File name:

XWorm6.0Launcher.exe

Full analysis: https://app.any.run/tasks/c824fa2d-07ce-44b1-b960-eb2aadd9dd2d
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: July 26, 2025, 14:30:55
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
auto-reg
crypto-regex
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 6 sections
MD5:

F5E3D2A4E2277E040DE93E34ED2E602C

SHA1:

ADA9CB523919A31B196F9F70B3D3C3F659589F3E

SHA256:

5E2781AA58A8F8EFA3F99D6F8FBB0D7540BCFEEC9D5A7AFCB376F43821092560

SSDEEP:

1536:5oi8o5YydDeCkV+qBUQXSm9uFDfJkmehkHYoK/QOqVPlte6PLJ:5YydDg7BRSmufyh8XK/QPlte6PL

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • MoUsoCoreWorker.exe (PID: 320)
      • MoUsoCoreWorker.exe.exe (PID: 5368)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • XWorm6.0Launcher.exe (PID: 1932)

    • Reads security settings of Internet Explorer

      • XWorm6.0Launcher.exe (PID: 1932)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6268)

    • Hides command output

      • cmd.exe (PID: 6268)

    • Reads the date of Windows installation

      • XWorm6.0Launcher.exe (PID: 1932)

    • Process drops legitimate windows executable

      • XWorm6.0Launcher.exe (PID: 1932)
      • MoUsoCoreWorker.exe (PID: 320)

    • Executable content was dropped or overwritten

      • XWorm6.0Launcher.exe (PID: 1932)
      • MoUsoCoreWorker.exe (PID: 320)

    • Starts a Microsoft application from unusual location

      • MoUsoCoreWorker.exe (PID: 320)

    • Starts itself from another location

      • MoUsoCoreWorker.exe (PID: 320)

    • Connects to unusual port

      • MoUsoCoreWorker.exe.exe (PID: 5368)

    • Found regular expressions for crypto-addresses (YARA)

      • MoUsoCoreWorker.exe.exe (PID: 5368)

  • INFO

    • Checks supported languages

      • XWorm6.0Launcher.exe (PID: 1932)
      • chcp.com (PID: 2492)
      • MoUsoCoreWorker.exe (PID: 320)
      • MoUsoCoreWorker.exe.exe (PID: 5368)
      • MoUsoCoreWorker.exe.exe (PID: 2320)

    • Reads the computer name

      • XWorm6.0Launcher.exe (PID: 1932)
      • MoUsoCoreWorker.exe (PID: 320)
      • MoUsoCoreWorker.exe.exe (PID: 5368)
      • MoUsoCoreWorker.exe.exe (PID: 2320)

    • Changes the display of characters in the console

      • cmd.exe (PID: 6268)

    • Reads the software policy settings

      • XWorm6.0Launcher.exe (PID: 1932)
      • slui.exe (PID: 1212)

    • Create files in a temporary directory

      • XWorm6.0Launcher.exe (PID: 1932)

    • Reads the machine GUID from the registry

      • XWorm6.0Launcher.exe (PID: 1932)
      • MoUsoCoreWorker.exe (PID: 320)
      • MoUsoCoreWorker.exe.exe (PID: 5368)
      • MoUsoCoreWorker.exe.exe (PID: 2320)

    • Checks proxy server information

      • XWorm6.0Launcher.exe (PID: 1932)
      • slui.exe (PID: 1212)

    • Process checks computer location settings

      • XWorm6.0Launcher.exe (PID: 1932)

    • Reads Environment values

      • MoUsoCoreWorker.exe (PID: 320)
      • MoUsoCoreWorker.exe.exe (PID: 5368)
      • MoUsoCoreWorker.exe.exe (PID: 2320)

    • Creates files or folders in the user directory

      • MoUsoCoreWorker.exe (PID: 320)

    • Launching a file from a Registry key

      • MoUsoCoreWorker.exe (PID: 320)
      • MoUsoCoreWorker.exe.exe (PID: 5368)

    • Creates files in the program directory

      • MoUsoCoreWorker.exe.exe (PID: 5368)

    • Manual execution by a user

      • MoUsoCoreWorker.exe.exe (PID: 2320)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:07:25 11:58:54+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.44
CodeSize: 16384
InitializedDataSize: 70144
UninitializedDataSize: -
EntryPoint: 0x40f0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
8
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start xworm6.0launcher.exe conhost.exe no specs cmd.exe no specs chcp.com no specs mousocoreworker.exe mousocoreworker.exe.exe mousocoreworker.exe.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
320"C:\Users\admin\AppData\Local\Temp\MoUsoCoreWorker.exe" C:\Users\admin\AppData\Local\Temp\MoUsoCoreWorker.exe
XWorm6.0Launcher.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MoUSO Core Worker Process
Exit code:
3
Version:
10.0.19041.5438
Modules
Images
c:\users\admin\appdata\local\temp\mousocoreworker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1212C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1932"C:\Users\admin\Desktop\XWorm6.0Launcher.exe" C:\Users\admin\Desktop\XWorm6.0Launcher.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\xworm6.0launcher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
2320"C:\Users\admin\AppData\Roaming\Microsoft\MoUsoCoreWorker.exe.exe"C:\Users\admin\AppData\Roaming\Microsoft\MoUsoCoreWorker.exe.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MoUSO Core Worker Process
Exit code:
2
Version:
10.0.19041.5438
Modules
Images
c:\users\admin\appdata\roaming\microsoft\mousocoreworker.exe.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2492chcp 65001 C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
5368"C:\Users\admin\AppData\Roaming\Microsoft\MoUsoCoreWorker.exe.exe"C:\Users\admin\AppData\Roaming\Microsoft\MoUsoCoreWorker.exe.exe
MoUsoCoreWorker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MoUSO Core Worker Process
Version:
10.0.19041.5438
Modules
Images
c:\users\admin\appdata\roaming\microsoft\mousocoreworker.exe.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6268C:\WINDOWS\system32\cmd.exe /c chcp 65001 > nulC:\Windows\System32\cmd.exe—XWorm6.0Launcher.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
7096\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—XWorm6.0Launcher.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
9 079
Read events
9 077
Write events
2
Delete events
0

Modification events

(PID) Process:(320) MoUsoCoreWorker.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MoUsoCoreWorker
Value:
"C:\Users\admin\AppData\Roaming\Microsoft\MoUsoCoreWorker.exe.exe"
(PID) Process:(5368) MoUsoCoreWorker.exe.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MoUsoCoreWorker
Value:
"C:\Users\admin\AppData\Roaming\Microsoft\MoUsoCoreWorker.exe.exe"
Executable files
2
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
1932XWorm6.0Launcher.exeC:\Users\admin\AppData\Local\Temp\MoUsoCoreWorker.exeexecutable
MD5:80724FC94FBE13DAF40235F12F43EAF9
SHA256:5EDB87C598CD76CAD3FCB51C09114916776B8154DBC07E09698818D7BBA5413B
320MoUsoCoreWorker.exeC:\Users\admin\AppData\Roaming\Microsoft\MoUsoCoreWorker.exe.exeexecutable
MD5:80724FC94FBE13DAF40235F12F43EAF9
SHA256:5EDB87C598CD76CAD3FCB51C09114916776B8154DBC07E09698818D7BBA5413B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
31
TCP/UDP connections
50
DNS requests
21
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5944
MoUsoCoreWorker.exe
GET
200
23.216.77.42:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.216.77.42:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5876
RUXIMICS.exe
GET
200
23.216.77.42:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
302
162.125.72.18:443
https://www.dropbox.com/scl/fi/pczqpnd6ak06wr5xifsqu/MoUsoCoreWorker.exe?rlkey=d6vr7dcia2qqsu0kzymc2cys5&st=nw0kjw1x&dl=1
unknown
text
17 b
whitelisted
5876
RUXIMICS.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
200
40.126.31.2:443
https://login.live.com/RST2.srf
unknown
xml
1.24 Kb
whitelisted
—
—
GET
200
20.109.210.53:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
4072
SIHClient.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5876
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
23.216.77.42:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.216.77.42:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5876
RUXIMICS.exe
23.216.77.42:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1932
XWorm6.0Launcher.exe
162.125.72.18:443
www.dropbox.com
DROPBOX
US
whitelisted
5944
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
google.com
  • 142.250.181.238
whitelisted
www.dropbox.com
  • 162.125.72.18
whitelisted
crl.microsoft.com
  • 23.216.77.42
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
ucf544197c62636caf3366e4d344.dl.dropboxusercontent.com
  • 162.125.72.15
whitelisted
login.live.com
  • 40.126.31.2
  • 20.190.159.0
  • 40.126.31.73
  • 40.126.31.67
  • 40.126.31.1
  • 40.126.31.130
  • 20.190.159.75
  • 20.190.159.129
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.250
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
—
—
Misc activity
ET INFO EXE - Served Attached HTTP
—
—
Misc activity
ET INFO EXE - Served Attached HTTP
—
—
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
XWorm6.0Launcher.exe