File name:

2025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber

Full analysis: https://app.any.run/tasks/05ae4bb2-a5ae-4442-b546-7c868666f0ff
Verdict: Malicious activity
Analysis date: June 01, 2025, 17:08:51
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

6E32FF96764D762D4D514E13779AECD2

SHA1:

440F69BD98BCCF4E37F36F1EDE5E93F772908B3C

SHA256:

9F9AFA441E2F0E16955CE036D38C27D3B6D7A53400BF808F496DC504A4223CA1

SSDEEP:

24576:daNjlcI4u2mN+8t6GUVLyXxgDU+LOP0RBjgRtl23I8BaFfvLAnVq:dsjlcFu2mN+8t6GUVLyXxgDU+LOP0Rdb

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE for service management

      • net.exe (PID: 7420)
      • 2025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exe (PID: 5776)
      • net.exe (PID: 1852)
      • net.exe (PID: 7832)
      • net.exe (PID: 2064)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • 2025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exe (PID: 5776)

    • The process creates files with name similar to system file names

      • 2025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exe (PID: 5776)

    • Executable content was dropped or overwritten

      • 2025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exe (PID: 5776)

    • Creates files in the driver directory

      • 2025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exe (PID: 5776)

    • Drops a system driver (possible attempt to evade defenses)

      • 2025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exe (PID: 5776)

    • Creates a software uninstall entry

      • 2025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exe (PID: 5776)

    • Executes as Windows Service

      • nethtsrv.exe (PID: 776)
      • netupdsrv.exe (PID: 4200)

    • Creates or modifies Windows services

      • installd.exe (PID: 1760)

  • INFO

    • Checks supported languages

      • 2025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exe (PID: 5776)
      • netupdsrv.exe (PID: 924)
      • nethtsrv.exe (PID: 776)
      • netupdsrv.exe (PID: 4200)
      • installd.exe (PID: 1760)
      • nethtsrv.exe (PID: 6252)

    • The sample compiled with english language support

      • 2025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exe (PID: 5776)

    • Create files in a temporary directory

      • 2025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exe (PID: 5776)

    • The sample compiled with russian language support

      • 2025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exe (PID: 5776)

    • Creates files in the program directory

      • 2025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exe (PID: 5776)

    • Reads the computer name

      • nethtsrv.exe (PID: 776)
      • netupdsrv.exe (PID: 4200)
      • installd.exe (PID: 1760)
      • nethtsrv.exe (PID: 6252)
      • netupdsrv.exe (PID: 924)

    • Checks proxy server information

      • slui.exe (PID: 8132)

    • Reads the software policy settings

      • slui.exe (PID: 8132)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2014:09:10 14:59:43+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 197120
InitializedDataSize: 515072
UninitializedDataSize: -
EntryPoint: 0x17610
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.0.3.622
ProductVersionNumber: 1.0.3.622
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
FileDescription: win32exe installer
FileVersion: 1.0.3.622
LegalCopyright: Copyright 2013-2014
ProductName: win32exe
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
22
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 2025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exe net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs installd.exe no specs nethtsrv.exe no specs conhost.exe no specs netupdsrv.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs nethtsrv.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs netupdsrv.exe no specs slui.exe 2025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
660\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
776C:\WINDOWS\SysWOW64\nethtsrv.exeC:\Windows\SysWOW64\nethtsrv.exe—services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Version:
1.2.0.5
Modules
Images
c:\windows\syswow64\nethtsrv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
924"C:\WINDOWS\system32\netupdsrv.exe" -nfdi C:\Windows\SysWOW64\netupdsrv.exe—2025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.2.0.5
Modules
Images
c:\windows\syswow64\netupdsrv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1760"C:\WINDOWS\system32\installd.exe" nethfdrv C:\Windows\SysWOW64\installd.exe—2025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\windows\syswow64\installd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1852net stop serviceupdaterC:\Windows\SysWOW64\net.exe—2025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2064net start serviceupdaterC:\Windows\SysWOW64\net.exe—2025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2552C:\WINDOWS\system32\net1 start nethttpserviceC:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
4188\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netupdsrv.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4200C:\WINDOWS\SysWOW64\netupdsrv.exeC:\Windows\SysWOW64\netupdsrv.exe—services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Version:
1.2.0.5
Modules
Images
c:\windows\syswow64\netupdsrv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4404C:\WINDOWS\system32\net1 stop nethttpserviceC:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
Total events
4 206
Read events
4 184
Write events
22
Delete events
0

Modification events

(PID) Process:(5776) 2025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Client
Operation:writeName:cid
Value:
6919
(PID) Process:(5776) 2025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Client
Operation:writeName:cname
Value:
draziWsreffO
(PID) Process:(5776) 2025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Client
Operation:writeName:sid
Value:
00000000000000000000000000000000
(PID) Process:(5776) 2025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Client
Operation:writeName:i
Value:
20250601170903
(PID) Process:(5776) 2025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\inethnfd
Operation:writeName:UninstallString
Value:
"C:\Program Files (x86)\Common Files\Config\uninstinethnfd.exe"
(PID) Process:(5776) 2025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\inethnfd
Operation:writeName:QuietUninstallString
Value:
"C:\Program Files (x86)\Common Files\Config\uninstinethnfd.exe" /S
(PID) Process:(5776) 2025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\inethnfd
Operation:writeName:DisplayIcon
Value:
%C:\Program Files (x86)\Common Files\Config\uninstinethnfd.exe
(PID) Process:(5776) 2025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\inethnfd
Operation:writeName:DisplayName
Value:
OffersWizard Network System Driver
(PID) Process:(5776) 2025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\inethnfd
Operation:writeName:DisplayVersion
Value:
1.0.0.3001
(PID) Process:(5776) 2025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\inethnfd
Operation:writeName:Publisher
Value:
Executable files
10
Suspicious files
2
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
57762025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exeC:\Users\admin\Desktop\_U3gvmW2H8Mobinary
MD5:29E91C9FE234CE2E0D34786EA5E26747
SHA256:448DE7AE82E8F5656F5DE37D0F72437338F2B2697172D95A1B153D0F902C34EC
57762025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exeC:\Users\admin\AppData\Local\Temp\nsy14EA.tmp\System.dllexecutable
MD5:C17103AE9072A06DA581DEC998343FC1
SHA256:DC58D8AD81CACB0C1ED72E33BFF8F23EA40B5252B5BB55D393A0903E6819AE2F
57762025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exeC:\Program Files (x86)\Common Files\Config\ver.xmlxml
MD5:103BFD464A383CC76FB3857833355B2A
SHA256:187A9B34DFFC8E03D2FBF571DE92EC1B1AD0B6108D99B51CB2EC8D1E8D8BC48F
57762025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exeC:\Program Files (x86)\Common Files\Config\data.xmlxml
MD5:C1FFBE71564098D794B5C7AAC6FB0428
SHA256:73FE851CAC16BBE9E8B71A609D03AAA3F9D80B168538AD7DA4A3BD6676D95D7A
57762025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exeC:\Windows\SysWOW64\hfnapi.dllexecutable
MD5:B5975A21EAB250939B471E8777390484
SHA256:5242C4862876537E1263AC39C40FDF934590E5C4063D1F12E889B7A0E1A6C538
57762025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exeC:\Windows\SysWOW64\hfpapi.dllexecutable
MD5:D6E47207C1FFAB0132E990E854B775BB
SHA256:3984DC899D42364A0C0FF7861B19A551FB5309AB7879CE40BB8ABECF27109882
57762025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exeC:\Users\admin\Desktop\_UPt7c2bNNDSexecutable
MD5:F16BB35C42A8ABD2E2A6B8BCAC94CDAF
SHA256:40BB9AF18D0338CB01564E334C6C776AC898C4679B94A7DDC78C318FE97ECC9F
57762025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exeC:\Windows\System32\drivers\nethfdrv.sysexecutable
MD5:24526EFC82EDD6EE19A6ABB1CDC3C092
SHA256:C828F5C930E24B52C690EE70B6BB0C291A211798CE0E7EE33E71B9574FECD763
57762025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exeC:\Windows\SysWOW64\nethtsrv.exeexecutable
MD5:FE9C7112B77410E6930377552CD5937E
SHA256:EBA87B6D47ABC36F6F07EE8AE3B146E76EA7E3443CC6FFF8F309C509272D6BB9
57762025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber.exeC:\Users\admin\AppData\Local\Temp\nsy14EA.tmp\nsExec.dllexecutable
MD5:ACC2B699EDFEA5BF5AAE45ABA3A41E96
SHA256:168A974EAA3F588D759DB3F47C1A9FDC3494BA1FA1A73A84E5E3B2A4D58ABD7E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
20
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7864
RUXIMICS.exe
GET
200
23.48.23.168:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7864
RUXIMICS.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
7864
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7864
RUXIMICS.exe
23.48.23.168:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
7864
RUXIMICS.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4892
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
8132
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
google.com
  • 216.58.206.78
whitelisted
crl.microsoft.com
  • 23.48.23.168
  • 23.48.23.161
  • 23.48.23.153
  • 23.48.23.159
  • 23.48.23.155
  • 23.48.23.156
  • 23.48.23.162
  • 23.48.23.150
  • 23.48.23.166
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
self.events.data.microsoft.com
  • 20.44.10.122
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-06-01_6e32ff96764d762d4d514e13779aecd2_darkgate_elex_mafia_magniber