Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10Xworm-V5.6...ox.dll
windows7-x64
1Xworm-V5.6...ox.dll
windows10-2004-x64
1Xworm-V5.6/Fixer.bat
windows7-x64
1Xworm-V5.6/Fixer.bat
windows10-2004-x64
1Xworm-V5.6...re.dll
windows7-x64
1Xworm-V5.6...re.dll
windows10-2004-x64
1Xworm-V5.6...ms.dll
windows7-x64
1Xworm-V5.6...ms.dll
windows10-2004-x64
1Xworm-V5.6...I2.dll
windows7-x64
1Xworm-V5.6...I2.dll
windows10-2004-x64
1Xworm-V5.6...or.dll
windows7-x64
1Xworm-V5.6...or.dll
windows10-2004-x64
1Xworm-V5.6/NAudio.dll
windows7-x64
1Xworm-V5.6/NAudio.dll
windows10-2004-x64
1Xworm-V5.6...on.dll
windows7-x64
1Xworm-V5.6...on.dll
windows10-2004-x64
1Xworm-V5.6...ws.dll
windows7-x64
1Xworm-V5.6...ws.dll
windows10-2004-x64
1Xworm-V5.6...at.dll
windows7-x64
1Xworm-V5.6...at.dll
windows10-2004-x64
1Xworm-V5.6...um.dll
windows7-x64
1Xworm-V5.6...um.dll
windows10-2004-x64
1Xworm-V5.6...rd.dll
windows7-x64
1Xworm-V5.6...rd.dll
windows10-2004-x64
1Xworm-V5.6...ss.dll
windows7-x64
1Xworm-V5.6...ss.dll
windows10-2004-x64
1Xworm-V5.6...er.dll
windows7-x64
1Xworm-V5.6...er.dll
windows10-2004-x64
1Xworm-V5.6...er.dll
windows7-x64
1Xworm-V5.6...er.dll
windows10-2004-x64
1Xworm-V5.6...er.dll
windows7-x64
1Xworm-V5.6...er.dll
windows10-2004-x64
1Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04/11/2024, 21:22 UTC
Behavioral task
behavioral1
Sample
Xworm-V5.6/FastColoredTextBox.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Xworm-V5.6/FastColoredTextBox.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Xworm-V5.6/Fixer.bat
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
Xworm-V5.6/Fixer.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Xworm-V5.6/GMap.NET.Core.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Xworm-V5.6/GMap.NET.Core.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Xworm-V5.6/GMap.NET.WindowsForms.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Xworm-V5.6/GMap.NET.WindowsForms.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Xworm-V5.6/Guna.UI2.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Xworm-V5.6/Guna.UI2.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Xworm-V5.6/IconExtractor.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Xworm-V5.6/IconExtractor.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Xworm-V5.6/NAudio.dll
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
Xworm-V5.6/NAudio.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Xworm-V5.6/Newtonsoft.Json.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Xworm-V5.6/Newtonsoft.Json.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Xworm-V5.6/Plugins/ActiveWindows.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
Xworm-V5.6/Plugins/ActiveWindows.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Xworm-V5.6/Plugins/Chat.dll
Resource
win7-20240729-en
Behavioral task
behavioral20
Sample
Xworm-V5.6/Plugins/Chat.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
Xworm-V5.6/Plugins/Chromium.dll
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
Xworm-V5.6/Plugins/Chromium.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
Xworm-V5.6/Plugins/Clipboard.dll
Resource
win7-20241010-en
Behavioral task
behavioral24
Sample
Xworm-V5.6/Plugins/Clipboard.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
Xworm-V5.6/Plugins/Cmstp-Bypass.dll
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
Xworm-V5.6/Plugins/Cmstp-Bypass.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
Xworm-V5.6/Plugins/FileManager.dll
Resource
win7-20240729-en
Behavioral task
behavioral28
Sample
Xworm-V5.6/Plugins/FileManager.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
Xworm-V5.6/Plugins/FilesSearcher.dll
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
Xworm-V5.6/Plugins/FilesSearcher.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
Xworm-V5.6/Plugins/HBrowser.dll
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
Xworm-V5.6/Plugins/HBrowser.dll
Resource
win10v2004-20241007-en
General
-
Target
Xworm-V5.6/Plugins/Chromium.dll
-
Size
32KB
-
MD5
edb2f0d0eb08dcd78b3ddf87a847de01
-
SHA1
cc23d101f917cad3664f8c1fa0788a89e03a669c
-
SHA256
b6d8bccdf123ceac6b9642ad3500d4e0b3d30b9c9dd2d29499d38c02bd8f9982
-
SHA512
8f87da834649a21a908c95a9ea8e2d94726bd9f33d4b7786348f6371dfae983cc2b5b5d4f80a17a60ded17d4eb71771ec25a7c82e4f3a90273c46c8ee3b8f2c3
-
SSDEEP
768:6SyQlmUmBlEu0FXfjq2sgDrLjfcVJ5sN9aWdMIxbKhJ+GEq3ZsL5f62:3yQltmBlmFXfjq2sgDrLjfcVJ5sNkQOa
Malware Config
Signatures
Processes
Network
-
Remote address:8.8.8.8:53Request2.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request88.156.103.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request196.249.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request241.150.49.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request149.220.183.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request200.163.202.172.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request241.42.69.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request92.12.20.2.in-addr.arpaIN PTRResponse92.12.20.2.in-addr.arpaIN PTRa2-20-12-92deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request83.210.23.2.in-addr.arpaIN PTRResponse83.210.23.2.in-addr.arpaIN PTRa2-23-210-83deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request94.12.20.2.in-addr.arpaIN PTRResponse94.12.20.2.in-addr.arpaIN PTRa2-20-12-94deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request21.236.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEax-0001.ax-msedge.netax-0001.ax-msedge.netIN A150.171.28.10ax-0001.ax-msedge.netIN A150.171.27.10
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239340418583_14V7XNG13AXXMHR4D&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:150.171.28.10:443RequestGET /th?id=OADD2.10239340418583_14V7XNG13AXXMHR4D&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 1145289
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: DA446B67C36F44A08CBFEAD0F1A0E274 Ref B: LON601060104011 Ref C: 2024-11-04T21:25:01Z
date: Mon, 04 Nov 2024 21:25:01 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301245_1SIH6VK53RU240WOI&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:150.171.28.10:443RequestGET /th?id=OADD2.10239317301245_1SIH6VK53RU240WOI&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 615306
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: C6CF9E5869B749D39451F1FA3EF8C2E7 Ref B: LON601060104011 Ref C: 2024-11-04T21:25:01Z
date: Mon, 04 Nov 2024 21:25:01 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301530_18PVHZ040UYOWJ1A4&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:150.171.28.10:443RequestGET /th?id=OADD2.10239317301530_18PVHZ040UYOWJ1A4&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 475975
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 840035A895D04191A3DB50CD4AFA88BB Ref B: LON601060104011 Ref C: 2024-11-04T21:25:01Z
date: Mon, 04 Nov 2024 21:25:01 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301097_12A5KDJOE91WSRBSS&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:150.171.28.10:443RequestGET /th?id=OADD2.10239317301097_12A5KDJOE91WSRBSS&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 739586
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 8D61C3509BF34BB3A8EA5E41E9FD6DD0 Ref B: LON601060104011 Ref C: 2024-11-04T21:25:01Z
date: Mon, 04 Nov 2024 21:25:01 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239340418584_19MU177BXG1FCVM1K&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:150.171.28.10:443RequestGET /th?id=OADD2.10239340418584_19MU177BXG1FCVM1K&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 906468
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 1092C1765FB84EA1BF5CBDEBD4E3FB84 Ref B: LON601060104011 Ref C: 2024-11-04T21:25:01Z
date: Mon, 04 Nov 2024 21:25:01 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301654_1QFI75P42YM2SO877&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:150.171.28.10:443RequestGET /th?id=OADD2.10239317301654_1QFI75P42YM2SO877&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 407818
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: EF3BD638C8334BD2A5C65E61856829B7 Ref B: LON601060104011 Ref C: 2024-11-04T21:25:02Z
date: Mon, 04 Nov 2024 21:25:02 GMT
-
Remote address:8.8.8.8:53Request45.19.74.20.in-addr.arpaIN PTRResponse
-
1.2kB 6.9kB 15 13
-
1.2kB 6.9kB 15 13
-
150.171.28.10:443https://tse1.mm.bing.net/th?id=OADD2.10239317301654_1QFI75P42YM2SO877&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90tls, http2156.8kB 4.4MB 3256 3250
HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239340418583_14V7XNG13AXXMHR4D&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301245_1SIH6VK53RU240WOI&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301530_18PVHZ040UYOWJ1A4&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301097_12A5KDJOE91WSRBSS&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239340418584_19MU177BXG1FCVM1K&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Response
200HTTP Response
200HTTP Response
200HTTP Response
200HTTP Response
200HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301654_1QFI75P42YM2SO877&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Response
200 -
1.2kB 6.9kB 15 13
-
1.2kB 6.9kB 15 13
-
71 B 157 B 1 1
DNS Request
2.159.190.20.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
88.156.103.20.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
196.249.167.52.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
241.150.49.20.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
149.220.183.52.in-addr.arpa
-
74 B 160 B 1 1
DNS Request
200.163.202.172.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
241.42.69.40.in-addr.arpa
-
69 B 131 B 1 1
DNS Request
92.12.20.2.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
83.210.23.2.in-addr.arpa
-
69 B 131 B 1 1
DNS Request
94.12.20.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
21.236.111.52.in-addr.arpa
-
62 B 170 B 1 1
DNS Request
tse1.mm.bing.net
DNS Response
150.171.28.10150.171.27.10
-
70 B 156 B 1 1
DNS Request
45.19.74.20.in-addr.arpa