File name:

2025-06-21_6a74326fe6c0fcb62da2aec319ea127b_cobalt-strike_hijackloader

Full analysis: https://app.any.run/tasks/7f8dc972-82e9-467b-8296-f2759c61056e
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: June 21, 2025, 14:58:49
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
golang
arch-doc
stealer
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, 7 sections
MD5:

6A74326FE6C0FCB62DA2AEC319EA127B

SHA1:

48374483AADA7C15FCB1E86DCE42A9AA0BC6E387

SHA256:

5B6BF0029CC39514D7AE5CA6A57A219A4AAFAC1C7F635AE302BE1E7BCD7DCCE3

SSDEEP:

24576:pUhgfKusaKifemOiNDx5Qf7exyg3fydi2XpdUUT4T:yusaKif+iNDx5QDexygvyAEK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 2025-06-21_6a74326fe6c0fcb62da2aec319ea127b_cobalt-strike_hijackloader.exe (PID: 1068)

    • Actions looks like stealing of personal data

      • explorer.exe (PID: 1700)

    • Steals credentials from Web Browsers

      • explorer.exe (PID: 1700)

  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • 2025-06-21_6a74326fe6c0fcb62da2aec319ea127b_cobalt-strike_hijackloader.exe (PID: 1068)
      • explorer.exe (PID: 1700)

    • Executable content was dropped or overwritten

      • explorer.exe (PID: 1700)

    • Potential Corporate Privacy Violation

      • explorer.exe (PID: 1700)

  • INFO

    • Checks supported languages

      • 2025-06-21_6a74326fe6c0fcb62da2aec319ea127b_cobalt-strike_hijackloader.exe (PID: 1068)

    • Application based on Golang

      • 2025-06-21_6a74326fe6c0fcb62da2aec319ea127b_cobalt-strike_hijackloader.exe (PID: 1068)

    • The sample compiled with english language support

      • 2025-06-21_6a74326fe6c0fcb62da2aec319ea127b_cobalt-strike_hijackloader.exe (PID: 1068)
      • explorer.exe (PID: 1700)

    • Manual execution by a user

      • notepad.exe (PID: 4196)
      • notepad.exe (PID: 5744)
      • notepad.exe (PID: 1356)
      • OpenWith.exe (PID: 6504)
      • OpenWith.exe (PID: 2596)
      • OpenWith.exe (PID: 6428)
      • OpenWith.exe (PID: 6688)
      • OpenWith.exe (PID: 2668)
      • notepad.exe (PID: 4156)
      • notepad.exe (PID: 760)
      • OpenWith.exe (PID: 6356)
      • OpenWith.exe (PID: 7104)
      • OpenWith.exe (PID: 3392)
      • WINWORD.EXE (PID: 6532)
      • OpenWith.exe (PID: 4816)
      • WINWORD.EXE (PID: 4528)
      • WINWORD.EXE (PID: 4832)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 4196)
      • notepad.exe (PID: 5744)
      • notepad.exe (PID: 1356)
      • notepad.exe (PID: 4156)
      • notepad.exe (PID: 760)

    • Reads Microsoft Office registry keys

      • OpenWith.exe (PID: 6504)
      • OpenWith.exe (PID: 6428)
      • OpenWith.exe (PID: 2596)
      • OpenWith.exe (PID: 6688)
      • OpenWith.exe (PID: 7104)
      • OpenWith.exe (PID: 2668)
      • OpenWith.exe (PID: 6356)
      • OpenWith.exe (PID: 4816)
      • OpenWith.exe (PID: 3392)

    • Checks proxy server information

      • slui.exe (PID: 6336)

    • Reads the software policy settings

      • slui.exe (PID: 6336)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: Executable, Large address aware, No debug
PEType: PE32+
LinkerVersion: 3
CodeSize: 515072
InitializedDataSize: 125952
UninitializedDataSize: -
EntryPoint: 0x5b880
OSVersion: 6.1
ImageVersion: 1
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 25.13.6.0
ProductVersionNumber: 25.13.6.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: Secure, manage, and trade blockchain assets.
FileVersion: 25.13.6
InternalName: Setup.exe
LegalCopyright: Copyright B) 2025 Exodus Movement Inc
OriginalFileName: Setup.exe
ProductName: Secure, manage, and trade blockchain assets.
ProductVersion: 25.13.6
SquirrelAwareVersion: 1
CompanyName: Exodus Movement Inc
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
166
Monitored processes
30
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 2025-06-21_6a74326fe6c0fcb62da2aec319ea127b_cobalt-strike_hijackloader.exe no specs explorer.exe chrome.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe no specs notepad.exe no specs chrome.exe no specs msedge.exe no specs notepad.exe no specs notepad.exe no specs chrome.exe no specs openwith.exe no specs msedge.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs rundll32.exe no specs notepad.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs notepad.exe no specs slui.exe openwith.exe no specs winword.exe winword.exe no specs winword.exe no specs ai.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
432"C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe—explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
1
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
760"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\f1575b64-8492-4e8b-b102-4d26e8c70371.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
1068"C:\Users\admin\Desktop\2025-06-21_6a74326fe6c0fcb62da2aec319ea127b_cobalt-strike_hijackloader.exe" C:\Users\admin\Desktop\2025-06-21_6a74326fe6c0fcb62da2aec319ea127b_cobalt-strike_hijackloader.exe—explorer.exe
User:
admin
Company:
Exodus Movement Inc
Integrity Level:
MEDIUM
Description:
Secure, manage, and trade blockchain assets.
Exit code:
0
Version:
25.13.6
Modules
Images
c:\users\admin\desktop\2025-06-21_6a74326fe6c0fcb62da2aec319ea127b_cobalt-strike_hijackloader.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1128"C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe—explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
1
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1204"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
1
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1356"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\Err.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
1700C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe
2025-06-21_6a74326fe6c0fcb62da2aec319ea127b_cobalt-strike_hijackloader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2188"C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe—explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
1
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2532"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2596"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Desktop\key1C:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
25 282
Read events
24 792
Write events
458
Delete events
32

Modification events

(PID) Process:(4320) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(4320) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2532) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2532) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(1128) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
1
(PID) Process:(1204) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
1
(PID) Process:(432) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
2
(PID) Process:(432) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
3
(PID) Process:(6344) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
2
(PID) Process:(6344) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
3
Executable files
30
Suspicious files
132
Text files
21
Unknown types
0

Dropped files

PID
Process
Filename
Type
10682025-06-21_6a74326fe6c0fcb62da2aec319ea127b_cobalt-strike_hijackloader.exeC:\Users\admin\Desktop\Soul.db —
MD5:—
SHA256:—
2188chrome.exeC:\Users\admin\AppData\Local\Temp\Web Databinary
MD5:983A5B37990067066CF80EDDF2426994
SHA256:E499265D1817B9CD52AC502B7BE6DEF5174478CAAAB7DADE263A7754E4E838D3
432chrome.exeC:\Users\admin\AppData\Local\Temp\Cookiesbinary
MD5:3EB66F8F3F058E157563F42DBF644355
SHA256:AD0A6073D226341F699F465BDD35F01E88F0E9D4BCCEC816D6DF06D34F848350
1700explorer.exeC:\Users\admin\hjksfoq.exeexecutable
MD5:9FE91D8225D6018E438AFC7BB393BB65
SHA256:21D0BD2F5870C46CAFA2A3AC4771CE0D907E1E03B926AE8820298F639E3B4FB6
1128chrome.exeC:\Users\admin\AppData\Local\Temp\Login Databinary
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
6532WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbresbinary
MD5:4DCDE7359EE11FBEFEE187B3484806B9
SHA256:9389112CECF24732043F06BDC68AC77DD8419242CBF20C32DA2ADF509F83CA4E
6532WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\CF863C0D-9BCA-4FBB-8C9F-5DC5D1452640xml
MD5:B8A89470FD2E3E347A9DD3B18D205228
SHA256:C820506A73EF9D1D746C4AF2A9349AFA5DAE255BE412E08658F12AFACB5D5F2E
6532WINWORD.EXEC:\Users\admin\Desktop\~$imalsmichael.rtfpgc
MD5:E8E9F6271AB1BA20A9967A387CBFCEDC
SHA256:23F2505E42FCCCD0EEEE4E0D840BC49F0890907965F1CD3F245B52A61C03B5AE
6532WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.datini
MD5:35C0CBEA8B497A0439D347572B3BCEEF
SHA256:577A6039258E422A292B67ED292DDB7CBFD57025799851579CF5EDB7CBB15239
6532WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\animalsmichael.rtf.LNKbinary
MD5:B280A70EDBD2F669E6B639C4041CF6D6
SHA256:5D4C3E5AC3CD61E720F5BF1BD243ABA6CD042A1CFB69E0EA112F97549095AD6F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
90
TCP/UDP connections
98
DNS requests
16
Threats
32

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5944
MoUsoCoreWorker.exe
GET
200
184.24.77.40:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
POST
200
104.21.112.1:443
https://b1.cornmealjustly.lat/Up/b
unknown
—
—
—
4512
RUXIMICS.exe
GET
200
184.24.77.40:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
184.24.77.40:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4512
RUXIMICS.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
104.21.96.1:443
https://b1.cornmealjustly.lat/ujs/f1575b64-8492-4e8b-b102-4d26e8c70371
unknown
text
31.8 Kb
—
—
—
POST
200
104.21.96.1:443
https://b1.cornmealjustly.lat/Up
unknown
—
—
—
—
—
POST
200
104.21.80.1:443
https://b1.cornmealjustly.lat/Up/b
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4512
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
184.24.77.40:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4512
RUXIMICS.exe
184.24.77.40:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
184.24.77.40:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4512
RUXIMICS.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 184.24.77.40
  • 184.24.77.27
  • 184.24.77.37
  • 184.24.77.23
  • 184.24.77.22
  • 184.24.77.15
  • 184.24.77.28
  • 184.24.77.16
  • 184.24.77.30
  • 184.24.77.43
  • 184.24.77.5
  • 184.24.77.18
  • 184.24.77.39
  • 184.24.77.7
  • 184.24.77.9
  • 184.24.77.13
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
officeclient.microsoft.com
  • 52.109.76.240
whitelisted
omex.cdn.office.net
  • 23.50.131.86
  • 23.50.131.87
whitelisted
ecs.office.com
  • 52.123.129.14
  • 52.123.128.14
whitelisted
messaging.lifecycle.office.com
  • 52.111.231.8
whitelisted
self.events.data.microsoft.com
  • 52.168.112.66
  • 20.189.173.10
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ET HUNTING ZIP file exfiltration over raw TCP
—
—
A Network Trojan was detected
ET MALWARE ACR/Amatera Stealer CnC Checkin Attempt
—
—
Misc activity
ET HUNTING ZIP file exfiltration over raw TCP
—
—
Malware Command and Control Activity Detected
ET MALWARE ACR/Amatera Stealer CnC Exfil (POST) M1
—
—
Misc activity
ET HUNTING ZIP file exfiltration over raw TCP
—
—
Malware Command and Control Activity Detected
ET MALWARE ACR/Amatera Stealer CnC Exfil (POST) M1
—
—
Misc activity
ET HUNTING ZIP file exfiltration over raw TCP
—
—
Malware Command and Control Activity Detected
ET MALWARE ACR/Amatera Stealer CnC Exfil (POST) M1
—
—
Misc activity
ET HUNTING ZIP file exfiltration over raw TCP
—
—
Misc activity
ET HUNTING ZIP file exfiltration over raw TCP
Process
Message
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-06-21_6a74326fe6c0fcb62da2aec319ea127b_cobalt-strike_hijackloader