File name:

2025-06-21_6a74326fe6c0fcb62da2aec319ea127b_cobalt-strike_hijackloader

Full analysis: https://app.any.run/tasks/7f8dc972-82e9-467b-8296-f2759c61056e
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: June 21, 2025, 14:58:49
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
golang
arch-doc
stealer
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, 7 sections
MD5:

6A74326FE6C0FCB62DA2AEC319EA127B

SHA1:

48374483AADA7C15FCB1E86DCE42A9AA0BC6E387

SHA256:

5B6BF0029CC39514D7AE5CA6A57A219A4AAFAC1C7F635AE302BE1E7BCD7DCCE3

SSDEEP:

24576:pUhgfKusaKifemOiNDx5Qf7exyg3fydi2XpdUUT4T:yusaKif+iNDx5QDexygvyAEK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 2025-06-21_6a74326fe6c0fcb62da2aec319ea127b_cobalt-strike_hijackloader.exe (PID: 1068)

    • Actions looks like stealing of personal data

      • explorer.exe (PID: 1700)

    • Steals credentials from Web Browsers

      • explorer.exe (PID: 1700)

  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • 2025-06-21_6a74326fe6c0fcb62da2aec319ea127b_cobalt-strike_hijackloader.exe (PID: 1068)
      • explorer.exe (PID: 1700)

    • Potential Corporate Privacy Violation

      • explorer.exe (PID: 1700)

    • Executable content was dropped or overwritten

      • explorer.exe (PID: 1700)

  • INFO

    • Application based on Golang

      • 2025-06-21_6a74326fe6c0fcb62da2aec319ea127b_cobalt-strike_hijackloader.exe (PID: 1068)

    • The sample compiled with english language support

      • 2025-06-21_6a74326fe6c0fcb62da2aec319ea127b_cobalt-strike_hijackloader.exe (PID: 1068)
      • explorer.exe (PID: 1700)

    • Checks supported languages

      • 2025-06-21_6a74326fe6c0fcb62da2aec319ea127b_cobalt-strike_hijackloader.exe (PID: 1068)

    • Manual execution by a user

      • notepad.exe (PID: 4196)
      • notepad.exe (PID: 5744)
      • notepad.exe (PID: 1356)
      • OpenWith.exe (PID: 6504)
      • OpenWith.exe (PID: 2596)
      • OpenWith.exe (PID: 6428)
      • OpenWith.exe (PID: 6688)
      • OpenWith.exe (PID: 2668)
      • notepad.exe (PID: 4156)
      • OpenWith.exe (PID: 6356)
      • OpenWith.exe (PID: 7104)
      • OpenWith.exe (PID: 3392)
      • notepad.exe (PID: 760)
      • OpenWith.exe (PID: 4816)
      • WINWORD.EXE (PID: 6532)
      • WINWORD.EXE (PID: 4528)
      • WINWORD.EXE (PID: 4832)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 4196)
      • notepad.exe (PID: 5744)
      • notepad.exe (PID: 1356)
      • notepad.exe (PID: 4156)
      • notepad.exe (PID: 760)

    • Reads Microsoft Office registry keys

      • OpenWith.exe (PID: 6504)
      • OpenWith.exe (PID: 2596)
      • OpenWith.exe (PID: 6428)
      • OpenWith.exe (PID: 6688)
      • OpenWith.exe (PID: 2668)
      • OpenWith.exe (PID: 7104)
      • OpenWith.exe (PID: 6356)
      • OpenWith.exe (PID: 3392)
      • OpenWith.exe (PID: 4816)

    • Reads the software policy settings

      • slui.exe (PID: 6336)

    • Checks proxy server information

      • slui.exe (PID: 6336)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: Executable, Large address aware, No debug
PEType: PE32+
LinkerVersion: 3
CodeSize: 515072
InitializedDataSize: 125952
UninitializedDataSize: -
EntryPoint: 0x5b880
OSVersion: 6.1
ImageVersion: 1
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 25.13.6.0
ProductVersionNumber: 25.13.6.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: Secure, manage, and trade blockchain assets.
FileVersion: 25.13.6
InternalName: Setup.exe
LegalCopyright: Copyright B) 2025 Exodus Movement Inc
OriginalFileName: Setup.exe
ProductName: Secure, manage, and trade blockchain assets.
ProductVersion: 25.13.6
SquirrelAwareVersion: 1
CompanyName: Exodus Movement Inc
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
166
Monitored processes
30
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 2025-06-21_6a74326fe6c0fcb62da2aec319ea127b_cobalt-strike_hijackloader.exe no specs explorer.exe chrome.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe no specs notepad.exe no specs chrome.exe no specs msedge.exe no specs notepad.exe no specs notepad.exe no specs chrome.exe no specs openwith.exe no specs msedge.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs rundll32.exe no specs notepad.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs notepad.exe no specs slui.exe openwith.exe no specs winword.exe winword.exe no specs winword.exe no specs ai.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
432"C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe—explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
1
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
760"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\f1575b64-8492-4e8b-b102-4d26e8c70371.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
1068"C:\Users\admin\Desktop\2025-06-21_6a74326fe6c0fcb62da2aec319ea127b_cobalt-strike_hijackloader.exe" C:\Users\admin\Desktop\2025-06-21_6a74326fe6c0fcb62da2aec319ea127b_cobalt-strike_hijackloader.exe—explorer.exe
User:
admin
Company:
Exodus Movement Inc
Integrity Level:
MEDIUM
Description:
Secure, manage, and trade blockchain assets.
Exit code:
0
Version:
25.13.6
Modules
Images
c:\users\admin\desktop\2025-06-21_6a74326fe6c0fcb62da2aec319ea127b_cobalt-strike_hijackloader.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1128"C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe—explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
1
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1204"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
1
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1356"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\Err.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
1700C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe
2025-06-21_6a74326fe6c0fcb62da2aec319ea127b_cobalt-strike_hijackloader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2188"C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe—explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
1
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2532"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2596"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Desktop\key1C:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
25 282
Read events
24 792
Write events
458
Delete events
32

Modification events

(PID) Process:(4320) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(4320) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2532) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2532) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(1128) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
1
(PID) Process:(1204) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
1
(PID) Process:(432) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
2
(PID) Process:(432) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
3
(PID) Process:(6344) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
2
(PID) Process:(6344) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
3
Executable files
30
Suspicious files
132
Text files
21
Unknown types
0

Dropped files

PID
Process
Filename
Type
10682025-06-21_6a74326fe6c0fcb62da2aec319ea127b_cobalt-strike_hijackloader.exeC:\Users\admin\Desktop\Soul.db —
MD5:—
SHA256:—
432chrome.exeC:\Users\admin\AppData\Local\Temp\Cookiesbinary
MD5:3EB66F8F3F058E157563F42DBF644355
SHA256:AD0A6073D226341F699F465BDD35F01E88F0E9D4BCCEC816D6DF06D34F848350
2188chrome.exeC:\Users\admin\AppData\Local\Temp\Web Databinary
MD5:983A5B37990067066CF80EDDF2426994
SHA256:E499265D1817B9CD52AC502B7BE6DEF5174478CAAAB7DADE263A7754E4E838D3
6532WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbresbinary
MD5:4DCDE7359EE11FBEFEE187B3484806B9
SHA256:9389112CECF24732043F06BDC68AC77DD8419242CBF20C32DA2ADF509F83CA4E
6532WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmbinary
MD5:C52A911C31781206F5D7EC205A7C47E4
SHA256:6819BE41BBDFD0CCA2785714B0DB275B3E695C352227166F857D9E18CE2E47C1
6532WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.datini
MD5:35C0CBEA8B497A0439D347572B3BCEEF
SHA256:577A6039258E422A292B67ED292DDB7CBFD57025799851579CF5EDB7CBB15239
6532WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\CF863C0D-9BCA-4FBB-8C9F-5DC5D1452640xml
MD5:B8A89470FD2E3E347A9DD3B18D205228
SHA256:C820506A73EF9D1D746C4AF2A9349AFA5DAE255BE412E08658F12AFACB5D5F2E
6532WINWORD.EXEC:\Users\admin\Desktop\~$ouniversity.rtfbinary
MD5:0325D3245BF4035561B4F1BAE88D67B9
SHA256:A2B4FB316EDE8F61FE7CA19C9967F0CEA89A1D2959CF1CD31A6419E357BE4BF5
6532WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbresbinary
MD5:96B238FCC314BBD899F4D1B76B5EA621
SHA256:BFBA165C0F8B297FA04158052E8E231143CBB4F11A1C1547591C54FC4166EB7E
6532WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bintext
MD5:1CA8F0E7BA74E9B5880596AE698C5990
SHA256:E6636C94E7096ED8EE9623535EE97C74FC0592B55DCDB45A3B3C16D7AA483BEC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
90
TCP/UDP connections
98
DNS requests
16
Threats
32

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5944
MoUsoCoreWorker.exe
GET
200
184.24.77.40:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4512
RUXIMICS.exe
GET
200
184.24.77.40:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
184.24.77.40:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4512
RUXIMICS.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
104.21.96.1:443
https://b1.cornmealjustly.lat/ujs/f1575b64-8492-4e8b-b102-4d26e8c70371
unknown
text
31.8 Kb
unknown
—
—
POST
200
104.21.96.1:443
https://b1.cornmealjustly.lat/Up
unknown
—
—
unknown
—
—
POST
200
104.21.16.1:443
https://b1.cornmealjustly.lat/Up/b
unknown
—
—
unknown
—
—
POST
200
104.21.80.1:443
https://b1.cornmealjustly.lat/Up/b
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4512
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
184.24.77.40:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4512
RUXIMICS.exe
184.24.77.40:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
184.24.77.40:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4512
RUXIMICS.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 184.24.77.40
  • 184.24.77.27
  • 184.24.77.37
  • 184.24.77.23
  • 184.24.77.22
  • 184.24.77.15
  • 184.24.77.28
  • 184.24.77.16
  • 184.24.77.30
  • 184.24.77.43
  • 184.24.77.5
  • 184.24.77.18
  • 184.24.77.39
  • 184.24.77.7
  • 184.24.77.9
  • 184.24.77.13
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
officeclient.microsoft.com
  • 52.109.76.240
whitelisted
omex.cdn.office.net
  • 23.50.131.86
  • 23.50.131.87
whitelisted
ecs.office.com
  • 52.123.129.14
  • 52.123.128.14
whitelisted
messaging.lifecycle.office.com
  • 52.111.231.8
whitelisted
self.events.data.microsoft.com
  • 52.168.112.66
  • 20.189.173.10
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ET HUNTING ZIP file exfiltration over raw TCP
—
—
A Network Trojan was detected
ET MALWARE ACR/Amatera Stealer CnC Checkin Attempt
—
—
Misc activity
ET HUNTING ZIP file exfiltration over raw TCP
—
—
Malware Command and Control Activity Detected
ET MALWARE ACR/Amatera Stealer CnC Exfil (POST) M1
—
—
Misc activity
ET HUNTING ZIP file exfiltration over raw TCP
—
—
Malware Command and Control Activity Detected
ET MALWARE ACR/Amatera Stealer CnC Exfil (POST) M1
—
—
Misc activity
ET HUNTING ZIP file exfiltration over raw TCP
—
—
Malware Command and Control Activity Detected
ET MALWARE ACR/Amatera Stealer CnC Exfil (POST) M1
—
—
Misc activity
ET HUNTING ZIP file exfiltration over raw TCP
—
—
Misc activity
ET HUNTING ZIP file exfiltration over raw TCP
Process
Message
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-06-21_6a74326fe6c0fcb62da2aec319ea127b_cobalt-strike_hijackloader