File name:

bypass.bat

Full analysis: https://app.any.run/tasks/18f866db-1294-4e59-aaeb-9125c53906d6
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 07, 2025, 07:27:48
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
github
fody
evasion
stealer
loader
python
telegram
remote
xworm
pyinstaller
Indicators:
MIME: text/x-msdos-batch
File info: DOS batch file, Unicode text, UTF-8 text, with very long lines (389), with CRLF line terminators
MD5:

BDC77140867FAEA84D1F3DCABBCF25DF

SHA1:

AF63E86BFBE258E9F2289C39589AA3D158CEDB56

SHA256:

621C958504B020D469F2759A6ACD5494552921515FF9B01FC73892FA6488D463

SSDEEP:

24:ywzR3Ja5TMtWy/gFR35MJ5TkztWkjGbuF6x9VMxCBfpTbRpTbkV:lzRANMtWTRpENkztWkUC6LKCBfpTbRp0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6328)
      • powershell.exe (PID: 6800)
      • powershell.exe (PID: 3152)

    • Uses TASKKILL.EXE to kill security tools

      • bot2.exe (PID: 6920)

    • Steals credentials from Web Browsers

      • bot2.exe (PID: 6920)

    • Actions looks like stealing of personal data

      • bot2.exe (PID: 6920)
      • chrome.exe (PID: 7048)

    • Uses Task Scheduler to run other applications

      • XClient.exe (PID: 1448)

    • Changes the autorun value in the registry

      • XClient.exe (PID: 1448)

    • Create files in the Startup directory

      • XClient.exe (PID: 1448)

    • XWORM has been detected (SURICATA)

      • XClient.exe (PID: 1448)

  • SUSPICIOUS

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 6268)

    • Downloads file from URI via Powershell

      • powershell.exe (PID: 6328)
      • powershell.exe (PID: 6800)

    • Likely accesses (executes) a file from the Public directory

      • powershell.exe (PID: 6328)
      • powershell.exe (PID: 6800)
      • bot2.exe (PID: 6732)
      • bot2.exe (PID: 6920)
      • powershell.exe (PID: 3152)
      • XClient.exe (PID: 1448)

    • The process drops C-runtime libraries

      • bot2.exe (PID: 6732)

    • Starts process via Powershell

      • powershell.exe (PID: 6328)
      • powershell.exe (PID: 6800)
      • powershell.exe (PID: 3152)

    • Executable content was dropped or overwritten

      • bot2.exe (PID: 6732)
      • powershell.exe (PID: 6328)
      • powershell.exe (PID: 6800)
      • XClient.exe (PID: 1448)

    • Process drops python dynamic module

      • bot2.exe (PID: 6732)

    • Process drops legitimate windows executable

      • bot2.exe (PID: 6732)

    • Application launched itself

      • bot2.exe (PID: 6732)
      • chrome.exe (PID: 7048)

    • Starts CMD.EXE for commands execution

      • bot2.exe (PID: 6920)

    • Loads Python modules

      • bot2.exe (PID: 6920)

    • Uses TASKKILL.EXE to kill process

      • bot2.exe (PID: 6920)

    • Uses TASKKILL.EXE to kill Browsers

      • bot2.exe (PID: 6920)

    • Manipulates environment variables

      • powershell.exe (PID: 3152)

    • Checks for external IP

      • svchost.exe (PID: 2192)
      • XClient.exe (PID: 1448)
      • bot2.exe (PID: 6920)

    • Potential Corporate Privacy Violation

      • bot2.exe (PID: 6920)

    • Reads security settings of Internet Explorer

      • XClient.exe (PID: 1448)

    • Reads the date of Windows installation

      • XClient.exe (PID: 1448)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • bot2.exe (PID: 6920)
      • XClient.exe (PID: 1448)

    • Contacting a server suspected of hosting an CnC

      • XClient.exe (PID: 1448)

    • Connects to unusual port

      • XClient.exe (PID: 1448)

    • The process executes via Task Scheduler

      • XClient.exe (PID: 5308)

  • INFO

    • Disables trace logs

      • powershell.exe (PID: 6328)
      • powershell.exe (PID: 6800)
      • XClient.exe (PID: 1448)

    • Checks proxy server information

      • powershell.exe (PID: 6328)
      • powershell.exe (PID: 6800)
      • bot2.exe (PID: 6920)
      • chrome.exe (PID: 7048)
      • XClient.exe (PID: 1448)

    • Detects Fody packer (YARA)

      • powershell.exe (PID: 6328)

    • Checks supported languages

      • bot2.exe (PID: 6732)
      • bot2.exe (PID: 6920)
      • XClient.exe (PID: 1448)
      • chrome.exe (PID: 7048)
      • XClient.exe (PID: 5308)

    • Reads the computer name

      • bot2.exe (PID: 6732)
      • bot2.exe (PID: 6920)
      • XClient.exe (PID: 1448)
      • chrome.exe (PID: 7048)
      • XClient.exe (PID: 5308)

    • Create files in a temporary directory

      • bot2.exe (PID: 6732)
      • chrome.exe (PID: 7048)
      • bot2.exe (PID: 6920)

    • The sample compiled with english language support

      • bot2.exe (PID: 6732)

    • Checks operating system version

      • bot2.exe (PID: 6920)

    • Reads Environment values

      • chrome.exe (PID: 7048)
      • XClient.exe (PID: 1448)

    • Reads the machine GUID from the registry

      • XClient.exe (PID: 1448)
      • chrome.exe (PID: 7048)
      • XClient.exe (PID: 5308)

    • Creates files or folders in the user directory

      • chrome.exe (PID: 7048)
      • XClient.exe (PID: 1448)

    • Process checks computer location settings

      • chrome.exe (PID: 7048)
      • XClient.exe (PID: 1448)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 3152)

    • PyInstaller has been detected (YARA)

      • bot2.exe (PID: 6732)

    • Reads the software policy settings

      • XClient.exe (PID: 1448)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
210
Monitored processes
97
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start cmd.exe no specs conhost.exe no specs powershell.exe bot2.exe conhost.exe no specs powershell.exe bot2.exe cmd.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs taskkill.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs taskkill.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs chrome.exe #XWORM xclient.exe powershell.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs svchost.exe chrome.exe no specs chrome.exe no specs schtasks.exe no specs conhost.exe no specs xclient.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
8\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
308"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=2128 --field-trial-handle=1928,i,11393175094624169113,18413886872845259126,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
624taskkill /F /IM Signal.exeC:\Windows\System32\taskkill.exe—bot2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
776"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=2012 --field-trial-handle=1928,i,11393175094624169113,18413886872845259126,262144 --variations-seed-version /prefetch:3C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1016taskkill /F /IM fiddler.exeC:\Windows\System32\taskkill.exe—bot2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1292"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=3404 --field-trial-handle=1928,i,11393175094624169113,18413886872845259126,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1296\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1344\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1392\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1392"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2916 --field-trial-handle=1928,i,11393175094624169113,18413886872845259126,262144 --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
24 909
Read events
24 889
Write events
20
Delete events
0

Modification events

(PID) Process:(7048) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(7048) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(7048) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(7048) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(7048) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(1448) XClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\XClient_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1448) XClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\XClient_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(1448) XClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\XClient_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(1448) XClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\XClient_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(1448) XClient.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\XClient_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
Executable files
83
Suspicious files
26
Text files
49
Unknown types
1

Dropped files

PID
Process
Filename
Type
6328powershell.exeC:\Users\Public\bot2.exeexecutable
MD5:3BEA36D1287DE03C7EBA8A7EE348D35C
SHA256:9E11C2806CFC43666CF6FFDD3131B90A9E4ED555831B1BEB9DEA1AAFF0EA3E01
6732bot2.exeC:\Users\admin\AppData\Local\Temp\_MEI67322\Crypto\Cipher\_ARC4.pydexecutable
MD5:BCD8CAAF9342AB891BB1D8DD45EF0098
SHA256:78725D2F55B7400A3FCAFECD35AF7AEB253FBC0FFCDF1903016EB0AABD1B4E50
6732bot2.exeC:\Users\admin\AppData\Local\Temp\_MEI67322\Crypto\Cipher\_raw_aes.pydexecutable
MD5:0AB25F99CDAACA6B11F2ECBE8223CAD5
SHA256:6CE8A60D1AB5ADC186E23E3DE864D7ADF6BDD37E3B0C591FA910763C5C26AF60
6732bot2.exeC:\Users\admin\AppData\Local\Temp\_MEI67322\Crypto\Cipher\_raw_cbc.pydexecutable
MD5:40390F2113DC2A9D6CFAE7127F6BA329
SHA256:6BA9C910F755885E4D356C798A4DD32D2803EA4CFABB3D56165B3017D0491AE2
6732bot2.exeC:\Users\admin\AppData\Local\Temp\_MEI67322\Crypto\Cipher\_raw_cast.pydexecutable
MD5:2E15AA6F97ED618A3236CFA920988142
SHA256:516C5EA47A7B9A166F2226ECBA79075F1A35EFFF14D87E00006B34496173BB78
6732bot2.exeC:\Users\admin\AppData\Local\Temp\_MEI67322\Crypto\Cipher\_pkcs1_decode.pydexecutable
MD5:C09BB8A30F0F733C81C5C5A3DAD8D76D
SHA256:8A1B751DB47CE7B1D3BD10BEBFFC7442BE4CFB398E96E3B1FF7FB83C88A8953D
6732bot2.exeC:\Users\admin\AppData\Local\Temp\_MEI67322\Crypto\Cipher\_raw_ecb.pydexecutable
MD5:80BB1E0E06ACAF03A0B1D4EF30D14BE7
SHA256:5D1C2C60C4E571B88F27D4AE7D22494BED57D5EC91939E5716AFA3EA7F6871F6
6732bot2.exeC:\Users\admin\AppData\Local\Temp\_MEI67322\Crypto\Cipher\_raw_cfb.pydexecutable
MD5:899895C0ED6830C4C9A3328CC7DF95B6
SHA256:18D568C7BE3E04F4E6026D12B09B1FA3FAE50FF29AC3DEAF861F3C181653E691
6732bot2.exeC:\Users\admin\AppData\Local\Temp\_MEI67322\Crypto\Cipher\_raw_ctr.pydexecutable
MD5:C4C525B081F8A0927091178F5F2EE103
SHA256:4D86A90B2E20CDE099D6122C49A72BAE081F60EB2EEA0F76E740BE6C41DA6749
6732bot2.exeC:\Users\admin\AppData\Local\Temp\_MEI67322\Crypto\Cipher\_raw_des.pydexecutable
MD5:F9E266F763175B8F6FD4154275F8E2F0
SHA256:14D2799BE604CBDC668FDE8834A896EEE69DAE0E0D43B37289FCCBA35CEF29EC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
49
DNS requests
19
Threats
38

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
302
140.82.121.4:443
https://github.com/mailclone2500/stealer/raw/refs/heads/main/path.exe
unknown
—
—
unknown
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
302
140.82.121.3:443
https://github.com/minhdmkk6/bot1/raw/refs/heads/main/XClient.exe
unknown
—
—
unknown
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
—
142.250.184.228:443
https://www.google.com/async/ddljson?async=ntp:2
unknown
—
—
unknown
—
—
GET
—
142.250.186.163:443
https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
unknown
—
—
unknown
—
—
GET
—
142.250.186.163:443
https://www.gstatic.com/og/_/js/k=og.qtm.en_US.XA6cJfY6CcY.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTsZ_cj3WMWRDcM6h5dBKoKiPSrw3g
unknown
—
—
unknown
1448
XClient.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
6920
bot2.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/?fields=8195
unknown
—
—
whitelisted
—
—
POST
204
104.126.37.139:443
https://www.bing.com/threshold/xls.aspx
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6328
powershell.exe
140.82.121.4:443
github.com
GITHUB
US
whitelisted
3976
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6328
powershell.exe
185.199.108.133:443
raw.githubusercontent.com
FASTLY
US
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6800
powershell.exe
140.82.121.4:443
github.com
GITHUB
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.46
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
github.com
  • 140.82.121.4
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
raw.githubusercontent.com
  • 185.199.108.133
  • 185.199.111.133
  • 185.199.110.133
  • 185.199.109.133
whitelisted
clientservices.googleapis.com
  • 142.250.185.67
whitelisted
accounts.google.com
  • 142.250.102.84
whitelisted
www.google.com
  • 216.58.206.68
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
—
—
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
—
—
Misc activity
ET INFO Request for EXE via Powershell
—
—
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
—
—
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
—
—
Misc activity
ET HUNTING EXE Downloaded from Github
—
—
Misc activity
ET INFO Request for EXE via Powershell
—
—
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
—
—
Misc activity
ET INFO Request for EXE via Powershell
—
—
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
bypass.bat