File name:

2025-05-25_005854ba5854d09fbfca24fce2a16b7c_black-basta_cobalt-strike_luca-stealer_satacom

Full analysis: https://app.any.run/tasks/3e722a57-c9a5-4f26-9441-6dcd89d93bee
Verdict: Malicious activity
Analysis date: May 25, 2025, 12:03:42
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
xmrig
auto-sch
auto-reg
antivm
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 6 sections
MD5:

005854BA5854D09FBFCA24FCE2A16B7C

SHA1:

AD4382B15D4DF08FEC677B95E2F912BDBD6771CC

SHA256:

3D85216E5DAD8A7F384B160447E83614AE2313E7C1D930AE99A9CB648114F8B4

SSDEEP:

12288:vmalOYRoPewONDRZoehSYu2uuDNvlhQUUItyfO4S9yRW7H8UTt:vmalOYUONDRZoe7Gu5voDSARWj8wt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • XMRig has been detected

      • 2025-05-25_005854ba5854d09fbfca24fce2a16b7c_black-basta_cobalt-strike_luca-stealer_satacom.exe (PID: 7312)
      • WinTemp-v4.exe (PID: 7440)
      • Win-v42.exe (PID: 4120)
      • Win-v43.exe (PID: 5116)

    • Known privilege escalation attack

      • dllhost.exe (PID: 7392)

    • Adds process to the Windows Defender exclusion list

      • WinTemp-v4.exe (PID: 7440)

    • Uses Task Scheduler to autorun other applications

      • WinTemp-v4.exe (PID: 7440)

    • Changes the autorun value in the registry

      • WinTemp-v4.exe (PID: 7440)

    • Starts REAGENTC.EXE to disable the Windows Recovery Environment

      • ReAgentc.exe (PID: 1052)

    • Changes Windows Defender settings

      • WinTemp-v4.exe (PID: 7440)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 2025-05-25_005854ba5854d09fbfca24fce2a16b7c_black-basta_cobalt-strike_luca-stealer_satacom.exe (PID: 7312)
      • WinTemp-v4.exe (PID: 7440)

    • Script adds exclusion path to Windows Defender

      • WinTemp-v4.exe (PID: 7440)

    • There is functionality for VM detection VirtualBox (YARA)

      • WinTemp-v4.exe (PID: 7440)

    • There is functionality for VM detection VMWare (YARA)

      • WinTemp-v4.exe (PID: 7440)

    • Starts CMD.EXE for commands execution

      • WinTemp-v4.exe (PID: 7440)

    • Executes application which crashes

      • Win-v42.exe (PID: 4120)
      • Win-v43.exe (PID: 5116)
      • 2025-05-25_005854ba5854d09fbfca24fce2a16b7c_black-basta_cobalt-strike_luca-stealer_satacom.exe (PID: 7312)

    • Takes ownership (TAKEOWN.EXE)

      • cmd.exe (PID: 5776)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 7308)
      • cmd.exe (PID: 7624)

    • Uses powercfg.exe to modify the power settings

      • WinTemp-v4.exe (PID: 7440)

    • Reads security settings of Internet Explorer

      • WinTemp-v4.exe (PID: 7440)

    • Hides command output

      • cmd.exe (PID: 7652)

    • Connects to unusual port

      • WinTemp-v4.exe (PID: 7440)

    • Script adds exclusion process to Windows Defender

      • WinTemp-v4.exe (PID: 7440)

    • The process creates files with name similar to system file names

      • WerFault.exe (PID: 7628)

    • Starts POWERSHELL.EXE for commands execution

      • WinTemp-v4.exe (PID: 7440)

  • INFO

    • Checks supported languages

      • 2025-05-25_005854ba5854d09fbfca24fce2a16b7c_black-basta_cobalt-strike_luca-stealer_satacom.exe (PID: 7312)
      • WinTemp-v4.exe (PID: 7440)
      • Win-v42.exe (PID: 4120)
      • Win-v43.exe (PID: 5116)

    • Reads the machine GUID from the registry

      • 2025-05-25_005854ba5854d09fbfca24fce2a16b7c_black-basta_cobalt-strike_luca-stealer_satacom.exe (PID: 7312)
      • WinTemp-v4.exe (PID: 7440)

    • Create files in a temporary directory

      • 2025-05-25_005854ba5854d09fbfca24fce2a16b7c_black-basta_cobalt-strike_luca-stealer_satacom.exe (PID: 7312)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 7628)
      • WinTemp-v4.exe (PID: 7440)
      • WerFault.exe (PID: 2960)
      • WerFault.exe (PID: 6656)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7508)
      • powershell.exe (PID: 7980)
      • powershell.exe (PID: 8128)

    • Checks transactions between databases Windows and Oracle

      • 2025-05-25_005854ba5854d09fbfca24fce2a16b7c_black-basta_cobalt-strike_luca-stealer_satacom.exe (PID: 7312)

    • Reads the computer name

      • 2025-05-25_005854ba5854d09fbfca24fce2a16b7c_black-basta_cobalt-strike_luca-stealer_satacom.exe (PID: 7312)
      • WinTemp-v4.exe (PID: 7440)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 7392)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7980)
      • powershell.exe (PID: 8128)
      • powershell.exe (PID: 7508)

    • Auto-launch of the file from Registry key

      • WinTemp-v4.exe (PID: 7440)

    • Manual execution by a user

      • Win-v43.exe (PID: 5116)
      • Win-v42.exe (PID: 4120)

    • Reads the software policy settings

      • WinTemp-v4.exe (PID: 7440)
      • slui.exe (PID: 7980)

    • Checks proxy server information

      • WinTemp-v4.exe (PID: 7440)
      • slui.exe (PID: 7980)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:05:13 16:48:38+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.43
CodeSize: 286208
InitializedDataSize: 127488
UninitializedDataSize: -
EntryPoint: 0x1e5f0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
174
Monitored processes
47
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #XMRIG 2025-05-25_005854ba5854d09fbfca24fce2a16b7c_black-basta_cobalt-strike_luca-stealer_satacom.exe CMSTPLUA #XMRIG wintemp-v4.exe powershell.exe no specs conhost.exe no specs werfault.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reagentc.exe no specs #XMRIG win-v42.exe werfault.exe no specs #XMRIG win-v43.exe werfault.exe no specs cmd.exe no specs conhost.exe no specs takeown.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs slui.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
728takeown /F "C:\WINDOWS\System32\reagentc.exe"C:\Windows\System32\takeown.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Takes ownership of a file
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\takeown.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1012\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powercfg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1052reagentc /disableC:\Windows\System32\ReAgentc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Windows Recovery Agent
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reagentc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1512\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2108cmd.exe /C reagentc /disableC:\Windows\System32\cmd.exe—WinTemp-v4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2392schtasks /Create /TN "v4" /TR "C:\Windows\System32\Win-v42.exe" /SC ONLOGON /RL HIGHEST /FC:\Windows\System32\schtasks.exe—WinTemp-v4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2960C:\WINDOWS\system32\WerFault.exe -u -p 4120 -s 448C:\Windows\System32\WerFault.exe—Win-v42.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
4068powercfg /change monitor-timeout-dc 0C:\Windows\System32\powercfg.exe—WinTemp-v4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\powercfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
4120C:\Windows\System32\Win-v42.exeC:\Windows\System32\Win-v42.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\windows\system32\win-v42.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
30 518
Read events
30 443
Write events
15
Delete events
60

Modification events

(PID) Process:(1052) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{a5a30fa2-3d06-4e9f-b5f4-a01df9d1fcba}\Elements\25000004
Operation:delete keyName:(default)
Value:
(PID) Process:(1052) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{a5a30fa2-3d06-4e9f-b5f4-a01df9d1fcba}\Elements
Operation:delete keyName:(default)
Value:
(PID) Process:(1052) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{a5a30fa2-3d06-4e9f-b5f4-a01df9d1fcba}
Operation:delete keyName:(default)
Value:
(PID) Process:(1052) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{a5a30fa2-3d06-4e9f-b5f4-a01df9d1fcba}\Description
Operation:writeName:Type
Value:
269484033
(PID) Process:(1052) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{a5a30fa2-3d06-4e9f-b5f4-a01df9d1fcba}\Elements\24000001
Operation:writeName:Element
Value:
{5b970157-8568-11eb-b45c-806e6f6e6963}
(PID) Process:(1052) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{a5a30fa2-3d06-4e9f-b5f4-a01df9d1fcba}\Elements\25000004
Operation:writeName:Element
Value:
0000000000000000
(PID) Process:(7440) WinTemp-v4.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\$SHconfig\startup
Operation:writeName:v4
Value:
C:\Windows\Win-v41.exe
(PID) Process:(7440) WinTemp-v4.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:v4
Value:
C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\Win-v43.exe
(PID) Process:(1052) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:delete keyName:(default)
Value:
(PID) Process:(1052) ReAgentc.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:writeName:Element
Value:
0000000000000000000000000000000006000000000000004800000000000000715E5C2FA985EB1190A89A9B763584210000000000000000745E5C2FA985EB1190A89A9B7635842100000000000000000000000000000000
Executable files
4
Suspicious files
7
Text files
16
Unknown types
1

Dropped files

PID
Process
Filename
Type
7628WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_explorer.exe_e99425b07369e3d19c3c5d478ae046144fb549_06b5b057_11529db8-a081-4989-8470-701d700524eb\Report.wer —
MD5:—
SHA256:—
7508powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ia4ki4nt.2t4.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1052ReAgentc.exeC:\Windows\System32\Recovery\Winre.wim —
MD5:—
SHA256:—
7980powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_bqil4mie.5ew.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7628WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD4B8.tmp.WERInternalMetadata.xmlxml
MD5:7140E897EC2A72D759EE5B4760A887AF
SHA256:532B90A6F326348DAE64D042A62D56E339E0EFFE80258C47D46256C067E01DE5
2960WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Win-v42.exe_d31bda1ebf7118c7d7c7aeeb14d1473597d6cc7_78910e5c_2bafca27-4026-41d5-916e-d0c89075447c\Report.wer —
MD5:—
SHA256:—
6656WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Win-v43.exe_596a2daef77f28df3ae3fe8fa5cdcf4e38f13433_b21b66a5_b3148d2a-2602-49c1-bab0-7ce6c1b7af03\Report.wer —
MD5:—
SHA256:—
7508powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:76516FDFF8EABC187186765527BF3412
SHA256:040543C372F725AA1BBBEDE62CB157E30659611C39CFCF76C32218A2086BA485
7628WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\2025-05-25_005854ba5854d09fbfca24fce2a16b7c_black-basta_cobalt-strike_luca-stealer_satacom.exe.7312.dmpbinary
MD5:705C17D5770CDC972773DAF826C41CD8
SHA256:70DCC384D2C62AAD79EE9E7FB6BE2D7096DB29C32ED7D8084DBC7705CB8DD0E2
7628WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD4E8.tmp.xmlxml
MD5:1707240397C3FDD1A43BF3DA83C87268
SHA256:D1221ACD2EF869CDF2C4FB07AA40709E09C50951B78A629A4C07DD4E6B9C3640
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
26
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
404
152.89.61.96:443
https://xai830k.com/sapphire.exe
unknown
html
315 b
malicious
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7440
WinTemp-v4.exe
152.89.61.96:443
xai830k.com
Virtual Systems LLC
UA
malicious
7440
WinTemp-v4.exe
45.144.212.77:7777
—
Bursabil Teknoloji A.S.
UA
malicious
5680
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7980
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.174
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
xai830k.com
  • 152.89.61.96
malicious
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-05-25_005854ba5854d09fbfca24fce2a16b7c_black-basta_cobalt-strike_luca-stealer_satacom