File name:

bypass.bat

Full analysis: https://app.any.run/tasks/18f866db-1294-4e59-aaeb-9125c53906d6
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 07, 2025, 07:27:48
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
github
fody
evasion
stealer
loader
python
telegram
remote
xworm
pyinstaller
Indicators:
MIME: text/x-msdos-batch
File info: DOS batch file, Unicode text, UTF-8 text, with very long lines (389), with CRLF line terminators
MD5:

BDC77140867FAEA84D1F3DCABBCF25DF

SHA1:

AF63E86BFBE258E9F2289C39589AA3D158CEDB56

SHA256:

621C958504B020D469F2759A6ACD5494552921515FF9B01FC73892FA6488D463

SSDEEP:

24:ywzR3Ja5TMtWy/gFR35MJ5TkztWkjGbuF6x9VMxCBfpTbRpTbkV:lzRANMtWTRpENkztWkUC6LKCBfpTbRp0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6328)
      • powershell.exe (PID: 6800)
      • powershell.exe (PID: 3152)

    • Uses TASKKILL.EXE to kill security tools

      • bot2.exe (PID: 6920)

    • Actions looks like stealing of personal data

      • bot2.exe (PID: 6920)
      • chrome.exe (PID: 7048)

    • Steals credentials from Web Browsers

      • bot2.exe (PID: 6920)

    • Uses Task Scheduler to run other applications

      • XClient.exe (PID: 1448)

    • Create files in the Startup directory

      • XClient.exe (PID: 1448)

    • Changes the autorun value in the registry

      • XClient.exe (PID: 1448)

    • XWORM has been detected (SURICATA)

      • XClient.exe (PID: 1448)

  • SUSPICIOUS

    • Starts process via Powershell

      • powershell.exe (PID: 6328)
      • powershell.exe (PID: 6800)
      • powershell.exe (PID: 3152)

    • Likely accesses (executes) a file from the Public directory

      • powershell.exe (PID: 6328)
      • bot2.exe (PID: 6732)
      • powershell.exe (PID: 6800)
      • bot2.exe (PID: 6920)
      • XClient.exe (PID: 1448)
      • powershell.exe (PID: 3152)

    • Downloads file from URI via Powershell

      • powershell.exe (PID: 6328)
      • powershell.exe (PID: 6800)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 6268)

    • Executable content was dropped or overwritten

      • bot2.exe (PID: 6732)
      • powershell.exe (PID: 6328)
      • powershell.exe (PID: 6800)
      • XClient.exe (PID: 1448)

    • Process drops python dynamic module

      • bot2.exe (PID: 6732)

    • The process drops C-runtime libraries

      • bot2.exe (PID: 6732)

    • Application launched itself

      • bot2.exe (PID: 6732)
      • chrome.exe (PID: 7048)

    • Starts CMD.EXE for commands execution

      • bot2.exe (PID: 6920)

    • Uses TASKKILL.EXE to kill process

      • bot2.exe (PID: 6920)

    • Loads Python modules

      • bot2.exe (PID: 6920)

    • Uses TASKKILL.EXE to kill Browsers

      • bot2.exe (PID: 6920)

    • Manipulates environment variables

      • powershell.exe (PID: 3152)

    • Checks for external IP

      • svchost.exe (PID: 2192)
      • XClient.exe (PID: 1448)
      • bot2.exe (PID: 6920)

    • Reads the date of Windows installation

      • XClient.exe (PID: 1448)

    • Reads security settings of Internet Explorer

      • XClient.exe (PID: 1448)

    • Potential Corporate Privacy Violation

      • bot2.exe (PID: 6920)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • bot2.exe (PID: 6920)
      • XClient.exe (PID: 1448)

    • Contacting a server suspected of hosting an CnC

      • XClient.exe (PID: 1448)

    • The process executes via Task Scheduler

      • XClient.exe (PID: 5308)

    • Connects to unusual port

      • XClient.exe (PID: 1448)

    • Process drops legitimate windows executable

      • bot2.exe (PID: 6732)

  • INFO

    • Disables trace logs

      • powershell.exe (PID: 6328)
      • powershell.exe (PID: 6800)
      • XClient.exe (PID: 1448)

    • Checks proxy server information

      • powershell.exe (PID: 6328)
      • powershell.exe (PID: 6800)
      • bot2.exe (PID: 6920)
      • chrome.exe (PID: 7048)
      • XClient.exe (PID: 1448)

    • Detects Fody packer (YARA)

      • powershell.exe (PID: 6328)

    • Reads the computer name

      • bot2.exe (PID: 6732)
      • bot2.exe (PID: 6920)
      • XClient.exe (PID: 1448)
      • chrome.exe (PID: 7048)
      • XClient.exe (PID: 5308)

    • Checks supported languages

      • bot2.exe (PID: 6732)
      • bot2.exe (PID: 6920)
      • XClient.exe (PID: 1448)
      • chrome.exe (PID: 7048)
      • XClient.exe (PID: 5308)

    • Create files in a temporary directory

      • bot2.exe (PID: 6732)
      • chrome.exe (PID: 7048)
      • bot2.exe (PID: 6920)

    • The sample compiled with english language support

      • bot2.exe (PID: 6732)

    • Checks operating system version

      • bot2.exe (PID: 6920)

    • Reads Environment values

      • chrome.exe (PID: 7048)
      • XClient.exe (PID: 1448)

    • Reads the machine GUID from the registry

      • chrome.exe (PID: 7048)
      • XClient.exe (PID: 1448)
      • XClient.exe (PID: 5308)

    • Process checks computer location settings

      • chrome.exe (PID: 7048)
      • XClient.exe (PID: 1448)

    • Creates files or folders in the user directory

      • chrome.exe (PID: 7048)
      • XClient.exe (PID: 1448)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 3152)

    • PyInstaller has been detected (YARA)

      • bot2.exe (PID: 6732)

    • Reads the software policy settings

      • XClient.exe (PID: 1448)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
210
Monitored processes
97
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start cmd.exe no specs conhost.exe no specs powershell.exe bot2.exe conhost.exe no specs powershell.exe bot2.exe cmd.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs taskkill.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs taskkill.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs chrome.exe #XWORM xclient.exe powershell.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs svchost.exe chrome.exe no specs chrome.exe no specs schtasks.exe no specs conhost.exe no specs xclient.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
8\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
308"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=2128 --field-trial-handle=1928,i,11393175094624169113,18413886872845259126,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
624taskkill /F /IM Signal.exeC:\Windows\System32\taskkill.exe—bot2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
776"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=2012 --field-trial-handle=1928,i,11393175094624169113,18413886872845259126,262144 --variations-seed-version /prefetch:3C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1016taskkill /F /IM fiddler.exeC:\Windows\System32\taskkill.exe—bot2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1292"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=3404 --field-trial-handle=1928,i,11393175094624169113,18413886872845259126,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1296\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1344\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1392\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1392"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2916 --field-trial-handle=1928,i,11393175094624169113,18413886872845259126,262144 --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
24 909
Read events
24 889
Write events
20
Delete events
0

Modification events

(PID) Process:(7048) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(7048) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(7048) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(7048) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(7048) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(1448) XClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\XClient_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1448) XClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\XClient_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(1448) XClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\XClient_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(1448) XClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\XClient_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(1448) XClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\XClient_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
Executable files
83
Suspicious files
26
Text files
49
Unknown types
1

Dropped files

PID
Process
Filename
Type
6328powershell.exeC:\Users\Public\bot2.exeexecutable
MD5:3BEA36D1287DE03C7EBA8A7EE348D35C
SHA256:9E11C2806CFC43666CF6FFDD3131B90A9E4ED555831B1BEB9DEA1AAFF0EA3E01
6328powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_npqblixm.muj.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6732bot2.exeC:\Users\admin\AppData\Local\Temp\_MEI67322\Crypto\Cipher\_pkcs1_decode.pydexecutable
MD5:C09BB8A30F0F733C81C5C5A3DAD8D76D
SHA256:8A1B751DB47CE7B1D3BD10BEBFFC7442BE4CFB398E96E3B1FF7FB83C88A8953D
6732bot2.exeC:\Users\admin\AppData\Local\Temp\_MEI67322\Crypto\Cipher\_ARC4.pydexecutable
MD5:BCD8CAAF9342AB891BB1D8DD45EF0098
SHA256:78725D2F55B7400A3FCAFECD35AF7AEB253FBC0FFCDF1903016EB0AABD1B4E50
6732bot2.exeC:\Users\admin\AppData\Local\Temp\_MEI67322\Crypto\Cipher\_raw_cast.pydexecutable
MD5:2E15AA6F97ED618A3236CFA920988142
SHA256:516C5EA47A7B9A166F2226ECBA79075F1A35EFFF14D87E00006B34496173BB78
6732bot2.exeC:\Users\admin\AppData\Local\Temp\_MEI67322\Crypto\Cipher\_chacha20.pydexecutable
MD5:DC14677EA8A8C933CC41F9CCF2BEDDC1
SHA256:68F081E96AE08617CF111B21EDED35C1774A5EF1223DF9A161C9445A78F25C73
6732bot2.exeC:\Users\admin\AppData\Local\Temp\_MEI67322\Crypto\Cipher\_raw_aesni.pydexecutable
MD5:B6EA675C3A35CD6400A7ECF2FB9530D1
SHA256:76EF4C1759B5553550AB652B84F8E158BA8F34F29FD090393815F06A1C1DC59D
6732bot2.exeC:\Users\admin\AppData\Local\Temp\_MEI67322\Crypto\Cipher\_raw_arc2.pydexecutable
MD5:F14E1AA2590D621BE8C10321B2C43132
SHA256:FCE70B3DAFB39C6A4DB85D2D662CB9EB9C4861AA648AD7436E7F65663345D177
6732bot2.exeC:\Users\admin\AppData\Local\Temp\_MEI67322\Crypto\Cipher\_raw_blowfish.pydexecutable
MD5:B127CAE435AEB8A2A37D2A1BC1C27282
SHA256:538B1253B5929254ED92129FA0957DB26CDDF34A8372BA0BF19D20D01549ADA3
6328powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_fslbrdku.jyc.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
49
DNS requests
19
Threats
38

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
302
140.82.121.4:443
https://github.com/mailclone2500/stealer/raw/refs/heads/main/path.exe
unknown
—
—
—
—
—
GET
302
140.82.121.3:443
https://github.com/minhdmkk6/bot1/raw/refs/heads/main/XClient.exe
unknown
—
—
—
1448
XClient.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
—
—
GET
—
142.250.186.163:443
https://www.gstatic.com/og/_/js/k=og.qtm.en_US.XA6cJfY6CcY.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTsZ_cj3WMWRDcM6h5dBKoKiPSrw3g
unknown
—
—
—
—
—
GET
—
142.250.186.163:443
https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
unknown
—
—
—
—
—
GET
—
142.250.184.228:443
https://www.google.com/async/ddljson?async=ntp:2
unknown
—
—
—
6920
bot2.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/?fields=8195
unknown
—
—
whitelisted
—
—
GET
200
140.82.121.3:443
https://raw.githubusercontent.com/minhdmkk6/bot1/refs/heads/main/XClient.exe
unknown
executable
75.0 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6328
powershell.exe
140.82.121.4:443
github.com
GITHUB
US
whitelisted
3976
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6328
powershell.exe
185.199.108.133:443
raw.githubusercontent.com
FASTLY
US
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6800
powershell.exe
140.82.121.4:443
github.com
GITHUB
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.46
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
github.com
  • 140.82.121.4
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
raw.githubusercontent.com
  • 185.199.108.133
  • 185.199.111.133
  • 185.199.110.133
  • 185.199.109.133
whitelisted
clientservices.googleapis.com
  • 142.250.185.67
whitelisted
accounts.google.com
  • 142.250.102.84
whitelisted
www.google.com
  • 216.58.206.68
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
—
—
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
—
—
Misc activity
ET INFO Request for EXE via Powershell
—
—
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
—
—
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
—
—
Misc activity
ET HUNTING EXE Downloaded from Github
—
—
Misc activity
ET INFO Request for EXE via Powershell
—
—
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
—
—
Misc activity
ET INFO Request for EXE via Powershell
—
—
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
bypass.bat