File name:

xfc495c23b8226582b6ba0c3518a67b2cffe76eafbf09e444a9d702cd74741d77.exe

Full analysis: https://app.any.run/tasks/a009e2ba-21fa-43f5-a7a5-bbd48ae2dec0
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: April 10, 2026, 00:01:47
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
xworm
rat
auto
auto-startup
auto-reg
pastebin
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 9 sections
MD5:

E1E745E75DBC6E68197901C7ADE98334

SHA1:

5E2FC311C44BB3E170309D36E349A90D919BC473

SHA256:

FC495C23B8226582B6BA0C3518A67B2CFFE76EAFBF09E444A9D702CD74741D77

SSDEEP:

98304:dkXkyuZsE2ze9oLgLK8BxZIFIVY8L3GdZttwFBT7fsHiSKx32jC/xeVN4EhVq/vh:z9oYVCIZv4rpJ7x8gJUzjqm8H6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • XWORM has been detected

      • xfc495c23b8226582b6ba0c3518a67b2cffe76eafbf09e444a9d702cd74741d77.exe (PID: 7268)
      • audiodg.exe (PID: 6064)
      • audiodg.exe (PID: 4784)
      • shost.exe (PID: 4312)

    • XWORM has been found (auto)

      • xfc495c23b8226582b6ba0c3518a67b2cffe76eafbf09e444a9d702cd74741d77.exe (PID: 7268)
      • audiodg.exe (PID: 6064)

    • XWORM mutex has been found

      • audiodg.exe (PID: 4784)
      • audiodg.exe (PID: 6064)

    • Changes the autorun value in the registry

      • audiodg.exe (PID: 6064)

    • Create files in the Startup directory

      • audiodg.exe (PID: 6064)

    • XWORM has been detected (YARA)

      • shost.exe (PID: 4312)
      • audiodg.exe (PID: 6064)

    • Executing a file with an untrusted certificate

      • xfc495c23b8226582b6ba0c3518a67b2cffe76eafbf09e444a9d702cd74741d77..exe (PID: 4304)

  • SUSPICIOUS

    • Starts a Microsoft application from unusual location

      • xfc495c23b8226582b6ba0c3518a67b2cffe76eafbf09e444a9d702cd74741d77..exe (PID: 4304)

    • The process executes files with name similar to system file names

      • xfc495c23b8226582b6ba0c3518a67b2cffe76eafbf09e444a9d702cd74741d77.exe (PID: 7268)
      • shost.exe (PID: 4312)

    • Executable content was dropped or overwritten

      • xfc495c23b8226582b6ba0c3518a67b2cffe76eafbf09e444a9d702cd74741d77.exe (PID: 7268)
      • shost.exe (PID: 4312)
      • audiodg.exe (PID: 6064)

    • The process creates files with name similar to system file names

      • xfc495c23b8226582b6ba0c3518a67b2cffe76eafbf09e444a9d702cd74741d77.exe (PID: 7268)

    • Using the short paths format

      • shost.exe (PID: 4312)

    • Starts itself from another location

      • xfc495c23b8226582b6ba0c3518a67b2cffe76eafbf09e444a9d702cd74741d77.exe (PID: 7268)

  • INFO

    • Checks supported languages

      • xfc495c23b8226582b6ba0c3518a67b2cffe76eafbf09e444a9d702cd74741d77.exe (PID: 7268)
      • audiodg.exe (PID: 6064)
      • shost.exe (PID: 4312)
      • audiodg.exe (PID: 4784)
      • winlogon (PID: 2812)

    • Reads the computer name

      • audiodg.exe (PID: 6064)
      • audiodg.exe (PID: 4784)
      • winlogon (PID: 2812)

    • Reads the machine GUID from the registry

      • audiodg.exe (PID: 4784)
      • audiodg.exe (PID: 6064)
      • winlogon (PID: 2812)

    • Create files in a temporary directory

      • shost.exe (PID: 4312)

    • The sample compiled with english language support

      • shost.exe (PID: 4312)

    • Launching a file from a Registry key

      • audiodg.exe (PID: 6064)

    • Launching a file from the Startup directory

      • audiodg.exe (PID: 6064)

    • Creates files or folders in the user directory

      • audiodg.exe (PID: 6064)
      • shost.exe (PID: 4312)

    • Reads Environment values

      • audiodg.exe (PID: 6064)

    • The sample compiled with bulgarian language support

      • shost.exe (PID: 4312)

    • Disables trace logs

      • audiodg.exe (PID: 6064)

    • Manual execution by a user

      • winlogon (PID: 2812)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

XWorm

(PID) Process(6064) audiodg.exe
C2 (1)https://pastebin.com/raw/Fxzr3jeT:<666666>
Keys
AES<Xwormmm>
Options
Splitter3
Sleep timeXWorm V5.6
USB drop nameUSB.exe
MutexteEgLm0aeViE3IZi
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:08:14 13:36:06+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14
CodeSize: 218112
InitializedDataSize: 164864
UninitializedDataSize: -
EntryPoint: 0x1a924
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
6
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #XWORM xfc495c23b8226582b6ba0c3518a67b2cffe76eafbf09e444a9d702cd74741d77.exe #XWORM audiodg.exe #XWORM shost.exe xfc495c23b8226582b6ba0c3518a67b2cffe76eafbf09e444a9d702cd74741d77..exe no specs #XWORM audiodg.exe no specs winlogon no specs

Process information

PID
CMD
Path
Indicators
Parent process
2812C:\Users\admin\AppData\Local\winlogonC:\Users\admin\AppData\Local\winlogon—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\winlogon
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
4304"C:\Users\admin\Desktop\xfc495c23b8226582b6ba0c3518a67b2cffe76eafbf09e444a9d702cd74741d77..exe"C:\Users\admin\Desktop\xfc495c23b8226582b6ba0c3518a67b2cffe76eafbf09e444a9d702cd74741d77..exe—xfc495c23b8226582b6ba0c3518a67b2cffe76eafbf09e444a9d702cd74741d77.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office Click-to-Run Client
Exit code:
3221225781
Version:
16.0.16529.20168
Modules
Images
c:\users\admin\desktop\xfc495c23b8226582b6ba0c3518a67b2cffe76eafbf09e444a9d702cd74741d77..exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4312"C:\Users\admin\Documents\diagnostics\shost.exe"C:\Users\admin\Documents\diagnostics\shost.exe
xfc495c23b8226582b6ba0c3518a67b2cffe76eafbf09e444a9d702cd74741d77.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\documents\diagnostics\shost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4784"C:\Users\admin\Documents\diagnostics\audiodg.exe"C:\Users\admin\Documents\diagnostics\audiodg.exe
shost.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\documents\diagnostics\audiodg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6064"C:\Users\admin\Documents\diagnostics\audiodg.exe"C:\Users\admin\Documents\diagnostics\audiodg.exe
xfc495c23b8226582b6ba0c3518a67b2cffe76eafbf09e444a9d702cd74741d77.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Version:
1.0.0.0
Modules
Images
c:\users\admin\documents\diagnostics\audiodg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
XWorm
(PID) Process(6064) audiodg.exe
C2 (1)https://pastebin.com/raw/Fxzr3jeT:<666666>
Keys
AES<Xwormmm>
Options
Splitter3
Sleep timeXWorm V5.6
USB drop nameUSB.exe
MutexteEgLm0aeViE3IZi
7268"C:\Users\admin\Desktop\xfc495c23b8226582b6ba0c3518a67b2cffe76eafbf09e444a9d702cd74741d77.exe" C:\Users\admin\Desktop\xfc495c23b8226582b6ba0c3518a67b2cffe76eafbf09e444a9d702cd74741d77.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\xfc495c23b8226582b6ba0c3518a67b2cffe76eafbf09e444a9d702cd74741d77.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
3 795
Read events
3 780
Write events
15
Delete events
0

Modification events

(PID) Process:(6064) audiodg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\audiodg_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6064) audiodg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\audiodg_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6064) audiodg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\audiodg_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6064) audiodg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\audiodg_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6064) audiodg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\audiodg_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6064) audiodg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\audiodg_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6064) audiodg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\audiodg_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6064) audiodg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\audiodg_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6064) audiodg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\audiodg_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6064) audiodg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\audiodg_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
1 099
Suspicious files
7
Text files
137
Unknown types
12

Dropped files

PID
Process
Filename
Type
7268xfc495c23b8226582b6ba0c3518a67b2cffe76eafbf09e444a9d702cd74741d77.exeC:\Users\admin\Documents\diagnostics\audiodg.exeexecutable
MD5:9367EAFEFD3471A59DF9EE9FFA198573
SHA256:76957A7DB92ABF1667474A4E45477CEA7297E9A25C78C1FADD94795FC5390833
7268xfc495c23b8226582b6ba0c3518a67b2cffe76eafbf09e444a9d702cd74741d77.exeC:\Users\admin\Documents\diagnostics\shost.exeexecutable
MD5:FD020069C161288A176FBF4564171026
SHA256:2CC246DBA8F0E5ACD06629C95A4E19745EDC256B835824C88A93FE2655848EC8
4312shost.exeC:\Users\admin\AppData\Local\Temp\PROGRA~~1\611391773354.exe —
MD5:—
SHA256:—
4312shost.exeC:\Users\admin\AppData\Local\Temp\RCX1DFE.tmp —
MD5:—
SHA256:—
4312shost.exeC:\Users\admin\AppData\Local\Temp\PROGRA~~1\600309545704..exe —
MD5:—
SHA256:—
4312shost.exeC:\Users\admin\AppData\Local\Temp\PROGRA~~1\795683489672.icoimage
MD5:FC7387DEE6FCD172DECBAE102437CE30
SHA256:E3530D306F7F383C6C3DCEAD7C0C5A0B8FBACB6B85B067AF05E98F4C6F502D61
7268xfc495c23b8226582b6ba0c3518a67b2cffe76eafbf09e444a9d702cd74741d77.exeC:\Users\admin\Desktop\xfc495c23b8226582b6ba0c3518a67b2cffe76eafbf09e444a9d702cd74741d77..exeexecutable
MD5:800485B37BD9ED8634BE39B32F7DD44B
SHA256:B136073BDC534501B5193586ACBDCEB8DDD7C3D4C961D4FB44CCCC98085DEBC9
4312shost.exeC:\Users\admin\AppData\Local\Temp\PROGRA~~1\014447615609..exeexecutable
MD5:0FE7B22CBF619CF188638A6025B81DEB
SHA256:B4DD76CDCFE1DDBD6F4F8436EEF5919D46A06EAE7FD26081E503B77DB450B7CF
4312shost.exeC:\Users\admin\AppData\Local\Temp\PROGRA~~1\795683489672.exeexecutable
MD5:0FE7B22CBF619CF188638A6025B81DEB
SHA256:B4DD76CDCFE1DDBD6F4F8436EEF5919D46A06EAE7FD26081E503B77DB450B7CF
4312shost.exeC:\Users\admin\AppData\Local\Temp\PROGRA~~1\727707230412.exe —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
93
TCP/UDP connections
42
DNS requests
19
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5392
svchost.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
5276
MoUsoCoreWorker.exe
GET
200
23.59.18.102:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
5316
svchost.exe
POST
400
20.190.159.128:443
https://login.live.com/ppsecure/deviceaddcredential.srf
US
text
203 b
whitelisted
5316
svchost.exe
POST
200
20.190.160.2:443
https://login.live.com/RST2.srf
US
binary
1.24 Kb
whitelisted
5316
svchost.exe
POST
400
20.190.159.128:443
https://login.live.com/ppsecure/deviceaddcredential.srf
US
binary
203 b
whitelisted
—
—
POST
400
20.190.160.2:443
https://login.live.com/ppsecure/deviceaddcredential.srf
US
text
203 b
whitelisted
2436
slui.exe
POST
500
48.192.1.65:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
US
text
512 b
whitelisted
2792
SIHClient.exe
GET
304
20.165.94.63:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
5316
svchost.exe
POST
200
20.190.159.128:443
https://login.live.com/RST2.srf
US
xml
1.24 Kb
whitelisted
—
—
POST
400
20.190.160.2:443
https://login.live.com/ppsecure/deviceaddcredential.srf
US
binary
203 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
—
—
48.192.1.65:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
2.16.204.141:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
5392
svchost.exe
2.16.164.49:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
5392
svchost.exe
23.59.18.102:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
5276
MoUsoCoreWorker.exe
23.59.18.102:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
2436
slui.exe
48.192.1.65:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3428
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
activation-v2.sls.microsoft.com
  • 48.192.1.65
whitelisted
www.bing.com
  • 2.16.204.141
  • 2.16.204.161
whitelisted
google.com
  • 142.251.127.100
  • 142.251.127.139
  • 142.251.127.138
  • 142.251.127.113
  • 142.251.127.102
  • 142.251.127.101
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.120
whitelisted
www.microsoft.com
  • 23.59.18.102
  • 88.221.169.152
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.159.128
  • 40.126.31.67
  • 40.126.31.71
  • 20.190.159.73
  • 40.126.31.69
  • 40.126.31.3
  • 20.190.159.131
  • 40.126.31.128
whitelisted
pastebin.com
  • 172.66.171.73
  • 104.20.29.150
whitelisted
slscr.update.microsoft.com
  • 20.165.94.63
whitelisted

Threats

PID
Process
Class
Message
2232
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Online Pastebin Text Storage
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
xfc495c23b8226582b6ba0c3518a67b2cffe76eafbf09e444a9d702cd74741d77.exe