XWorm LATAM - WMI Spawned PowerShell With Cloudinary

Daniel Jeremiah@daniyyell

•updated Feb 27, 2026•0•27

Detects a low-noise XWorm execution chain described by ANY.RUN where WmiPrvSE.exe spawns PowerShell that uses WebClient to fetch Cloudinary-hosted content and performs in-memory Assembly.Load.