52c33068b9931fdc17faba5a22551145953a49cc9937b22ff5996d64418c2615

Analysis

max time kernel
107s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 19:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fluxus/Fluxus V7.exe
Size

3.9MB
MD5

b4f9cbca656fd34c4dbb1d706a7f1ad3
SHA1

2b95d88a80ccb619b581c420f7435c660cfbb28e
SHA256

1e022d3886700317e5c41977de8fd595db5fbb3529164048ed09ee7efdb5711d
SHA512

5ed86eaf8ae42d9a8f0dca9776e25b3c2232434b32088df7feaa8149886594f1d4b1e37c597597eacebdb4082e0263441a6b78def5eef2ad610a6875c28fe969
SSDEEP

49152:UgLIR9JyCns59qfuce05XlWycazyClY1YH8PnGpv80tbvvqVUcH:UgLIRfyC7egWJa3lY1U82kmvvoUc

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133548308208577533"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
852	chrome.exe
852	chrome.exe
5948	Fluxus V7.exe
5948	Fluxus V7.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4456	Fluxus V7.exe
Token: SeShutdownPrivilege	852	chrome.exe
Token: SeCreatePagefilePrivilege	852	chrome.exe
Token: SeShutdownPrivilege	852	chrome.exe
Token: SeCreatePagefilePrivilege	852	chrome.exe
Token: SeShutdownPrivilege	852	chrome.exe
Token: SeCreatePagefilePrivilege	852	chrome.exe
Token: SeShutdownPrivilege	852	chrome.exe
Token: SeCreatePagefilePrivilege	852	chrome.exe
Token: SeShutdownPrivilege	852	chrome.exe
Token: SeCreatePagefilePrivilege	852	chrome.exe
Token: SeShutdownPrivilege	852	chrome.exe
Token: SeCreatePagefilePrivilege	852	chrome.exe
Token: SeShutdownPrivilege	852	chrome.exe
Token: SeCreatePagefilePrivilege	852	chrome.exe
Token: SeShutdownPrivilege	852	chrome.exe
Token: SeCreatePagefilePrivilege	852	chrome.exe
Token: SeShutdownPrivilege	852	chrome.exe
Token: SeCreatePagefilePrivilege	852	chrome.exe
Token: SeShutdownPrivilege	852	chrome.exe
Token: SeCreatePagefilePrivilege	852	chrome.exe
Token: SeShutdownPrivilege	852	chrome.exe
Token: SeCreatePagefilePrivilege	852	chrome.exe
Token: SeShutdownPrivilege	852	chrome.exe
Token: SeCreatePagefilePrivilege	852	chrome.exe
Token: SeShutdownPrivilege	852	chrome.exe
Token: SeCreatePagefilePrivilege	852	chrome.exe
Token: SeShutdownPrivilege	852	chrome.exe
Token: SeCreatePagefilePrivilege	852	chrome.exe
Token: SeShutdownPrivilege	852	chrome.exe
Token: SeCreatePagefilePrivilege	852	chrome.exe
Token: SeShutdownPrivilege	852	chrome.exe
Token: SeCreatePagefilePrivilege	852	chrome.exe
Token: SeShutdownPrivilege	852	chrome.exe
Token: SeCreatePagefilePrivilege	852	chrome.exe
Token: SeShutdownPrivilege	852	chrome.exe
Token: SeCreatePagefilePrivilege	852	chrome.exe
Token: SeShutdownPrivilege	852	chrome.exe
Token: SeCreatePagefilePrivilege	852	chrome.exe
Token: SeShutdownPrivilege	852	chrome.exe
Token: SeCreatePagefilePrivilege	852	chrome.exe
Token: SeShutdownPrivilege	852	chrome.exe
Token: SeCreatePagefilePrivilege	852	chrome.exe
Token: SeShutdownPrivilege	852	chrome.exe
Token: SeCreatePagefilePrivilege	852	chrome.exe
Token: SeShutdownPrivilege	852	chrome.exe
Token: SeCreatePagefilePrivilege	852	chrome.exe
Token: SeShutdownPrivilege	852	chrome.exe
Token: SeCreatePagefilePrivilege	852	chrome.exe
Token: SeShutdownPrivilege	852	chrome.exe
Token: SeCreatePagefilePrivilege	852	chrome.exe
Token: SeShutdownPrivilege	852	chrome.exe
Token: SeCreatePagefilePrivilege	852	chrome.exe
Token: SeShutdownPrivilege	852	chrome.exe
Token: SeCreatePagefilePrivilege	852	chrome.exe
Token: SeShutdownPrivilege	852	chrome.exe
Token: SeCreatePagefilePrivilege	852	chrome.exe
Token: SeShutdownPrivilege	852	chrome.exe
Token: SeCreatePagefilePrivilege	852	chrome.exe
Token: SeShutdownPrivilege	852	chrome.exe
Token: SeCreatePagefilePrivilege	852	chrome.exe
Token: SeShutdownPrivilege	852	chrome.exe
Token: SeCreatePagefilePrivilege	852	chrome.exe
Token: SeShutdownPrivilege	852	chrome.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
5948	Fluxus V7.exe
5948	Fluxus V7.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe
852	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 3352	852	chrome.exe	96
PID 852 wrote to memory of 3352	852	chrome.exe	96
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 4620	852	chrome.exe	98
PID 852 wrote to memory of 3936	852	chrome.exe	99
PID 852 wrote to memory of 3936	852	chrome.exe	99
PID 852 wrote to memory of 3448	852	chrome.exe	100
PID 852 wrote to memory of 3448	852	chrome.exe	100
PID 852 wrote to memory of 3448	852	chrome.exe	100
PID 852 wrote to memory of 3448	852	chrome.exe	100
PID 852 wrote to memory of 3448	852	chrome.exe	100
PID 852 wrote to memory of 3448	852	chrome.exe	100
PID 852 wrote to memory of 3448	852	chrome.exe	100
PID 852 wrote to memory of 3448	852	chrome.exe	100
PID 852 wrote to memory of 3448	852	chrome.exe	100
PID 852 wrote to memory of 3448	852	chrome.exe	100
PID 852 wrote to memory of 3448	852	chrome.exe	100
PID 852 wrote to memory of 3448	852	chrome.exe	100
PID 852 wrote to memory of 3448	852	chrome.exe	100
PID 852 wrote to memory of 3448	852	chrome.exe	100
PID 852 wrote to memory of 3448	852	chrome.exe	100
PID 852 wrote to memory of 3448	852	chrome.exe	100
PID 852 wrote to memory of 3448	852	chrome.exe	100
PID 852 wrote to memory of 3448	852	chrome.exe	100
PID 852 wrote to memory of 3448	852	chrome.exe	100
PID 852 wrote to memory of 3448	852	chrome.exe	100
PID 852 wrote to memory of 3448	852	chrome.exe	100
PID 852 wrote to memory of 3448	852	chrome.exe	100

C:\Users\Admin\AppData\Local\Temp\Fluxus\Fluxus V7.exe
"C:\Users\Admin\AppData\Local\Temp\Fluxus\Fluxus V7.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4456

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4408

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffde7509758,0x7ffde7509768,0x7ffde7509778
  2⤵
  PID:3352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 --field-trial-handle=1904,i,12375427791624960740,10992278937550167040,131072 /prefetch:2
  2⤵
  PID:4620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1904,i,12375427791624960740,10992278937550167040,131072 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1904,i,12375427791624960740,10992278937550167040,131072 /prefetch:8
  2⤵
  PID:3448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3084 --field-trial-handle=1904,i,12375427791624960740,10992278937550167040,131072 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3088 --field-trial-handle=1904,i,12375427791624960740,10992278937550167040,131072 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4172 --field-trial-handle=1904,i,12375427791624960740,10992278937550167040,131072 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 --field-trial-handle=1904,i,12375427791624960740,10992278937550167040,131072 /prefetch:8
  2⤵
  PID:880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5260 --field-trial-handle=1904,i,12375427791624960740,10992278937550167040,131072 /prefetch:8
  2⤵
  PID:3268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 --field-trial-handle=1904,i,12375427791624960740,10992278937550167040,131072 /prefetch:8
  2⤵
  PID:3896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4808 --field-trial-handle=1904,i,12375427791624960740,10992278937550167040,131072 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4196 --field-trial-handle=1904,i,12375427791624960740,10992278937550167040,131072 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5396 --field-trial-handle=1904,i,12375427791624960740,10992278937550167040,131072 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3252 --field-trial-handle=1904,i,12375427791624960740,10992278937550167040,131072 /prefetch:8
  2⤵
  PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3460 --field-trial-handle=1904,i,12375427791624960740,10992278937550167040,131072 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4104 --field-trial-handle=1904,i,12375427791624960740,10992278937550167040,131072 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4796 --field-trial-handle=1904,i,12375427791624960740,10992278937550167040,131072 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 --field-trial-handle=1904,i,12375427791624960740,10992278937550167040,131072 /prefetch:8
  2⤵
  PID:2064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=6048 --field-trial-handle=1904,i,12375427791624960740,10992278937550167040,131072 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3404 --field-trial-handle=1904,i,12375427791624960740,10992278937550167040,131072 /prefetch:8
  2⤵
  PID:5556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1888 --field-trial-handle=1904,i,12375427791624960740,10992278937550167040,131072 /prefetch:8
  2⤵
  PID:5660

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2696

C:\Users\Admin\Downloads\Fluxus\Fluxus\Fluxus V7.exe
"C:\Users\Admin\Downloads\Fluxus\Fluxus\Fluxus V7.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:5948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f

Filesize
62KB

MD5
aa41473732f30d3b58deb7b994624a04

SHA1
785555553919d805666b4b135ee0cb79b3aea51e

SHA256
7a3ce70f6a14dbcffeb2aeddc3f22dad500abaa0d18b387e4930e36bae09ed51

SHA512
00bc19d8266aca5de6b551551d8baf8f537b8e5784566109cd9c24cc6463a652ef7d1466588e0401a7d52c226647454e5f992c4581b2166811294091e3040af9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
864B

MD5
1b423d4f1fe774e879cb03b1c50551ac

SHA1
0a430e14dfbe5ecebf0a3c0f4a21efce4e77856c

SHA256
f79bf0306794ac6ecc8c2915d08d31b32bfdea35f87e6339d48422d54d79a413

SHA512
117f11150f66ff1664fb85728b26f8a297412465a885276eece131147449146feb569bb657f9d4c9e1a2bd31f541c5c1b63612d0777cf1aed21e278d1ad4ba99

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
8f26cedd99795e59dc2ab780cfe0894f

SHA1
b1cca21742d0694179f53dd36200a3ff3aca14e3

SHA256
28eaea4cd2083a92cce7502457a86f8028d9465b0eb528f904488d0cfcac90cd

SHA512
7fc999a30b90423dfaa896680ca079e68ee3517faa712d19569ab641b12a39bed3cc24515955db7d2580f1951a8a661306d85133f685b4112e28ea4abc0eaf95

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
873B

MD5
c4410ddc258e130689f7d0f56908b841

SHA1
3de69f5b51a4135fdd6e3a18c9b4281fb1975a87

SHA256
6c3a370413e279022dc187213faffadc5a86eccfe0e3ec925d40c692f021600e

SHA512
5004a8a3c6bcc0fc007280be3bb8440ab11166837c0c1bd6e12bf774cba7eb8b8ad824e80a123b76d13a646200ea5e9683aeb2b67c7977c93158b8f13f72d0c1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
f50980efcdc1f725040bf6aee5f6ae3c

SHA1
2f7f4d0fddb54ed34bdb85bd4540d9a92e11edc9

SHA256
cdedf325c8d0cb855ab3d56cb23efce2c07b4985b0fce4a87c630ac1e0db611f

SHA512
d6259b1010b36bff77c19eb3888bc68a804a1c762222e870dd338c5d78a542c5c78df6f514b93ae143da68878da4a5356daa907e2b10af3b8b62c05c625fa93e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
de75c027b6a5113d6d0d429daffcfd38

SHA1
5cbecff29379976adf09f877d4ac48380791bccb

SHA256
0e407bc0f21b0b5f9d02f8e7ca2a520c57b36059f5012ed654e9970b7e1995cb

SHA512
88651ec29eafd3747504a8c828f5a7210e357157d89370268937f62f9d4ea079ebf537911cddc0460a87cb7b644a671fd668c0f45afff983c64574469eac93cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
0e08357bee72887ccea12bc37c4a1f60

SHA1
a2cb2f9db64258b95eaca749c32a68f700cdb172

SHA256
72e2ea8d86a0d15d5fdaed8beba50eeaa967240a26d0ff428b899aa04c67b20f

SHA512
526e74dec563c697f5a543dc636f9973ac7152e6ac81f5198f603dd647c676a78f717d0cb9bdce0717ba265cb1462521cd5d6504a339abfbb094f9c1fb6c1ed6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
36569ed2858caeb565d4c514af3ef4de

SHA1
c97a3b0b91ef594d2c1bf237334f6032b68d887f

SHA256
d9698a61738979acbf01416600e86fde1f5b003152434823bae050cf8f495360

SHA512
d2574b496955b858c26d81fe00a453873122a5ed8ecc0e8b37439ffddbac89c0071df3e0127deebf8185cc5d4e79d22fc00a251349c1b51f74eefc25a8515fb8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
c17c657008acf5818733c2f4e3eded59

SHA1
c353c1fe59184269e3d6a15707f8e4baebc658ae

SHA256
be6c4bad936994a258ea9194cb31321fa221bf0990ad910e5ddc21a8e3844b92

SHA512
3b53969c6defbdb503a4b07c2fbdbe8563796d5117e0b92ad07d9f9ad036ed66d16f7ff0c7938a0caa5077ea05b88211482725ba5cda76a2217ef06f8623500d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
a3c765649b7568bd53ec8f93113c50e1

SHA1
5fa497996fccfe85d8e04a34d6e6536de9041e79

SHA256
54263f9cb85c584209dc0042ad0bf644c1138ddffa8586e5ee14d742a3997876

SHA512
0d057755c517ed36de09b91ab82392d2948beceeebb8b1ae0b123772bea896c0775b8e1d3aa39cc0517c5131a92e6469039742cdfc5b315c32af5f6dc2c368f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
258KB

MD5
135ff06e9a97e87d0a4f282baa662e2f

SHA1
f5794176bc0c1de7f4944bf1145339c92bbd7084

SHA256
893cacea9e7d45f5b9e99b7845bce34332389d23dd507f1e198a8e5a5dd9fafb

SHA512
a60802ebf8ca5bb488192955bf119deabd6006200f4c6295af92775e4e13406386c34f5c6d719f7c2cf1d5da63618b68be26527250bdfb4e3457a097cdc85d49

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
258KB

MD5
6177ac44881124b1cfc0ea9dcd49759f

SHA1
31fe5e046a79a9666e542d973ad61f8dfd0c45eb

SHA256
736c5ecf438ec17865e425422adf05e087f0e1dec88ff3ed5caf45dfb70dde75

SHA512
256315e0bdbb21c63ac488e0aeae5cb899daffe3231cd30dd8d04c3a900ff43f0fd5843ba14e93d0c7d7ed9dc3bcbc801164d235af09063caebfeeba702977ce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
113KB

MD5
1c25ed77037304a186f520aa7bfd64e8

SHA1
bd432c10267a4305dc6e19806683f6a25ea03344

SHA256
980e4133f01fb8e716fc8fcf274ba0a46f86a6f586f877413e8131c6f19253cc

SHA512
bceed2de3cce71286105cf60ced41af256d3f040cc5e065db3722432ef69671c32b0ab2d239df02862d9f1191d4322578d5094877a903f436d8bcf8de3b6ea32

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
104KB

MD5
cbbd8dba2de6489274b78c848d80d81a

SHA1
2f7dd54b1dd672ae2f2879cdb1abd49bc42207bf

SHA256
9e2f1ff49985558d2407aa168aaa3fcd2b33dd2b2e465929277177a301d90171

SHA512
032b90f2722ce93261af6c1ca8db630f929414733a1451fe63e235d15645a675bc2b667ffa41d3e661a187fd035fdfe0d3c08418f96f3d46ef97a58cd3350098

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe58056a.TMP

Filesize
97KB

MD5
34b06b0242540c7bd7428f905046c233

SHA1
413796f2aeefe5e7df46c6dc88c72051b47f6e91

SHA256
57abbc7f2d96d2bdabd74fd101e45edd3b6ddc9dadfca1ec7bfeaceb63b3ea88

SHA512
567c235904e3bf4d5fb686455fe97257d8ed3605f527a7cd0a05f8bc8688ccb9edaebacb8bef90e6c96542a0c030a36342100480b89e5e590e8da180987cc3cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dfn0s5ub.xie.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\Fluxus.zip

Filesize
2.3MB

MD5
0ae0a6a9b090ff1645468003f45c4966

SHA1
08f3983824bf49b1b6ea24b8e60c9ed1b026d0ab

SHA256
52c33068b9931fdc17faba5a22551145953a49cc9937b22ff5996d64418c2615

SHA512
b1c6e174173a105b496473da77ddadbebc1ac9920ba3d6b590d35a396b18b6eedf300300340974d6c0f0d49a51eadf7f2335b2a184591c8c892c06fb62fad120

Download Submit
memory/4456-2-0x0000000004E40000-0x0000000004E50000-memory.dmp

Filesize
64KB

Download
memory/4456-1-0x0000000000030000-0x0000000000424000-memory.dmp

Filesize
4.0MB

Download
memory/4456-0-0x0000000074630000-0x0000000074DE0000-memory.dmp

Filesize
7.7MB

Download
memory/4456-5-0x0000000074630000-0x0000000074DE0000-memory.dmp

Filesize
7.7MB

Download
memory/4456-4-0x0000000005220000-0x00000000052B2000-memory.dmp

Filesize
584KB

Download
memory/4456-3-0x00000000056E0000-0x0000000005C84000-memory.dmp

Filesize
5.6MB

Download
memory/5948-265-0x000000000A3E0000-0x000000000A3EE000-memory.dmp

Filesize
56KB

Download
memory/5948-286-0x000000000D4C0000-0x000000000D4E2000-memory.dmp

Filesize
136KB

Download
memory/5948-263-0x0000000005B40000-0x0000000005B50000-memory.dmp

Filesize
64KB

Download
memory/5948-266-0x000000000BD40000-0x000000000C368000-memory.dmp

Filesize
6.2MB

Download
memory/5948-253-0x000000000A3D0000-0x000000000A3D8000-memory.dmp

Filesize
32KB

Download
memory/5948-276-0x000000000BCF0000-0x000000000BD0A000-memory.dmp

Filesize
104KB

Download
memory/5948-277-0x000000000C3B0000-0x000000000C3E6000-memory.dmp

Filesize
216KB

Download
memory/5948-278-0x000000000CA70000-0x000000000D0EA000-memory.dmp

Filesize
6.5MB

Download
memory/5948-279-0x000000000C490000-0x000000000C526000-memory.dmp

Filesize
600KB

Download
memory/5948-280-0x000000000C3F0000-0x000000000C412000-memory.dmp

Filesize
136KB

Download
memory/5948-281-0x000000000C530000-0x000000000C596000-memory.dmp

Filesize
408KB

Download
memory/5948-282-0x000000000C440000-0x000000000C45E000-memory.dmp

Filesize
120KB

Download
memory/5948-283-0x000000000C5F0000-0x000000000C63A000-memory.dmp

Filesize
296KB

Download
memory/5948-284-0x000000000D0F0000-0x000000000D444000-memory.dmp

Filesize
3.3MB

Download
memory/5948-285-0x000000000D450000-0x000000000D4B6000-memory.dmp

Filesize
408KB

Download
memory/5948-264-0x000000000A770000-0x000000000A7A8000-memory.dmp

Filesize
224KB

Download
memory/5948-287-0x000000000D680000-0x000000000D6CC000-memory.dmp

Filesize
304KB

Download
memory/5948-297-0x000000000E5B0000-0x000000000E5CE000-memory.dmp

Filesize
120KB

Download
memory/5948-298-0x000000000E5D0000-0x000000000E673000-memory.dmp

Filesize
652KB

Download
memory/5948-299-0x000000000E6C0000-0x000000000E6CA000-memory.dmp

Filesize
40KB

Download
memory/5948-300-0x000000000E6E0000-0x000000000E6F1000-memory.dmp

Filesize
68KB

Download
memory/5948-301-0x000000000E890000-0x000000000E89E000-memory.dmp

Filesize
56KB

Download
memory/5948-302-0x000000000E8B0000-0x000000000E8C4000-memory.dmp

Filesize
80KB

Download
memory/5948-303-0x000000000E8F0000-0x000000000E90A000-memory.dmp

Filesize
104KB

Download
memory/5948-304-0x000000000E910000-0x000000000E918000-memory.dmp

Filesize
32KB

Download
memory/5948-305-0x000000000D910000-0x000000000D918000-memory.dmp

Filesize
32KB

Download
memory/5948-252-0x0000000005B40000-0x0000000005B50000-memory.dmp

Filesize
64KB

Download
memory/5948-317-0x0000000074630000-0x0000000074DE0000-memory.dmp

Filesize
7.7MB

Download
memory/5948-318-0x0000000005B40000-0x0000000005B50000-memory.dmp

Filesize
64KB

Download
memory/5948-319-0x0000000005B40000-0x0000000005B50000-memory.dmp

Filesize
64KB

Download
memory/5948-251-0x0000000074630000-0x0000000074DE0000-memory.dmp

Filesize
7.7MB

Download
memory/5948-334-0x0000000074630000-0x0000000074DE0000-memory.dmp

Filesize
7.7MB

Download