File name:

2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta

Full analysis: https://app.any.run/tasks/7857c383-72fd-4858-8750-18c66f345b46
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 31, 2025, 11:14:48
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
autoit
loader
xworm
remote
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 6 sections
MD5:

B5201201273C1580A4DF673C30BFBF4D

SHA1:

2E656011D4983EE00AF5ADEDD03C637DE045935B

SHA256:

58229092085D5EBF56B8E04A42636665737106A1C31798962B462310F464A3E8

SSDEEP:

24576:Op+/4UURxUruRrax70p5O9Qx+aAm0vYRO8t4wX:OE/XUraxm5O9QMal0QRO8t40

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe (PID: 7396)

    • Changes Windows Defender settings

      • 2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe (PID: 7464)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 7488)

    • Adds path to the Windows Defender exclusion list

      • 2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe (PID: 7464)

    • Create files in the Startup directory

      • windowsupdate.exe (PID: 7928)

    • XWORM has been detected (YARA)

      • windowsupdate.exe (PID: 7928)

    • XWORM has been detected (SURICATA)

      • windowsupdate.exe (PID: 7928)

  • SUSPICIOUS

    • Starts POWERSHELL.EXE for commands execution

      • 2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe (PID: 7464)

    • Script adds exclusion path to Windows Defender

      • 2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe (PID: 7464)

    • Uses REG/REGEDIT.EXE to modify registry

      • 2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe (PID: 7464)

    • Reads security settings of Internet Explorer

      • 2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe (PID: 7464)

    • Executable content was dropped or overwritten

      • 2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe (PID: 7464)
      • windowsupdate.exe (PID: 7928)

    • Reads the date of Windows installation

      • 2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe (PID: 7464)

    • Potential Corporate Privacy Violation

      • 2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe (PID: 7464)

    • Connects to unusual port

      • windowsupdate.exe (PID: 7928)

    • Contacting a server suspected of hosting an CnC

      • windowsupdate.exe (PID: 7928)

  • INFO

    • Reads mouse settings

      • 2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe (PID: 7464)

    • The sample compiled with english language support

      • 2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe (PID: 7464)

    • Checks supported languages

      • 2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe (PID: 7464)
      • windowsupdate.exe (PID: 7928)

    • Reads the computer name

      • 2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe (PID: 7464)
      • windowsupdate.exe (PID: 7928)

    • Checks proxy server information

      • 2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe (PID: 7464)
      • slui.exe (PID: 7308)

    • Create files in a temporary directory

      • 2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe (PID: 7464)

    • Creates files or folders in the user directory

      • 2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe (PID: 7464)
      • windowsupdate.exe (PID: 7928)

    • Process checks computer location settings

      • 2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe (PID: 7464)

    • Reads the machine GUID from the registry

      • windowsupdate.exe (PID: 7928)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7488)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7488)

    • Reads the software policy settings

      • slui.exe (PID: 7308)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

XWorm

(PID) Process(7928) windowsupdate.exe
C2bot2025.zapto.org:8877
Keys
AES<123456789>
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameXWorm V5.2
MutexcPhXGOLJLA9BaEXT
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:03:31 00:04:46+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.16
CodeSize: 734208
InitializedDataSize: 577536
UninitializedDataSize: -
EntryPoint: 0x2549c
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (British)
CharacterSet: Unicode
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
17
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe powershell.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs #XWORM windowsupdate.exe svchost.exe slui.exe 2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
7308C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7396"C:\Users\admin\Desktop\2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe" C:\Users\admin\Desktop\2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe
c:\windows\system32\ntdll.dll
7464"C:\Users\admin\Desktop\2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe" C:\Users\admin\Desktop\2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\psapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
7488powershell -WindowStyle Hidden -Command Add-MpPreference -ExclusionPath C:\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
7496\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7504reg add HKLM\SOFTWARE\Policies\Microsoft\Windows Defender /v DisableAntiSpyware /t REG_DWORD /d 1 /fC:\Windows\System32\reg.exe—2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
7524reg add HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /fC:\Windows\System32\reg.exe—2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
7536\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—reg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7548reg add HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /fC:\Windows\System32\reg.exe—2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
10 273
Read events
10 270
Write events
3
Delete events
0

Modification events

(PID) Process:(7464) 2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7464) 2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7464) 2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
4
Suspicious files
2
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
74642025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exeC:\Users\admin\AppData\Local\Temp\tmp4687.tmpexecutable
MD5:5B6D504E295F3C95BA551F983E80ECA7
SHA256:7A72281B6C126A481F2BAC591525A0EA487BAE627C1B1B1986CF1A079FB537FA
74642025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exeC:\Users\admin\Desktop\windowsupdate.exeexecutable
MD5:5B6D504E295F3C95BA551F983E80ECA7
SHA256:7A72281B6C126A481F2BAC591525A0EA487BAE627C1B1B1986CF1A079FB537FA
7488powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ye3rg3ex.jlo.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7928windowsupdate.exeC:\Users\admin\AppData\Roaming\XClient.exeexecutable
MD5:5B6D504E295F3C95BA551F983E80ECA7
SHA256:7A72281B6C126A481F2BAC591525A0EA487BAE627C1B1B1986CF1A079FB537FA
7488powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:831123CE930380454B492439DA23DE87
SHA256:A76D6A340B012734112B6F1FE10CADC9BF875578E733B89DA8E3ADD04D13AEB2
7488powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_vnxisxky.szz.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
74642025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\panel[1].exeexecutable
MD5:5B6D504E295F3C95BA551F983E80ECA7
SHA256:7A72281B6C126A481F2BAC591525A0EA487BAE627C1B1B1986CF1A079FB537FA
7928windowsupdate.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnkbinary
MD5:6099B313C1B0426F8DCCA46E68BC0909
SHA256:0D101046D829F6C912145FB87AE736E0CFE9A884E0F1BC4D614C8C82E90334CB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
23
DNS requests
7
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.216.77.42:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
825 b
whitelisted
7464
2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe
GET
200
103.153.64.233:80
http://tiendev.click/panel.exe
VN
executable
34.0 Kb
malicious
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
US
xml
512 b
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
US
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2656
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7464
2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe
103.153.64.233:80
tiendev.click
Hanoi Technology and Equipment Joint Stock Company
VN
malicious
2104
svchost.exe
23.216.77.42:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
7928
windowsupdate.exe
222.252.52.129:8877
bot2025.zapto.org
VNPT Corp
VN
malicious
7188
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7308
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.46
whitelisted
tiendev.click
  • 103.153.64.233
malicious
crl.microsoft.com
  • 23.216.77.42
  • 23.216.77.6
  • 23.216.77.8
  • 23.216.77.22
  • 23.216.77.28
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
bot2025.zapto.org
  • 222.252.52.129
malicious
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

PID
Process
Class
Message
7464
2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe
Potential Corporate Privacy Violation
ET INFO Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile
7464
2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe
A Network Trojan was detected
ET HUNTING SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016
7464
2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe
Misc activity
ET INFO AutoIt User Agent Executable Request
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DNS Query to DynDNS Domain *.zapto .org
7928
windowsupdate.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Xworm TCP Packet
7464
2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7464
2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta.exe
Misc activity
ET HUNTING Possible EXE Download From Suspicious TLD
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DNS Query to DynDNS Domain *.zapto .org
7928
windowsupdate.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Xworm TCP Packet
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-03-31_b5201201273c1580a4df673c30bfbf4d_agent-tesla_black-basta