4919a549a552e26a10c9cda5518928c373404b072690c338f5821c34218cf2bd

Analysis

max time kernel
58s
max time network
135s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
17-11-2024 05:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fluxus.exe
Size

314KB
MD5

39380751ccb5ba67afe489aa449f7095
SHA1

bbada4d300f774f66a9f3cea28bd6a51d80b503a
SHA256

c3443ddfba264e9becf7d41400c1c43bb15b3fdd91bb883bccc9a3a85f6dab92
SHA512

681e17cc42f3d75a23c7e85ad3d62c34c0cc114130fefc9747456fb75a3db0f0cd2520697f1fa6b3216d6880ff448abfca4feed8eeff07ed628e0fd2bf1b69f6
SSDEEP

3072:SdcElZm+a6dBTmseX27WQqmYwSKiIwOby6bdxmYwSKqIfV:QZmj6Basem7WZN8by6bdxN

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0003000000020f84-1631.dat	upx
behavioral1/memory/2800-1633-0x000007FEF2D30000-0x000007FEF3319000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2472	chrome.exe
2472	chrome.exe

Suspicious use of AdjustPrivilegeToken 60 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe
Token: SeShutdownPrivilege	2472	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe
2472	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2920	2836	Fluxus.exe	30
PID 2836 wrote to memory of 2920	2836	Fluxus.exe	30
PID 2836 wrote to memory of 2920	2836	Fluxus.exe	30
PID 2472 wrote to memory of 2976	2472	chrome.exe	33
PID 2472 wrote to memory of 2976	2472	chrome.exe	33
PID 2472 wrote to memory of 2976	2472	chrome.exe	33
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 528	2472	chrome.exe	35
PID 2472 wrote to memory of 380	2472	chrome.exe	36
PID 2472 wrote to memory of 380	2472	chrome.exe	36
PID 2472 wrote to memory of 380	2472	chrome.exe	36
PID 2472 wrote to memory of 3016	2472	chrome.exe	37
PID 2472 wrote to memory of 3016	2472	chrome.exe	37
PID 2472 wrote to memory of 3016	2472	chrome.exe	37
PID 2472 wrote to memory of 3016	2472	chrome.exe	37
PID 2472 wrote to memory of 3016	2472	chrome.exe	37
PID 2472 wrote to memory of 3016	2472	chrome.exe	37
PID 2472 wrote to memory of 3016	2472	chrome.exe	37
PID 2472 wrote to memory of 3016	2472	chrome.exe	37
PID 2472 wrote to memory of 3016	2472	chrome.exe	37
PID 2472 wrote to memory of 3016	2472	chrome.exe	37
PID 2472 wrote to memory of 3016	2472	chrome.exe	37
PID 2472 wrote to memory of 3016	2472	chrome.exe	37
PID 2472 wrote to memory of 3016	2472	chrome.exe	37
PID 2472 wrote to memory of 3016	2472	chrome.exe	37
PID 2472 wrote to memory of 3016	2472	chrome.exe	37
PID 2472 wrote to memory of 3016	2472	chrome.exe	37

C:\Users\Admin\AppData\Local\Temp\Fluxus.exe
"C:\Users\Admin\AppData\Local\Temp\Fluxus.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2836 -s 500
  2⤵
  PID:2920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6d19758,0x7fef6d19768,0x7fef6d19778
  2⤵
  PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1108 --field-trial-handle=1312,i,8582749069011868178,4093362792899526307,131072 /prefetch:2
  2⤵
  PID:528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1552 --field-trial-handle=1312,i,8582749069011868178,4093362792899526307,131072 /prefetch:8
  2⤵
  PID:380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1624 --field-trial-handle=1312,i,8582749069011868178,4093362792899526307,131072 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1548 --field-trial-handle=1312,i,8582749069011868178,4093362792899526307,131072 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2244 --field-trial-handle=1312,i,8582749069011868178,4093362792899526307,131072 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1448 --field-trial-handle=1312,i,8582749069011868178,4093362792899526307,131072 /prefetch:2
  2⤵
  PID:468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2144 --field-trial-handle=1312,i,8582749069011868178,4093362792899526307,131072 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3720 --field-trial-handle=1312,i,8582749069011868178,4093362792899526307,131072 /prefetch:8
  2⤵
  PID:1548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3800 --field-trial-handle=1312,i,8582749069011868178,4093362792899526307,131072 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3788 --field-trial-handle=1312,i,8582749069011868178,4093362792899526307,131072 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3740 --field-trial-handle=1312,i,8582749069011868178,4093362792899526307,131072 /prefetch:8
  2⤵
  PID:1732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2568 --field-trial-handle=1312,i,8582749069011868178,4093362792899526307,131072 /prefetch:8
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=1816 --field-trial-handle=1312,i,8582749069011868178,4093362792899526307,131072 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3708 --field-trial-handle=1312,i,8582749069011868178,4093362792899526307,131072 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1052 --field-trial-handle=1312,i,8582749069011868178,4093362792899526307,131072 /prefetch:8
  2⤵
  PID:1496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=2528 --field-trial-handle=1312,i,8582749069011868178,4093362792899526307,131072 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=1300 --field-trial-handle=1312,i,8582749069011868178,4093362792899526307,131072 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2584 --field-trial-handle=1312,i,8582749069011868178,4093362792899526307,131072 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1936 --field-trial-handle=1312,i,8582749069011868178,4093362792899526307,131072 /prefetch:8
  2⤵
  PID:2160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=3564 --field-trial-handle=1312,i,8582749069011868178,4093362792899526307,131072 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4204 --field-trial-handle=1312,i,8582749069011868178,4093362792899526307,131072 /prefetch:8
  2⤵
  PID:2880

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2516

C:\Users\Admin\Downloads\Newm\RealFlux.exe
"C:\Users\Admin\Downloads\Newm\RealFlux.exe"
1⤵
PID:1332
- C:\Users\Admin\Downloads\Newm\RealFlux.exe
  "C:\Users\Admin\Downloads\Newm\RealFlux.exe"
  2⤵
  PID:2800

C:\Users\Admin\Downloads\Newm\RealFlux.exe
"C:\Users\Admin\Downloads\Newm\RealFlux.exe"
1⤵
PID:2516
- C:\Users\Admin\Downloads\Newm\RealFlux.exe
  "C:\Users\Admin\Downloads\Newm\RealFlux.exe"
  2⤵
  PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\6c01a1ce-17ed-4b84-a436-4ec05239c7c0.tmp

Filesize
356KB

MD5
e14705fc619d3ae679ec937d14db0a9d

SHA1
8caaa476de0a1ee61e5540bfd830e00723a82aed

SHA256
9695e8757ad1f78fd40ba8e285fac48128563a9e06e668cd8c4750c95aa22471

SHA512
dbe1f462ec0cb4315b3fc1201f854854ead61617194e97492a2c91b9507579fb74098cbf24ad3abbb62ae0dd0b247e3614f1fa2ede166fd1e972e51dd4cb4382

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
f720bdb1b202ca6d8672b5502ace749e

SHA1
9cb8acd4f30d5848a7cb10ddfa7af98a667fd128

SHA256
15aa086bb035b7ac711ea23b1ece467799fd12ac0428f77058d570ed8db36877

SHA512
5eef907eac8796508f0cb4fb9251b77bc460866eb59ea6b22a11bd981d2f99f2cffd8e5e4924cae062f8f2a7b09a12f47155b7cc1dcabc3d1c84c57a38c90e0f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
687B

MD5
3ed33f830eb712ee8f9825f5465ec04c

SHA1
b52c369f00428e98acfac700bf50689e249398f1

SHA256
f7405ffe0d3c2f9e1976a88f4237714361ee397bbef06bacae8931f7d9c40b42

SHA512
c11161adfcec64d1a2e15c54b9947450b4ad1fde7a7aa7738a52d22ece23b9f85ea14a354a471df99bb7b20b7106ccc18d466f7c0e79f4551b890c37662ca6f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
fe5b2761c4c9a03041df465d13f2c026

SHA1
380e727cd98c879cdc7bc20ddde5ec5369f251a6

SHA256
1f785b73b51e34f48cb905af82ed5a9280235bc17c8896f7c91a25976937b339

SHA512
f29b3e85d629d3d22052ce8aa5f6b8f1df181abe15bc62d094f457bddce262cb16bf9aad4154ae89f4c8f475077eee37e82d79c29405842eff5660adf31aff84

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
a7121b2ec5e599e4886b7cc4142d9f50

SHA1
a59cd85fa4fe17d18048bd7ccf70fb7a44517c21

SHA256
8227ed24f31c78900a3e09d9799f1048c05faaf4a1d761403f3ebe2adfc79df8

SHA512
d122ee682b970be1675ffab6bb4e354d6b4c164e743f106bf69ffbcc28222ce219d6cbd328519610c63fadc8c3b0699e9e221260698bd71b3745e6b7a6b3c191

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
532139f160b94cda35d86253e69c7298

SHA1
148c109e7dc5843a27b7c6c5fb52a56f5da31784

SHA256
db5e26699c571b8dd253aaf9984e6dbc0ce0f91a85931c2bdf0f2b72b60e22e4

SHA512
ad4feaa29c58d56991e03bded3f53db92f2a4530f69f3cd355f315e3c9e27fd8fd829b7d0edf81324261587b7225bd120766cbb4cc9212bc05bed4e6a498e46d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ac993749-93bf-48af-97c1-4f5ffbb537cd.tmp

Filesize
6KB

MD5
78b0effac28b88226a6191566007face

SHA1
1bdb7a45ff566bebcb71df0846876f38210c41fa

SHA256
0c05f81001411d29ecca77081ff177f68d0aa1452a67d6b1675869779fcea6ea

SHA512
e1b7a56a3f7f73ed8c4452e91c8dc0e7670157b91e35baf6b01d8d96312fae9697ec858d9aacfcd14583b42d808c982e2c386fe1290efae09d96888f3b4d901d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
177KB

MD5
225537a59c7de1235835f2bcd632315c

SHA1
f2c181d7c04021ffd950ec120345f759b855b78b

SHA256
dd2bdfc86ae20fbc87c28ea76968ed57590e79676f5d24614613749cea37df29

SHA512
d076e8d6bd349382e0dd4a24feb22bbaac58a262316a1926cfcd157f1b7bb1dc59fadc68f4dac56c06e97197beaadbe5887b8a250267424b8a849a6f3a749411

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
399KB

MD5
16b7cd5df673a2ddb48654cd2440ae35

SHA1
f09bfcb7efbab2a2f00bde29fac0deab573bd373

SHA256
0120c18742a6c9d31ae3b8a75dfa2f8d71eed6c16b8e9d6fb9ffe3dab568c653

SHA512
2a02f1ca81a3364458406af8779eeb9726acc35ee14a702a5ff7040bed8fceebfa943bef4e08b61f86fbd1f012b514232fe4d4a5195d955410d5ad08fe29061b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
81KB

MD5
b754ebffc85e3e45b98224178e10909c

SHA1
a827fda889f200705a3fbdba89b6b2cab36c48f5

SHA256
a789f164111ee940a960b9dd6d62778f36fdaf1f46fde5e55fbbfbe743f58413

SHA512
56dc95c5d151679c87f12973ca6b52aec1a420a4eccfb79b82cec0c34c8e1cbf94f392a0ba650b858c88adb1fdd9f6967e6243d634d5e5935066061c0c91a7a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8CC7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\api-ms-win-core-file-l1-2-0.dll

Filesize
21KB

MD5
1c58526d681efe507deb8f1935c75487

SHA1
0e6d328faf3563f2aae029bc5f2272fb7a742672

SHA256
ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2

SHA512
8edb9a0022f417648e2ece9e22c96e2727976332025c3e7d8f15bcf6d7d97e680d1bf008eb28e2e0bd57787dcbb71d38b2deb995b8edc35fa6852ab1d593f3d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
bfffa7117fd9b1622c66d949bac3f1d7

SHA1
402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2

SHA256
1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e

SHA512
b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
21KB

MD5
517eb9e2cb671ae49f99173d7f7ce43f

SHA1
4ccf38fed56166ddbf0b7efb4f5314c1f7d3b7ab

SHA256
57cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54

SHA512
492be2445b10f6bfe6c561c1fc6f5d1af6d1365b7449bc57a8f073b44ae49c88e66841f5c258b041547fcd33cbdcb4eb9dd3e24f0924db32720e51651e9286be

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\api-ms-win-core-timezone-l1-1-0.dll

Filesize
21KB

MD5
d12403ee11359259ba2b0706e5e5111c

SHA1
03cc7827a30fd1dee38665c0cc993b4b533ac138

SHA256
f60e1751a6ac41f08e46480bf8e6521b41e2e427803996b32bdc5e78e9560781

SHA512
9004f4e59835af57f02e8d9625814db56f0e4a98467041da6f1367ef32366ad96e0338d48fff7cc65839a24148e2d9989883bcddc329d9f4d27cae3f843117d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\python311.dll

Filesize
1.6MB

MD5
546cc5fe76abc35fdbf92f682124e23d

SHA1
5c1030752d32aa067b49125194befee7b3ee985a

SHA256
43bff2416ddd123dfb15d23dc3e99585646e8df95633333c56d85545029d1e76

SHA512
cb75334f2f36812f3a5efd500b2ad97c21033a7a7054220e58550e95c3408db122997fee70a319aef8db6189781a9f2c00a9c19713a89356038b87b036456720

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13322\ucrtbase.dll

Filesize
992KB

MD5
0e0bac3d1dcc1833eae4e3e4cf83c4ef

SHA1
4189f4459c54e69c6d3155a82524bda7549a75a6

SHA256
8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

SHA512
a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25162\cryptography-43.0.3.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI13322\api-ms-win-core-localization-l1-2-0.dll

Filesize
21KB

MD5
724223109e49cb01d61d63a8be926b8f

SHA1
072a4d01e01dbbab7281d9bd3add76f9a3c8b23b

SHA256
4e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210

SHA512
19b0065b894dc66c30a602c9464f118e7f84d83010e74457d48e93aaca4422812b093b15247b24d5c398b42ef0319108700543d13f156067b169ccfb4d7b6b7c

Download Submit
memory/2800-1633-0x000007FEF2D30000-0x000007FEF3319000-memory.dmp

Filesize
5.9MB

Download
memory/2836-0-0x000007FEF5E33000-0x000007FEF5E34000-memory.dmp

Filesize
4KB

Download
memory/2836-1-0x000000013F6F0000-0x000000013F742000-memory.dmp

Filesize
328KB

Download