID: 4120)

    • Script adds exclusion process to Windows Defender

      • WinTemp-v4.exe (PID: 7440)

    • The process creates files with name similar to system file names

      • WerFault.exe (PID: 7628)

    • Script adds exclusion path to Windows Defender

      • WinTemp-v4.exe (PID: 7440)

    • There is functionality for VM detection VirtualBox (YARA)

      • WinTemp-v4.exe (PID: 7440)

    • There is functionality for VM detection VMWare (YARA)

      • WinTemp-v4.exe (PID: 7440)

    • Starts CMD.EXE for commands execution

      • WinTemp-v4.exe (PID: 7440)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 7624)
      • cmd.exe (PID: 7308)

    • Takes ownership (TAKEOWN.EXE)

      • cmd.exe (PID: 5776)

    • Uses powercfg.exe to modify the power settings

      • WinTemp-v4.exe (PID: 7440)

    • Hides command output

      • cmd.exe (PID: 7652)

    • Reads security settings of Internet Explorer

      • WinTemp-v4.exe (PID: 7440)

    • Connects to unusual port

      • WinTemp-v4.exe (PID: 7440)

  • INFO

    • Create files in a temporary directory

      • 2025-05-25_005854ba5854d09fbfca24fce2a16b7c_black-basta_cobalt-strike_luca-stealer_satacom.exe (PID: 7312)

    • Reads the computer name

      • 2025-05-25_005854ba5854d09fbfca24fce2a16b7c_black-basta_cobalt-strike_luca-stealer_satacom.exe (PID: 7312)
      • WinTemp-v4.exe (PID: 7440)

    • Reads the machine GUID from the registry

      • 2025-05-25_005854ba5854d09fbfca24fce2a16b7c_black-basta_cobalt-strike_luca-stealer_satacom.exe (PID: 7312)
      • WinTemp-v4.exe (PID: 7440)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 7392)

    • Checks supported languages

      • WinTemp-v4.exe (PID: 7440)
      • 2025-05-25_005854ba5854d09fbfca24fce2a16b7c_black-basta_cobalt-strike_luca-stealer_satacom.exe (PID: 7312)
      • Win-v42.exe (PID: 4120)
      • Win-v43.exe (PID: 5116)

    • Checks transactions between databases Windows and Oracle

      • 2025-05-25_005854ba5854d09fbfca24fce2a16b7c_black-basta_cobalt-strike_luca-stealer_satacom.exe (PID: 7312)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 7628)
      • WinTemp-v4.exe (PID: 7440)
      • WerFault.exe (PID: 6656)
      • WerFault.exe (PID: 2960)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7508)
      • powershell.exe (PID: 8128)
      • powershell.exe (PID: 7980)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7508)
      • powershell.exe (PID: 7980)
      • powershell.exe (PID: 8128)

    • Auto-launch of the file from Registry key

      • WinTemp-v4.exe (PID: 7440)

    • Manual execution by a user

      • Win-v42.exe (PID: 4120)
      • Win-v43.exe (PID: 5116)

    • Checks proxy server information

      • WinTemp-v4.exe (PID: 7440)
      • slui.exe (PID: 7980)

    • Reads the software policy settings

      • WinTemp-v4.exe (PID: 7440)
      • slui.exe (PID: 7980)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:05:13 16:48:38+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.43
CodeSize: 286208
InitializedDataSize: 127488
UninitializedDataSize: -
EntryPoint: 0x1e5f0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
174
Monitored processes
47
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #XMRIG 2025-05-25_005854ba5854d09fbfca24fce2a16b7c_black-basta_cobalt-strike_luca-stealer_satacom.exe CMSTPLUA #XMRIG wintemp-v4.exe powershell.exe no specs conhost.exe no specs werfault.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reagentc.exe no specs #XMRIG win-v42.exe werfault.exe no specs #XMRIG win-v43.exe werfault.exe no specs cmd.exe no specs conhost.exe no specs takeown.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs slui.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
728takeown /F "C:\WINDOWS\System32\reagentc.exe"C:\Windows\System32\takeown.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Takes ownership of a file
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\takeown.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1012\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powercfg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1052reagentc /disableC:\Windows\System32\ReAgentc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Windows Recovery Agent
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reagentc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1512\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2108cmd.exe /C reagentc /disableC:\Windows\System32\cmd.exe—WinTemp-v4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2392schtasks /Create /TN "v4" /TR "C:\Windows\System32\Win-v42.exe" /SC ONLOGON /RL HIGHEST /FC:\Windows\System32\schtasks.exe—WinTemp-v4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2960C:\WINDOWS\system32\WerFault.exe -u -p 4120 -s 448C:\Windows\System32\WerFault.exe—Win-v42.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
4068powercfg /change monitor-timeout-dc 0C:\Windows\System32\powercfg.exe—WinTemp-v4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\powercfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
4120C:\Windows\System32\Win-v42.exeC:\Windows\System32\Win-v42.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\windows\system32\win-v42.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
30 518
Read events
30 443
Write events
15
Delete events
60

Modification events

(PID) Process:(1052) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{a5a30fa2-3d06-4e9f-b5f4-a01df9d1fcba}\Elements\25000004
Operation:delete keyName:(default)
Value:
(PID) Process:(1052) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{a5a30fa2-3d06-4e9f-b5f4-a01df9d1fcba}\Elements
Operation:delete keyName:(default)
Value:
(PID) Process:(1052) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{a5a30fa2-3d06-4e9f-b5f4-a01df9d1fcba}
Operation:delete keyName:(default)
Value:
(PID) Process:(1052) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{a5a30fa2-3d06-4e9f-b5f4-a01df9d1fcba}\Description
Operation:writeName:Type
Value:
269484033
(PID) Process:(1052) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{a5a30fa2-3d06-4e9f-b5f4-a01df9d1fcba}\Elements\24000001
Operation:writeName:Element
Value:
{5b970157-8568-11eb-b45c-806e6f6e6963}
(PID) Process:(1052) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{a5a30fa2-3d06-4e9f-b5f4-a01df9d1fcba}\Elements\25000004
Operation:writeName:Element
Value:
0000000000000000
(PID) Process:(7440) WinTemp-v4.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\$SHconfig\startup
Operation:writeName:v4
Value:
C:\Windows\Win-v41.exe
(PID) Process:(7440) WinTemp-v4.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:v4
Value:
C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\Win-v43.exe
(PID) Process:(1052) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:delete keyName:(default)
Value:
(PID) Process:(1052) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:writeName:Element
Value:
0000000000000000000000000000000006000000000000004800000000000000715E5C2FA985EB1190A89A9B763584210000000000000000745E5C2FA985EB1190A89A9B7635842100000000000000000000000000000000
Executable files
4
Suspicious files
7
Text files
16
Unknown types
1

Dropped files

PID
Process
Filename
Type
7628WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_explorer.exe_e99425b07369e3d19c3c5d478ae046144fb549_06b5b057_11529db8-a081-4989-8470-701d700524eb\Report.wer —
MD5:—
SHA256:—
7508powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_2g1jdtz2.ufr.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1052ReAgentc.exeC:\Windows\System32\Recovery\Winre.wim —
MD5:—
SHA256:—
7628WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD4B8.tmp.WERInternalMetadata.xmlxml
MD5:7140E897EC2A72D759EE5B4760A887AF
SHA256:532B90A6F326348DAE64D042A62D56E339E0EFFE80258C47D46256C067E01DE5
7508powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ia4ki4nt.2t4.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2960WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Win-v42.exe_d31bda1ebf7118c7d7c7aeeb14d1473597d6cc7_78910e5c_2bafca27-4026-41d5-916e-d0c89075447c\Report.wer —
MD5:—
SHA256:—
6656WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Win-v43.exe_596a2daef77f28df3ae3fe8fa5cdcf4e38f13433_b21b66a5_b3148d2a-2602-49c1-bab0-7ce6c1b7af03\Report.wer —
MD5:—
SHA256:—
7628WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD3AD.tmp.dmpbinary
MD5:27BD500BA70FF6CD254260C79377EDE6
SHA256:B52340F1C0F97DEFCD8B6C92CE085BAA9308A7592DDFCD94550B67F8689BB1D3
7980powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_bqil4mie.5ew.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7980powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_e1cy1cbb.33m.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
26
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
404
152.89.61.96:443
https://xai830k.com/sapphire.exe
unknown
html
315 b
malicious
2104
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7440
WinTemp-v4.exe
152.89.61.96:443
xai830k.com
Virtual Systems LLC
UA
malicious
7440
WinTemp-v4.exe
45.144.212.77:7777
—
Bursabil Teknoloji A.S.
UA
malicious
5680
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7980
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.174
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
xai830k.com
  • 152.89.61.96
malicious
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-05-25_005854ba5854d09fbfca24fce2a16b7c_black-basta_cobalt-strike_luca-stealer_satacom