File name:

2025-04-29_1b568687be24eb25a9b24fc2e1e5536c_akira_black-basta_elex_hijackloader_rhadamanthys_smoke-loader

Full analysis: https://app.any.run/tasks/3a0530cf-4e6d-4b63-bbc2-b5f1bf8e16d3
Verdict: Malicious activity
Analysis date: April 29, 2025, 08:54:41
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections
MD5:

1B568687BE24EB25A9B24FC2E1E5536C

SHA1:

47172667C28142660E1A83A3A4C39C57C38C7E40

SHA256:

8E003C11FF8CD2493B09A59739A7ED3AA474AD8ACE54CEC5C2CE0E6C69383BD6

SSDEEP:

98304:iefUuZuKAuf5jTFEkOefUuZuKAuf5jTFziy9/W10abzzpQXPJP0jjiGHaGx/LOL8:kySbzzdr0ijelYuycRu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 2025-04-29_1b568687be24eb25a9b24fc2e1e5536c_akira_black-basta_elex_hijackloader_rhadamanthys_smoke-loader~4.exe (PID: 672)

    • Starts NET.EXE for service management

      • cmd.exe (PID: 4112)
      • cmd.exe (PID: 4408)
      • cmd.exe (PID: 5072)
      • cmd.exe (PID: 6516)
      • cmd.exe (PID: 6048)
      • net.exe (PID: 728)
      • net.exe (PID: 4040)
      • net.exe (PID: 1052)
      • net.exe (PID: 4120)
      • net.exe (PID: 6132)

    • Uses NET.EXE to stop Windows Update service

      • cmd.exe (PID: 4408)
      • net.exe (PID: 4120)

    • Starts NET.EXE to view/add/change user profiles

      • cmd.exe (PID: 6712)
      • net.exe (PID: 3888)

    • Starts NET.EXE to view/change users localgroup

      • cmd.exe (PID: 6808)
      • net.exe (PID: 2088)

    • Uses NET.EXE to stop Windows Security Center service

      • cmd.exe (PID: 6048)
      • net.exe (PID: 6132)

  • SUSPICIOUS

    • Starts a Microsoft application from unusual location

      • 2025-04-29_1b568687be24eb25a9b24fc2e1e5536c_akira_black-basta_elex_hijackloader_rhadamanthys_smoke-loader.exe (PID: 5800)
      • 2025-04-29_1b568687be24eb25a9b24fc2e1e5536c_akira_black-basta_elex_hijackloader_rhadamanthys_smoke-loader.exe (PID: 812)

    • Process drops legitimate windows executable

      • 2025-04-29_1b568687be24eb25a9b24fc2e1e5536c_akira_black-basta_elex_hijackloader_rhadamanthys_smoke-loader.exe (PID: 5800)
      • UpdatAuto.exe (PID: 3332)

    • Starts CMD.EXE for commands execution

      • 2025-04-29_1b568687be24eb25a9b24fc2e1e5536c_akira_black-basta_elex_hijackloader_rhadamanthys_smoke-loader.exe (PID: 5800)
      • UpdatAuto.exe (PID: 3332)

    • Executing commands from a ".bat" file

      • 2025-04-29_1b568687be24eb25a9b24fc2e1e5536c_akira_black-basta_elex_hijackloader_rhadamanthys_smoke-loader.exe (PID: 5800)
      • UpdatAuto.exe (PID: 3332)

    • Starts itself from another location

      • 2025-04-29_1b568687be24eb25a9b24fc2e1e5536c_akira_black-basta_elex_hijackloader_rhadamanthys_smoke-loader.exe (PID: 5800)

    • Executable content was dropped or overwritten

      • 2025-04-29_1b568687be24eb25a9b24fc2e1e5536c_akira_black-basta_elex_hijackloader_rhadamanthys_smoke-loader.exe (PID: 5800)
      • UpdatAuto.exe (PID: 3332)

    • Creates file in the systems drive root

      • UpdatAuto.exe (PID: 3332)
      • 2025-04-29_1b568687be24eb25a9b24fc2e1e5536c_akira_black-basta_elex_hijackloader_rhadamanthys_smoke-loader.exe (PID: 5800)

    • Windows service management via SC.EXE

      • sc.exe (PID: 2096)
      • sc.exe (PID: 6800)
      • sc.exe (PID: 5548)
      • sc.exe (PID: 4464)
      • sc.exe (PID: 5400)

  • INFO

    • The sample compiled with chinese language support

      • 2025-04-29_1b568687be24eb25a9b24fc2e1e5536c_akira_black-basta_elex_hijackloader_rhadamanthys_smoke-loader.exe (PID: 5800)
      • UpdatAuto.exe (PID: 3332)

    • Create files in a temporary directory

      • 2025-04-29_1b568687be24eb25a9b24fc2e1e5536c_akira_black-basta_elex_hijackloader_rhadamanthys_smoke-loader.exe (PID: 5800)
      • UpdatAuto.exe (PID: 3332)

    • Checks supported languages

      • 2025-04-29_1b568687be24eb25a9b24fc2e1e5536c_akira_black-basta_elex_hijackloader_rhadamanthys_smoke-loader.exe (PID: 5800)
      • UpdatAuto.exe (PID: 3332)

    • The sample compiled with english language support

      • 2025-04-29_1b568687be24eb25a9b24fc2e1e5536c_akira_black-basta_elex_hijackloader_rhadamanthys_smoke-loader.exe (PID: 5800)

    • Creates files in the program directory

      • UpdatAuto.exe (PID: 3332)
      • 2025-04-29_1b568687be24eb25a9b24fc2e1e5536c_akira_black-basta_elex_hijackloader_rhadamanthys_smoke-loader.exe (PID: 5800)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Microsoft Visual Basic 6 (63.9)
.exe | Win32 Executable MS Visual C++ (generic) (24.3)
.dll | Win32 Dynamic Link Library (generic) (5.1)
.exe | Win32 Executable (generic) (3.5)
.exe | Generic Win/DOS Executable (1.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2007:03:12 04:30:52+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 102400
InitializedDataSize: 16384
UninitializedDataSize: -
EntryPoint: 0x27dc
OSVersion: 4
ImageVersion: 6.1
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 6.1.0.0
ProductVersionNumber: 6.1.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
Comments: Windows Update Manager for NT
CompanyName: Microsoft Corporation
FileDescription: Windows Update Manager for NT
LegalCopyright: Copyright (C) Microsoft Corp. 1981-1999
ProductName: Microsoft(R) Windows (R) 2000 Operating System
FileVersion: 6.01
ProductVersion: 6.01
InternalName: INCUBUS
OriginalFileName: INCUBUS.exe
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
167
Monitored processes
47
Malicious processes
4
Suspicious processes
7

Behavior graph

Click at the process to see the details
start 2025-04-29_1b568687be24eb25a9b24fc2e1e5536c_akira_black-basta_elex_hijackloader_rhadamanthys_smoke-loader.exe cmd.exe no specs conhost.exe no specs updatauto.exe cmd.exe no specs conhost.exe no specs 2025-04-29_1b568687be24eb25a9b24fc2e1e5536c_akira_black-basta_elex_hijackloader_rhadamanthys_smoke-loader~4.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs slui.exe no specs 2025-04-29_1b568687be24eb25a9b24fc2e1e5536c_akira_black-basta_elex_hijackloader_rhadamanthys_smoke-loader.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
6722025-04-29_1b568687be24eb25a9b24fc2e1e5536c_akira_black-basta_elex_hijackloader_rhadamanthys_smoke-loader~4.exeC:\Users\admin\Desktop\2025-04-29_1b568687be24eb25a9b24fc2e1e5536c_akira_black-basta_elex_hijackloader_rhadamanthys_smoke-loader~4.exe—2025-04-29_1b568687be24eb25a9b24fc2e1e5536c_akira_black-basta_elex_hijackloader_rhadamanthys_smoke-loader.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Chrome
Exit code:
3222601730
Version:
123.0.6312.123
Modules
Images
c:\users\admin\desktop\2025-04-29_1b568687be24eb25a9b24fc2e1e5536c_akira_black-basta_elex_hijackloader_rhadamanthys_smoke-loader~4.exe
c:\windows\system32\ntdll.dll
728net start TlntSvrC:\Windows\SysWOW64\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
812"C:\Users\admin\Desktop\2025-04-29_1b568687be24eb25a9b24fc2e1e5536c_akira_black-basta_elex_hijackloader_rhadamanthys_smoke-loader.exe" C:\Users\admin\Desktop\2025-04-29_1b568687be24eb25a9b24fc2e1e5536c_akira_black-basta_elex_hijackloader_rhadamanthys_smoke-loader.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Update Manager for NT
Exit code:
3221226540
Version:
6.01
Modules
Images
c:\users\admin\desktop\2025-04-29_1b568687be24eb25a9b24fc2e1e5536c_akira_black-basta_elex_hijackloader_rhadamanthys_smoke-loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1020\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1052net stop srserviceC:\Windows\SysWOW64\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2088net localgroup administrators helpassistant /addC:\Windows\SysWOW64\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2096sc config srservice start= disabledC:\Windows\SysWOW64\sc.exe—2025-04-29_1b568687be24eb25a9b24fc2e1e5536c_akira_black-basta_elex_hijackloader_rhadamanthys_smoke-loader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2152\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2268\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2284\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
667
Read events
667
Write events
0
Delete events
0

Modification events

No data
Executable files
20
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
58002025-04-29_1b568687be24eb25a9b24fc2e1e5536c_akira_black-basta_elex_hijackloader_rhadamanthys_smoke-loader.exeC:\ntldr~6executable
MD5:69E731FB1A87669C89ED11A8ED5EAD0D
SHA256:CD4FBA13CE392CA0A75805308526F1857DD0EB444B3E267A704F6BD8CB7FB110
58002025-04-29_1b568687be24eb25a9b24fc2e1e5536c_akira_black-basta_elex_hijackloader_rhadamanthys_smoke-loader.exeC:\Windows\SysWOW64\Option.battext
MD5:1D04ABF39E9DF55EED1D04430CC21EB8
SHA256:0BC485263CF8A962E64DB0B88F156F2A9AF1B81ECFDB1CF9111D497E85DF70F3
3332UpdatAuto.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe —
MD5:—
SHA256:—
58002025-04-29_1b568687be24eb25a9b24fc2e1e5536c_akira_black-basta_elex_hijackloader_rhadamanthys_smoke-loader.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe —
MD5:—
SHA256:—
58002025-04-29_1b568687be24eb25a9b24fc2e1e5536c_akira_black-basta_elex_hijackloader_rhadamanthys_smoke-loader.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe —
MD5:—
SHA256:—
58002025-04-29_1b568687be24eb25a9b24fc2e1e5536c_akira_black-basta_elex_hijackloader_rhadamanthys_smoke-loader.exeC:\ntldr~8executable
MD5:69E731FB1A87669C89ED11A8ED5EAD0D
SHA256:CD4FBA13CE392CA0A75805308526F1857DD0EB444B3E267A704F6BD8CB7FB110
3332UpdatAuto.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exeexecutable
MD5:F177703A09315C8B0CEDAC84267B9200
SHA256:709C798BAFCCC93D47F36C45E686785E46475A0A8B1527892CCD1018F57803DD
58002025-04-29_1b568687be24eb25a9b24fc2e1e5536c_akira_black-basta_elex_hijackloader_rhadamanthys_smoke-loader.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeexecutable
MD5:00E9D7E5134DAB462AE16556152351F9
SHA256:00DF307E3D94EAC39A43E6E4CA4969DF79555D57EAFD1A7B4AD547F87694A244
58002025-04-29_1b568687be24eb25a9b24fc2e1e5536c_akira_black-basta_elex_hijackloader_rhadamanthys_smoke-loader.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exeexecutable
MD5:D9F152BACEB84C3942884DDFF540D2D4
SHA256:0498FB0AECA284B27903FC9225D6772C71714E9893422778E0C7758FACE00000
3332UpdatAuto.exeC:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exeexecutable
MD5:36E005471194B521E75FC3BE3055FBCD
SHA256:38EE800F851BC1820BFE7DC5BF116ABB733BD49D449EE9DB4B884ECBE5E73161
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
33
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
304
20.12.23.50:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
7652
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
7652
SIHClient.exe
GET
200
23.216.77.10:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
7652
SIHClient.exe
GET
200
23.216.77.10:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
7652
SIHClient.exe
GET
200
23.216.77.10:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7652
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
—
—
GET
200
13.85.23.206:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
—
—
—
7652
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
7652
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
7652
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7652
SIHClient.exe
20.12.23.50:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7652
SIHClient.exe
23.216.77.10:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
7652
SIHClient.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
7652
SIHClient.exe
13.85.23.206:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
960
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 142.250.184.206
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
crl.microsoft.com
  • 23.216.77.10
  • 23.216.77.36
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.11
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-04-29_1b568687be24eb25a9b24fc2e1e5536c_akira_black-basta_elex_hijackloader_rhadamanthys_smoke-loader