xworm | hxxps://mega[.]nz/file/ORE0hbia#WUbaV7wkKeJGJn69jImU7sjH4ipqeEYEJ-XWS7JpkiY

Resubmissions

22-11-2024 16:51

241122-vc6fqatrfx 10

22-11-2024 16:48

241122-vbcr1strd1 10

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2024 16:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/ORE0hbia#WUbaV7wkKeJGJn69jImU7sjH4ipqeEYEJ-XWS7JpkiY

Score

10^/10

xworm discovery rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

127.0.0.1:40193

table-services.gl.at.ply.gg:40193

Mutex

hwj3sOSYzsrtcnTJ

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023d2f-207.dat	family_xworm
behavioral1/memory/5828-209-0x00000000005C0000-0x00000000005CE000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Executes dropped EXE 9 IoCs

pid	Process
5828	Inject In EAC.exe
5156	EAC_BYPASS.exe
5480	EAC_BYPASS.exe
5628	EAC_BYPASS.exe
1288	EAC_BYPASS.exe
2668	EAC_BYPASS.exe
5652	EAC_BYPASS.exe
1560	EAC_BYPASS.exe
5572	Inject in Forinte NOT WOKRING IN UPDATE.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3820	msedge.exe
3820	msedge.exe
3496	msedge.exe
3496	msedge.exe
1676	identity_helper.exe
1676	identity_helper.exe
2424	msedge.exe
2424	msedge.exe
5156	EAC_BYPASS.exe
5156	EAC_BYPASS.exe
5480	EAC_BYPASS.exe
5480	EAC_BYPASS.exe
5628	EAC_BYPASS.exe
5628	EAC_BYPASS.exe
1288	EAC_BYPASS.exe
1288	EAC_BYPASS.exe
2668	EAC_BYPASS.exe
2668	EAC_BYPASS.exe
5652	EAC_BYPASS.exe
5652	EAC_BYPASS.exe
1560	EAC_BYPASS.exe
1560	EAC_BYPASS.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: 33	3236	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3236	AUDIODG.EXE
Token: SeRestorePrivilege	5532	7zG.exe
Token: 35	5532	7zG.exe
Token: SeSecurityPrivilege	5532	7zG.exe
Token: SeSecurityPrivilege	5532	7zG.exe
Token: SeDebugPrivilege	5828	Inject In EAC.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
5532	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
5156	EAC_BYPASS.exe
5480	EAC_BYPASS.exe
5628	EAC_BYPASS.exe
1288	EAC_BYPASS.exe
2668	EAC_BYPASS.exe
5652	EAC_BYPASS.exe
1560	EAC_BYPASS.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 2452	3496	msedge.exe	82
PID 3496 wrote to memory of 2452	3496	msedge.exe	82
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 2248	3496	msedge.exe	83
PID 3496 wrote to memory of 3820	3496	msedge.exe	84
PID 3496 wrote to memory of 3820	3496	msedge.exe	84
PID 3496 wrote to memory of 852	3496	msedge.exe	85
PID 3496 wrote to memory of 852	3496	msedge.exe	85
PID 3496 wrote to memory of 852	3496	msedge.exe	85
PID 3496 wrote to memory of 852	3496	msedge.exe	85
PID 3496 wrote to memory of 852	3496	msedge.exe	85
PID 3496 wrote to memory of 852	3496	msedge.exe	85
PID 3496 wrote to memory of 852	3496	msedge.exe	85
PID 3496 wrote to memory of 852	3496	msedge.exe	85
PID 3496 wrote to memory of 852	3496	msedge.exe	85
PID 3496 wrote to memory of 852	3496	msedge.exe	85
PID 3496 wrote to memory of 852	3496	msedge.exe	85
PID 3496 wrote to memory of 852	3496	msedge.exe	85
PID 3496 wrote to memory of 852	3496	msedge.exe	85
PID 3496 wrote to memory of 852	3496	msedge.exe	85
PID 3496 wrote to memory of 852	3496	msedge.exe	85
PID 3496 wrote to memory of 852	3496	msedge.exe	85
PID 3496 wrote to memory of 852	3496	msedge.exe	85
PID 3496 wrote to memory of 852	3496	msedge.exe	85
PID 3496 wrote to memory of 852	3496	msedge.exe	85
PID 3496 wrote to memory of 852	3496	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://mega.nz/file/ORE0hbia#WUbaV7wkKeJGJn69jImU7sjH4ipqeEYEJ-XWS7JpkiY
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80d7746f8,0x7ff80d774708,0x7ff80d774718
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,2053228075296481381,12949169401958431112,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,2053228075296481381,12949169401958431112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,2053228075296481381,12949169401958431112,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,2053228075296481381,12949169401958431112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,2053228075296481381,12949169401958431112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2036,2053228075296481381,12949169401958431112,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,2053228075296481381,12949169401958431112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,2053228075296481381,12949169401958431112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2036,2053228075296481381,12949169401958431112,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4160 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,2053228075296481381,12949169401958431112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2036,2053228075296481381,12949169401958431112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,2053228075296481381,12949169401958431112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,2053228075296481381,12949169401958431112,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,2053228075296481381,12949169401958431112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,2053228075296481381,12949169401958431112,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,2053228075296481381,12949169401958431112,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2440 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3280

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x480 0x514
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3236

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5228

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Blume Cracked By Vixen Work in 2024 And 2025\" -ad -an -ai#7zMap14765:150:7zEvent17686
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5532

C:\Users\Admin\Downloads\Blume Cracked By Vixen Work in 2024 And 2025\Blume Cracked By Vixen Group\Inject In EAC.exe
"C:\Users\Admin\Downloads\Blume Cracked By Vixen Work in 2024 And 2025\Blume Cracked By Vixen Group\Inject In EAC.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5828

C:\Users\Admin\Downloads\Blume Cracked By Vixen Work in 2024 And 2025\Blume Cracked By Vixen Group\Plugins\EAC_BYPASS.exe
"C:\Users\Admin\Downloads\Blume Cracked By Vixen Work in 2024 And 2025\Blume Cracked By Vixen Group\Plugins\EAC_BYPASS.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5156

C:\Users\Admin\Downloads\Blume Cracked By Vixen Work in 2024 And 2025\Blume Cracked By Vixen Group\Plugins\EAC_BYPASS.exe
"C:\Users\Admin\Downloads\Blume Cracked By Vixen Work in 2024 And 2025\Blume Cracked By Vixen Group\Plugins\EAC_BYPASS.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5480

C:\Users\Admin\Downloads\Blume Cracked By Vixen Work in 2024 And 2025\Blume Cracked By Vixen Group\Plugins\EAC_BYPASS.exe
"C:\Users\Admin\Downloads\Blume Cracked By Vixen Work in 2024 And 2025\Blume Cracked By Vixen Group\Plugins\EAC_BYPASS.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5628

C:\Users\Admin\Downloads\Blume Cracked By Vixen Work in 2024 And 2025\Blume Cracked By Vixen Group\Plugins\EAC_BYPASS.exe
"C:\Users\Admin\Downloads\Blume Cracked By Vixen Work in 2024 And 2025\Blume Cracked By Vixen Group\Plugins\EAC_BYPASS.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1288

C:\Users\Admin\Downloads\Blume Cracked By Vixen Work in 2024 And 2025\Blume Cracked By Vixen Group\Plugins\EAC_BYPASS.exe
"C:\Users\Admin\Downloads\Blume Cracked By Vixen Work in 2024 And 2025\Blume Cracked By Vixen Group\Plugins\EAC_BYPASS.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2668

C:\Users\Admin\Downloads\Blume Cracked By Vixen Work in 2024 And 2025\Blume Cracked By Vixen Group\Plugins\EAC_BYPASS.exe
"C:\Users\Admin\Downloads\Blume Cracked By Vixen Work in 2024 And 2025\Blume Cracked By Vixen Group\Plugins\EAC_BYPASS.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5652

C:\Users\Admin\Downloads\Blume Cracked By Vixen Work in 2024 And 2025\Blume Cracked By Vixen Group\Plugins\EAC_BYPASS.exe
"C:\Users\Admin\Downloads\Blume Cracked By Vixen Work in 2024 And 2025\Blume Cracked By Vixen Group\Plugins\EAC_BYPASS.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1560

C:\Users\Admin\Downloads\Blume Cracked By Vixen Work in 2024 And 2025\Blume Cracked By Vixen Group\Inject in Forinte NOT WOKRING IN UPDATE.exe
"C:\Users\Admin\Downloads\Blume Cracked By Vixen Work in 2024 And 2025\Blume Cracked By Vixen Group\Inject in Forinte NOT WOKRING IN UPDATE.exe"
1⤵
- Executes dropped EXE
PID:5572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
17KB

MD5
950eca48e414acbe2c3b5d046dcb8521

SHA1
1731f264e979f18cdf08c405c7b7d32789a6fb59

SHA256
c0bbe530abfce19e06697bc4358eb426e076ccdb9113e22df4a6f32085da67a2

SHA512
27e55525ade4d099a6881011f6e2e0d5d3a9ca7181f4f014dc231d40b3b1907d0d437b0c44d336c25dd7b73209cd773b8563675ac260c43c7752e2d2d694d4d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
0450fcd8a5980d9fd454a1179f028757

SHA1
f659f44aecfab72ab639c2cecb102861ad278c6a

SHA256
a70a03e7438747b66f20e838343fc5756b0ff804c088382db6e7d50c0b3f0947

SHA512
26c72c495115279f33bef3965f25b54182bb1b0a73d3fefd3ecebc7d6420b34a29658e1d503b7495cb8120e4d2bbfada1fa4729de9942d1115df4723201d14c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
188B

MD5
008114e1a1a614b35e8a7515da0f3783

SHA1
3c390d38126c7328a8d7e4a72d5848ac9f96549b

SHA256
7301b76033c2970e61bab5eaddaff5aa652c39db5c0ea5632814f989716a1d18

SHA512
a202fc891eace003c346bad7e5d2c73dadf9591d5ce950395ff4b63cc2866b17e02bd3f0ad92749df033a936685851455bcdbfad30f26e765c3c89d3309cb82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e8ec5c810ad602c10bbf86fa63552eae

SHA1
00d722da9e3dde78beed803beb3f0577ad73e3a7

SHA256
908aa9fdddab0647cb9e910d2451aee1acd9c402ea0bae0185417a6768a2bfcd

SHA512
4cecd7df370602ab269649e8cc03bcd626ad9ffb7e2e62d0c651d279d175da03f9d5447f1db5d87ccafe9f8f80bae6ddf3fe09b75cc70b2a107fdbf4d7682bb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e6699ce762b384362b04d26ed4ead1f9

SHA1
0c2350e0195d32964e04db797af060315bf773a2

SHA256
987a0409f7150b9faee95b32789e25be1ec734c3355c954bda71c5a3f0ce3120

SHA512
5c841248aa509adb0d837c4b31c79e2a1a76d3c89973904bb5f7b83fa93c8048eecaee111a3e55df0cb67af2a116e46be4b4f368353462ef4d423defc4244cef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
7d6aa8cba851e7d2c990733914c61b8d

SHA1
d72fb2da4b4d7ed129ca16f5844bfbaecee556a5

SHA256
66d1be8e7f58fdb2ede7abd8206ae91dd9a014340d4a17e1e81241fbf44da76f

SHA512
cb8c86953d85bb40e676af700243d4b4f3646b862824c9f6cc8e649d2a9fa40b9a924d230b3bdf897de85b2b5ea720adfbc0783e71cf75a876e0a39a3c624d6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57d87e.TMP

Filesize
48B

MD5
0dd414abb3d436ebd3e00044ad73e017

SHA1
7544b169f4b126e5e5afed66b37a75a13751a9ac

SHA256
2ce33637fb1c488ffb33d4c5145cc3a50362d5e4e0ebadfc45e1cd953b48d699

SHA512
31b35c56973da11872d914f0a518d993ce684f60628c90f507a93780d7f7f7e1bb289cded584ee81bf8d0dcf622b3051ad9ccf237779c8bb965f0ad115dbde81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5ec76e97c5c712cccf8751d5fa00341b

SHA1
141111313bc73e1defcada33f7023f5f4b87b1fb

SHA256
04184aa95e3e41ff340767fec92424f95be5e8570bc06af4f90b2fd7c11e70b5

SHA512
47a80e27e298e07fad725d90f72dde20538b9010cf56e7bb210d124abe57b6ad3cfa7c3baeb8891bf608971b30f89392d9601320689aa3410baf91ba09363ea9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
050958821b6024a1d468b35c076170ea

SHA1
9a056be24b436e52b4196894bb47f11e7dd79cad

SHA256
eaacb1d747714ffe00538ab5d656dec627f25a638a1a3e89a4822c7a335f14a3

SHA512
e39b82d34171a869489808411777a21b9433dfd60dbe51f7dc5c2c462646b24367ca9ab26b1788c373ca2b7f6edb0aee6c2762061b366bd1cd244bc99739f2b9

Download Submit
C:\Users\Admin\Downloads\Blume Cracked By Vixen Work in 2024 And 2025.rar

Filesize
4.5MB

MD5
1ccb0e3f76baec45a2d9389aaedb0b1c

SHA1
6a382595fcf88afed76560c03736936faadf9a76

SHA256
3842cf8e8fd82426fda2106334d9626c3524d29311b4b7004951b8971aec38a2

SHA512
8ccfaba6438880a83c1dae7c166616a56e27c91e604470ff85f6b958fe347d6e33a6462e2c1c5e4452026f81c41b959510ddf50639a54a906a8432de8e999070

Download Submit
C:\Users\Admin\Downloads\Blume Cracked By Vixen Work in 2024 And 2025\Blume Cracked By Vixen Group\Inject In EAC.exe

Filesize
32KB

MD5
b6d53906bbe93e3ff62c88c942a19f85

SHA1
5021192ed0bcdacc1802ea7b2ce952d1285d7798

SHA256
b382e1437d9816afb54cfb13d64aab204998bc6ea498e84d39a4ce4efb4f8645

SHA512
d6e4be10b342680124a5da16cf9e9a7a0c0022a3efdf3763dfe316b7d1a8d60089f9a74e53271738e7c089d15f6fb72dcc9e02d8cc52575eef1dd0c23c8fa643

Download Submit
C:\Users\Admin\Downloads\Blume Cracked By Vixen Work in 2024 And 2025\Blume Cracked By Vixen Group\Plugins\EAC_BYPASS.exe

Filesize
4.9MB

MD5
b7219857e8e1305def7a814ad27f5fb5

SHA1
b41ee7cf66e7cfbc19764c1ca5bbddcc6141e0bb

SHA256
c3d568da2c0055824bfc629de90970014fe15164693f7acc478dc7e06891516f

SHA512
fa35a119b73e9fba4dad22966f5a13ae5486931c1f1559ec7e0e4fbf4523d5b463407c7058254fdc5160352cd668bf3ae55dbb352a1276704233d5e313dcd9fd

Download Submit
memory/1288-267-0x0000000140000000-0x000000014086B000-memory.dmp

Filesize
8.4MB

Download
memory/1560-282-0x0000000140000000-0x000000014086B000-memory.dmp

Filesize
8.4MB

Download
memory/2668-272-0x0000000140000000-0x000000014086B000-memory.dmp

Filesize
8.4MB

Download
memory/5156-252-0x0000000140000000-0x000000014086B000-memory.dmp

Filesize
8.4MB

Download
memory/5156-251-0x00007FF81C530000-0x00007FF81C532000-memory.dmp

Filesize
8KB

Download
memory/5480-257-0x0000000140000000-0x000000014086B000-memory.dmp

Filesize
8.4MB

Download
memory/5628-262-0x0000000140000000-0x000000014086B000-memory.dmp

Filesize
8.4MB

Download
memory/5652-277-0x0000000140000000-0x000000014086B000-memory.dmp

Filesize
8.4MB

Download
memory/5828-248-0x0000000000EB0000-0x0000000000EBC000-memory.dmp

Filesize
48KB

Download
memory/5828-209-0x00000000005C0000-0x00000000005CE000-memory.dmp

Filesize
56KB

Download