81fcfb53cd5cb589a418edd62da80390e3fa6f6eae39204c0bea53e3b33df1fa

Analysis

max time kernel
142s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22-02-2024 04:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Flow-Launcher-Setup.exe
Size

100.5MB
MD5

82a7c075123bd2271722e897bbafdba5
SHA1

665d8cbb2c5e1ac0c4df0f49110ec4957d93746e
SHA256

81fcfb53cd5cb589a418edd62da80390e3fa6f6eae39204c0bea53e3b33df1fa
SHA512

ffd3f63174cb9ddc1318e07a348b0f39d7d9c295482c55a6fb1eeeeb37a67a53e90a7749924ddaca6f0b9da98c81e5423dbdc3717a51c140425bfb49ef38792b
SSDEEP

3145728:XD4tlz1hOCZQjUaiy0Y1QUlzsi83WKxJtITAn/TN5B:XD+lz1kwQ4aiMZOxnIQ/F

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\Control Panel\International\Geo\Nation	Update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\Control Panel\International\Geo\Nation	Flow.Launcher.exe

Executes dropped EXE 4 IoCs

pid	Process
2984	Update.exe
3412	Flow.Launcher.exe
2724	Flow.Launcher.exe
4996	Flow.Launcher.exe

Loads dropped DLL 64 IoCs

pid	Process
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe
3412	Flow.Launcher.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Flow.Launcher = "C:\\Users\\Admin\\AppData\\Local\\FlowLauncher\\app-1.17.2\\Flow.Launcher.exe"	Flow.Launcher.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
22	raw.githubusercontent.com
26	raw.githubusercontent.com
31	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 1 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\Control Panel\Colors	Flow.Launcher.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 54 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1790404759-2178872477-2616469472-1000\{486B3F7B-6348-40D6-B88A-06D34F392A7C}	Flow.Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WinPos1280x720x96(1).left = "4294967269"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f706806ee260aa0d7449371beb064c986830000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WinPos1280x720x96(1).left = "175"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\MinPos1280x720x96(1).y = "4294967295"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\MaxPos1280x720x96(1).x = "4294967295"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WFlags = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\ShowCmd = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "18874369"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "18874385"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\MinPos1280x720x96(1).x = "4294967295"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WinPos1280x720x96(1).top = "46"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WinPos1280x720x96(1).bottom = "646"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WinPos1280x720x96(1).bottom = "652"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 1e007180000000000000000000005e6455d5f8d4294ca827d93c859c4f2a0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WinPos1280x720x96(1).right = "975"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\HotKey = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 0c0001008421de39070000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WinPos1280x720x96(1).top = "52"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\MaxPos1280x720x96(1).y = "4294967295"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WinPos1280x720x96(1).right = "773"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000010000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3468	explorer.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3412	Flow.Launcher.exe
Token: SeDebugPrivilege	2984	Update.exe
Token: 33	2896	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2896	AUDIODG.EXE
Token: SeShutdownPrivilege	4076	rundll32.exe
Token: SeCreatePagefilePrivilege	4076	rundll32.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2984	Update.exe
3412	Flow.Launcher.exe
3972	osk.exe
3468	explorer.exe
3468	explorer.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3412	Flow.Launcher.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
3412	Flow.Launcher.exe
3972	osk.exe
3972	osk.exe
3972	osk.exe
3972	osk.exe
3972	osk.exe
3972	osk.exe
3972	osk.exe
3972	osk.exe
3972	osk.exe
3972	osk.exe
3972	osk.exe
3972	osk.exe
3972	osk.exe
3972	osk.exe
3972	osk.exe
3972	osk.exe
3972	osk.exe
3972	osk.exe
3972	osk.exe
3972	osk.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2984	2980	Flow-Launcher-Setup.exe	91
PID 2980 wrote to memory of 2984	2980	Flow-Launcher-Setup.exe	91
PID 2980 wrote to memory of 2984	2980	Flow-Launcher-Setup.exe	91
PID 2984 wrote to memory of 3412	2984	Update.exe	93
PID 2984 wrote to memory of 3412	2984	Update.exe	93
PID 2724 wrote to memory of 4996	2724	Flow.Launcher.exe	106
PID 2724 wrote to memory of 4996	2724	Flow.Launcher.exe	106
PID 3412 wrote to memory of 2868	3412	Flow.Launcher.exe	110
PID 3412 wrote to memory of 2868	3412	Flow.Launcher.exe	110
PID 2868 wrote to memory of 4076	2868	control.exe	111
PID 2868 wrote to memory of 4076	2868	control.exe	111

C:\Users\Admin\AppData\Local\Temp\Flow-Launcher-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Flow-Launcher-Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Flow.Launcher.exe
    "C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Flow.Launcher.exe" --squirrel-firstrun
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Modifies Control Panel
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3412
  - - C:\Windows\SYSTEM32\control.exe
      "control" access.cpl
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2868
    - - C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL access.cpl
        5⤵
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4076

C:\Windows\system32\osk.exe
"C:\Windows\system32\osk.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3972

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x470 0x46c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2896

C:\Users\Admin\AppData\Local\FlowLauncher\Flow.Launcher.exe
"C:\Users\Admin\AppData\Local\FlowLauncher\Flow.Launcher.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Flow.Launcher.exe
  "C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Flow.Launcher.exe"
  2⤵
  - Executes dropped EXE
  PID:4996

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:2792

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
PID:3468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\FlowLauncher\Flow.Launcher.exe

Filesize
306KB

MD5
453cef95e980c47ec04ec523e2a812bb

SHA1
33bbf8198fa88f603dfa12e45d96ebbdc216ed93

SHA256
fa492b19c65b96bfa766d9c7860643f1291902e1c48f7bc1fd2a4aa3b91440b0

SHA512
56558a060ea2d938826751061ba9cb49abe61162a319d8494f3076e20ebd97db26498bee1e7ba4c3cc56198a7965901404e638a95fd51214642d1adea3973e5a

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Flow.Launcher.Core.dll

Filesize
140KB

MD5
ccef35884e4ec00c8d17015f250b9d8b

SHA1
caae08e3b0bf2af8358fd7fe5e208f01e655f7d1

SHA256
2317f9c295ea25170afc1a30bf2ab45be76a30c166b5ed94795636336f34d8a0

SHA512
737840f4e9e9d48e2b2ba1a25bcd847309aabdfe0cc85a3947a3e0213d76980ad2a0f7d5094d3708e8ba2150acf66ae29b55e875c39d51b4e30b1a5789367b18

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Flow.Launcher.Infrastructure.dll

Filesize
106KB

MD5
bd2f128ca13abcc90f70ce0bf125ab79

SHA1
3c9fea5f0e52535c0fd5442a014482e876c024d5

SHA256
ff3dc7578cfb6dbffcf6eb81776a0ec88c1b433276c780842c8f5e44adeb27a6

SHA512
a51f8865ae396c157b6e7b13b1667bb6d597f4391258092cbbe046c19fd9b452fb7782f9ed1da67296afc01255b7fc0b59cc5b9a204a16c4603cd2b41ee43a16

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Flow.Launcher.deps.json

Filesize
98KB

MD5
a006e4aba9b2567a4f85103506683450

SHA1
91443059ccacc2a73297ecff3fcd6daeb741e744

SHA256
23c6c1f54c12ab46a9685499ce985ed48628c8f3178bfa691e2fa6ee998a4db0

SHA512
60a4944f20a2713a8ed68860ddfc7392518024a226e78e7f9d270cdc82c5e1fa6e38216c9830631da1c56b1e61e2412c5b2c19ffbd06d7513448f211e90f2901

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Flow.Launcher.dll

Filesize
987KB

MD5
b1921083f4c062a19b9be6864165a0e1

SHA1
e9ad053d4226d783b920127b42b4d2afd8328bf1

SHA256
6fbcfee5153fce9d3b38d908ebc16daa52828bc4a342df22d042f814577add46

SHA512
4c2c576a5d1dfb416480b887ab52a191b6ed21d2f3998d095a91347628b9fc061099a7a3527f4feccb61a1c6671476dabd16be335b5a9f601fdbc955be3f19c3

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Flow.Launcher.exe

Filesize
268KB

MD5
82c4af14b68689d7439dc38904c07395

SHA1
87342da9fedf0b7a4a04005b1518a62f3e1b45d3

SHA256
9cf9527356d019328a356435854d22596038f30ea0d901119170eefe376da7d0

SHA512
0354a39138937478c0e57b69c72d483fcdc53241f661225600ad68cefd1a9fe004a99c7cecbdf3c8e36c804274e730961579564aaff52616c2515a08ff0a9afa

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Flow.Launcher.runtimeconfig.json

Filesize
561B

MD5
77255e19c07671e5666356a22f0ff4b3

SHA1
810a77b4a3c8aceafcab0f1f9a2d45abe6376803

SHA256
ec1045dd44106fc884bdb1593832e10cc90bb07910cc368219eb0d790db2d98d

SHA512
c1c308b49f9ab1076347f5f3e92872445201e21b440c2aa7e53e66b67eab400bad556af4c3a7325cb0da69e026046bb6cd39eafc54faa786abcbadd19add011f

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Plugins\Flow.Launcher.Plugin.Caculator\Languages\nl.xaml

Filesize
1KB

MD5
7adba94ddbad04c8e375417fe26fd100

SHA1
637f7abd3d515225b72632821470502019f12d43

SHA256
42f87235d23e08596ea8ec441c96125549fcf7efc9d282334caf3d888f91239f

SHA512
abfb1fc0c5bb18aca5d0520f0b6fd582a507104899ab66f364a22410aef6cbf1f590522de4b88c0e5e213b70c7877ffd2756ac5f5a6afff7d2579f4412cebd09

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Plugins\Flow.Launcher.Plugin.PluginIndicator\Languages\nl.xaml

Filesize
633B

MD5
812120c04912192e0a643f27adc84036

SHA1
6b736f1292c9180ffdae0ab0bd0f4afb2093ff68

SHA256
bd3e8a2cfb6bb55efad2b85fa437593f2d736b2468482c8f790eb7b5873eab1e

SHA512
c0b726175117ef9a6a0aa46c5bab5863c702cf1e8259af90800436f06d4634f0e0dc06e76ba3c791759ed1a97464a4f282cd54fff854582f982b72997ff96b58

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Plugins\Flow.Launcher.Plugin.PluginsManager\Languages\de.xaml

Filesize
7KB

MD5
3fa81ac7c07cfec412f2a17566fd45ff

SHA1
4d21bc648150106ee9afde67cd89ce2b68e63d6c

SHA256
05415570c7b2314219f1b9327074dd0ff2b93a07e40e3ada29e39aa6e6c347d5

SHA512
49e48588cad3de91950c349340cc028ee714384f5440037d17051329e722a13df6d96685122e761ad960973279c22838c5fafb318913a93f37f1bd7af16646c5

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Plugins\Flow.Launcher.Plugin.ProcessKiller\Languages\nl.xaml

Filesize
845B

MD5
43da9cb628b4a06d89b3170414c521d3

SHA1
e00038637f1b3971c64b5176b3402df269ec5a39

SHA256
4af01c7edfb7e4fd1aad8880f46438bf6089493db6e18ac7531c3bfad68e2f88

SHA512
577b500e3a1777d473c16cf1354acd3415a7333d408918ded3ace3a53597ed164b88af35f451c5a7a1e5f40736f55c5367ef2b8c61d95f421692a4f0618bee16

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Plugins\Flow.Launcher.Plugin.ProcessKiller\PropertyChanged.dll

Filesize
6KB

MD5
0b432bba9f37c2210d5e6b65c4fe4f74

SHA1
06110db2d0af730e351ac2b451f31673038c1fae

SHA256
769cfdc70b796166c53f63a43daf8e302f6262ee18fb7ae0e2cba61dbc4b22a8

SHA512
2f4d198d536a78f10195d31491f9343ce1342dbd3a4865d2a89b7640cc187d9799e50126801f8f9b1ebccb812e865ddf56e622d59178dcb69ba39d4deaaa8b30

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Plugins\Flow.Launcher.Plugin.Program\pl\Microsoft.VisualStudio.Validation.resources.dll

Filesize
14KB

MD5
4320a3ef63840382d0f43562e0014fb1

SHA1
5cc3526db6de644396776809c78c436e2a51ee5d

SHA256
64655f62d25251fe46c255eb6cae5462c44ab8ba4ac9d000e18cc7ef2ca4d08a

SHA512
f1075885d588897e5679c5f9252c0676e93ee0a395cb4c12ce1cff8a7b78856bef5d69f9eb2e6ec2b19addb6e00914749ae58197ef95d8858ab9253b75d9d3f6

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Plugins\Flow.Launcher.Plugin.Program\ru\Microsoft.VisualStudio.Validation.resources.dll

Filesize
14KB

MD5
f838407bfbfb508b439001ce207e9ec0

SHA1
f62f9340eec6c17e7b0f239ffd0fc9d428f71a36

SHA256
34848fe20b59ded6e9c5885713c6d80248d6c0efc693c4beff88fc2efb6d128b

SHA512
f97f31fc2e492cdb9dbbc2bac4d22f6f5851f40e5e1f9cdfd4ab006d1da7391a9b3749a1627dacae1c0ccdafc9dcee3c6cc0e6b706f2b2b225d58d545ce50b7f

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Plugins\Flow.Launcher.Plugin.Shell\Languages\nl.xaml

Filesize
1KB

MD5
cd554e1e7b83063401b7b9e432c53cca

SHA1
4f3e20a194211d6df7e42cf11d9c0c15f6fab926

SHA256
514d071d46460e4a07f7c6e087ea174302accc587049dfd1d349619de04e3b4b

SHA512
352f2132153b2a652fa9abc53952e2f1a7ca46afe467531fd16ebed5e41850fd673a7b0f7be33bc161852cd64b98ae013977cd68a4bc66faa060edee8c39199a

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Plugins\Flow.Launcher.Plugin.Shell\cs\Microsoft.VisualStudio.Validation.resources.dll

Filesize
13KB

MD5
28709f33ce80da670aeaae027d85ee43

SHA1
3c76e5d174a624b2843531975e858561873581d5

SHA256
7bb90a76e40c1ed78ef9db5ef74a64c89a7e6e6a9fbc720a0617348351e7c655

SHA512
ea3c802acc43a2a6173d08bdfa6cd62bf058c0bd25bae4634364dc8cd368e3415bca10bce667b06324808720b6eeb9707db2dfacaa0a02cb6a2968c2485952c2

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Plugins\Flow.Launcher.Plugin.Shell\de\Microsoft.VisualStudio.Validation.resources.dll

Filesize
13KB

MD5
fb61e04b46ad0d070a2504f4e8c35257

SHA1
8683c58774fd6d6b1a551b70a010978216249872

SHA256
74e7b701ff0823753ad25084043ab0119db248b098cdaacdc544237f76cb511e

SHA512
49666998a6ac0ff9fa8ee6e7d4b871469daed378e9f56f7aa979b63972784b2b48632e96f1c40fbc95e2f6c3433fb38a96c22259a15a6c63f64033d9e8043f98

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Plugins\Flow.Launcher.Plugin.Shell\es\Microsoft.VisualStudio.Validation.resources.dll

Filesize
14KB

MD5
1801df1c0726406b65c7880740627b4c

SHA1
11c2947aed248266ce7a27383fd8045b40a6f7f8

SHA256
96de4a44dbda8579e9319c1d5299415443e3ab3d28b8e8aea68d87093e6da282

SHA512
fb67f004e153a61171b75a40d1623c1b52c6a6c08aa0d9bbb60295c63f917e810aff628d28c05cecad94f21a14b7afaa7822e077b5336c40ea7a0efb8c36c733

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Plugins\Flow.Launcher.Plugin.Shell\fr\Microsoft.VisualStudio.Validation.resources.dll

Filesize
14KB

MD5
bb865ff2fda8d811d50a5e1690e68e5a

SHA1
0db5a28fe1e27f835782e405ad6884939ecf241c

SHA256
fbecdf10df2d211041e9f2830fb7bb749b172e9c119c6ef8b8a54c856b145c4b

SHA512
6dfeb7095dab316c1deee8f6551154f9e763f6e1e7c152c67e81ca948b4ac51a6494c265cfa9a03c6de5f31a031031328559f1ea033cb03bfa3fb0ec81b7cd27

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Plugins\Flow.Launcher.Plugin.Shell\it\Microsoft.VisualStudio.Validation.resources.dll

Filesize
14KB

MD5
bf118b2f1f54aaec5be73aa25d2faff4

SHA1
96c95faeec84dbaab8529c5ec4bdc5399e236b81

SHA256
bd8922c7a2555d6f2a0ecf6a5982d11631ec49e74e6c5cc972d67173fc8482c2

SHA512
645c646937f9be7b5291e89646d90b5f2de4a16e4b1998fdfd7842c666f6e87f83c142a707d8bd8703b86d69209b178869fba0bc0f2f3387513cb6558a781f64

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Plugins\Flow.Launcher.Plugin.Shell\ja\Microsoft.VisualStudio.Validation.resources.dll

Filesize
14KB

MD5
4f095991a3f46a13d543697f3ffc083d

SHA1
16b4a45d146bef3191cfac214ea30ddae6944d3d

SHA256
193423659f7dc2b5f0dc2ed778c535a69b6e19bea9a0cb5a4429c64550cf5c0a

SHA512
54873a21737478db42d15f56bb74b6541599a0128050fa3a00f6b814ee8b1ba5bae9d026c98d052825747c2e37edd8464ac7d6a4c76389a277235b16da7cd484

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Plugins\Flow.Launcher.Plugin.Shell\ko\Microsoft.VisualStudio.Validation.resources.dll

Filesize
14KB

MD5
e9821ae8dad60c4bb122784c38e2b98c

SHA1
9576ed9e5121e8dc3c5c2cf2b7116087c4bca9e9

SHA256
b18160dac316f8e90763e5022df8d9f2bf56db3aeac09ef8e2ff8227a60201d2

SHA512
3f473bd3005c0091f6dc31188c7b6edfd07e0072d62bcacdacfee7be489e9fff60a3c1d495aeef786384cd231e619409c908c40874cc8f34197aabc4e0cb0ab5

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Plugins\Flow.Launcher.Plugin.Shell\pt-BR\Microsoft.VisualStudio.Validation.resources.dll

Filesize
14KB

MD5
68a9ff29657cb4fa59ce7abaa59185f5

SHA1
795a30b63078377e374f42950b57a0451ed84182

SHA256
77bae0aa22fea4e3abb50320753ae5fa8d172a56907f22a16dc48a3e0eb519a4

SHA512
34038ecb90752876187f8da2d379f8daa4f73ba0d8bebf78eed540efebba701776a54cf769ddc68da7be92dca5f5a75f59367cd3e6e0c52a9ea1b6d44f24ceab

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Plugins\Flow.Launcher.Plugin.Sys\Microsoft.VisualStudio.Threading.dll

Filesize
416KB

MD5
6eb406087af1473a6bf6fd32a45f8c33

SHA1
9358579cc0454b04529cd3cf1d1b6bac318e514a

SHA256
2abf82d5710daa901e414c458a7f46937d960777feac94ebb3f4c9dfc4e80ad8

SHA512
f449043793954e8942474702f70a85e19b6006550f51250292d0e81cd2c91a4b2f227f28c52a70c75c2c3920d27740c28d408abc14075968df2f5b50e2e742fc

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Plugins\Flow.Launcher.Plugin.Sys\cs\Microsoft.VisualStudio.Threading.resources.dll

Filesize
16KB

MD5
4fb30689cd3958ebb75d43fb329cb1bf

SHA1
993390371fe34641632b8fa34be7b7d0092896d8

SHA256
49110eedb0c4d0478b64695a7f57c1ed44c47633208a7dba79d235bfd17b92d7

SHA512
6d11ba380b9c170394d4d12614f9fc6db97c7bbc64ab2cef0b7dd3676f6e868bc755ad033d35b9f661de9d92fc98e6b0dd12bd6ec6546bfcf76531afa8add01a

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Plugins\Flow.Launcher.Plugin.Sys\de\Microsoft.VisualStudio.Threading.resources.dll

Filesize
17KB

MD5
bbf7d3adcdc621fabf7574b3f674c126

SHA1
6278b8c5bb5dca48c1220e39a4e61d8a1fbba715

SHA256
1f253640140350fb142a5deefa5eb57e3aec0076aa1e765ead584985862a9d7d

SHA512
1fb3da58109e87fddda365e84b67935b7f1b1c3f5c4721be8bbc8e731257b570c87868847bf14a25e45b6beb94f0d01e6ae84368b180873c5e39bcbbc36bed15

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Plugins\Flow.Launcher.Plugin.Sys\es\Microsoft.VisualStudio.Threading.resources.dll

Filesize
17KB

MD5
b8599dc6bc46460e2374712e39a72cdb

SHA1
6a6540c081f12f1e5312a6c51a1e4bdbb4b9be9d

SHA256
fe614d46f6d22a4f0027bc72d6181eab822798514cdf4fa5e9437a7322b95dfa

SHA512
d25f28b53f6aeacbc32e7280673ae96b54649d939d23c8ab99aba421ab19cf68c1a679ea97ba364d30c05e12c802c2c27071ef12c0403f0e517db02eae931ff6

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Plugins\Flow.Launcher.Plugin.Sys\fr\Microsoft.VisualStudio.Threading.resources.dll

Filesize
17KB

MD5
3d3e33425a53f187c69e376341e54ce7

SHA1
fe13b863b6e3c20675611eecbd98e9130f347af0

SHA256
8eec97d788cfd15b33fce59c7d10d7c484d7da6ab47b5a9271f3fc86730a6463

SHA512
1d217eddd6c10264a6059ad87a5ddf0fec4a30ae70130db20c0a423fb2dc7ce8da5a94820f7c939be8b73717c479ed9100f5f31842ec725384cf1c2191020342

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Plugins\Flow.Launcher.Plugin.Sys\pl\Microsoft.VisualStudio.Threading.resources.dll

Filesize
17KB

MD5
a94830046e99419cf170b1844a4d64e6

SHA1
b6fb65933b7c5976f6d0d9a79135bdc802e03c25

SHA256
28d20d36a83462c12d8f7e2b69b1ea430c56b3b1c9038815244bb187043a6909

SHA512
0242ed4c1203928e7c73bad446ea45af59279524a7f2d8f5394d91642528897f62394e36662d9b13f8f413cb235eab4202984e9a982fc7d4708ff4fcd1b2c723

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Plugins\Flow.Launcher.Plugin.Sys\pt-BR\Microsoft.VisualStudio.Threading.resources.dll

Filesize
16KB

MD5
822d0c29d86da36f6357acfc3e7e8a78

SHA1
bda67efcd7c965d6181b7dec4e9d39989cdfa2af

SHA256
80bfacf8e92b8b3be2d2acd30fe4b40d7bce1626b74555708b008f3dd0da86c4

SHA512
b419bac524679834a21d4ea67c4964fb3627d76514bb6702cf8375852302b54329297f3974149d43b2339e69f05b979856832e8e24c86be4b738df89bb7dec1e

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Plugins\Flow.Launcher.Plugin.Sys\ru\Microsoft.VisualStudio.Threading.resources.dll

Filesize
18KB

MD5
b0896f26127780f1c33d076c4f2eec12

SHA1
2b415828046279f22eec984091adc664af0943f2

SHA256
e9a7120b3e443b0fb4404138cbb55dfd6306654ac1aad653604d27ce779df64e

SHA512
af8dadcfc1aa38ee749b1d8b64f67372c130fe9b9c7a3a87959eb92bf9d0e237fe90a1ba8911d9f3337f469d7fb0f62fe88339e3a924cd144ee15a2f5f15bcb5

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Plugins\Flow.Launcher.Plugin.Sys\tr\Microsoft.VisualStudio.Validation.resources.dll

Filesize
13KB

MD5
e66f15b6c4f61251f2a7dc0135e9a83c

SHA1
9687723fdfb55152a37d1df0033efbdf82ccd8ef

SHA256
ee98cc027bbce339e7dfe0b7757be233e38fb8bc95226f3992b376858f3cff80

SHA512
d5af3c003989d7b4a2a58341cfd218d4a45a9d8fbb92e24dcbdfbf2f63b4832be1e80ff025c4a802669d32771f90beabe444417aab7cc579579429582adca756

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Plugins\Flow.Launcher.Plugin.Sys\zh-Hans\Microsoft.VisualStudio.Validation.resources.dll

Filesize
13KB

MD5
b00ee299391af986860996ca349c18fc

SHA1
1e18f4a4707498ec2fdab49de3cdeaff505b611e

SHA256
a90ee2b4fce6cab8ca3fd2e5e310ad709287bc77091285a3f4aa525a9ca3606a

SHA512
f78b46d1d1e6d01a342ecaa7094cc500a8411320e57b7fd76e45fcd82f9b1a47cbf4fe1d38c0f162aa23f927f7373e9d6ddc48d5182d1e2e51d99fb627e45a4d

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Plugins\Flow.Launcher.Plugin.Sys\zh-Hant\Microsoft.VisualStudio.Validation.resources.dll

Filesize
13KB

MD5
6f90f21ce4593465e75829243a12e60b

SHA1
bd7862696490bde0905ae18b42f51d5115ea050e

SHA256
70a96d0f704757d7cf6df1716dc7ed3b65cf53503ff3c17cd8072704fd484532

SHA512
29cf6d318fe12f094a933fe8f92fba91aa6b12ef0d070ad5e48e6090115171c10dd5b55476b4ef8ea0931997c83b9a0e2c2a17824957b8b4b997ec9b35752dbd

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Plugins\Flow.Launcher.Plugin.Url\Languages\ru.xaml

Filesize
1KB

MD5
e98a3003c2d5df5ed1b7ff064918155f

SHA1
b514353b4ecec79d2936f3c5829dba584e19b416

SHA256
f943474e9979343d8590f01f268fbf70fcffafc992ade2ed9ba8542a5e350cdf

SHA512
b9fe83ab648670c5c7770c3a594417aae6d2d5691a530be54558e9ce958fd8427cf086f5a23e457718cb5bf9f4fe2a37a87334b210a6e6a0b9d33d0759505783

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Plugins\Flow.Launcher.Plugin.Url\it\Microsoft.VisualStudio.Threading.resources.dll

Filesize
17KB

MD5
b0330e1f58aa011400cd6fd56d409ccc

SHA1
1d44f780ee3b042b8e7f5ff028bbbc375579ea4f

SHA256
982b85176da73a894c576b3f85b6eedd3d574fe531f3e1fc043355f5c382ca7f

SHA512
0645fde9ef36d9fd90c2b4bb4f0baa3e4a517fa1271aa9c55e3031135e33d7f7612aee9165562b8f642f9a4b450a6acc21db99a1f8e1402f1ab95b759d0164d1

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Plugins\Flow.Launcher.Plugin.Url\ja\Microsoft.VisualStudio.Threading.resources.dll

Filesize
17KB

MD5
c2765cf056a97309b1c302baea810120

SHA1
4cdfb38957334e5216315c5009f1004af4202c1f

SHA256
ff11cc659df3e4f0d65b7d7a98a10aa5fa32e24c9e267c06790a7868e7b7fefb

SHA512
205242c7e805b5073d815f1bad20757b23797ec73296520b622bc738f4e9227f067f9aac6dbb6a8471c00e825dd00de9711aee73e4bdbb01682e745c649f49d1

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Plugins\Flow.Launcher.Plugin.Url\ko\Microsoft.VisualStudio.Threading.resources.dll

Filesize
16KB

MD5
e65202a42bf45861c8cc1525ec21abe7

SHA1
2c81258b1fea1b21714fdbcc687a4888cc4683ad

SHA256
1299e03520c920fb9ee5960fa46a992636b006627e1079aaf2202d4ca2b3820d

SHA512
8849626bd11d7c553dce9e0b1ec59eb79898739df0b6eec746978a96c1a8a56b5f158c1d325a5f1a6e88b7306c4b53de7f1cf1aaea8834adc87d5d6a98d71e7c

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Plugins\Flow.Launcher.Plugin.Url\tr\Microsoft.VisualStudio.Threading.resources.dll

Filesize
16KB

MD5
953299d220dbd0595f049591a06ffa5e

SHA1
b8dd6f5a61954bf93a57e0a48f84c54925115c62

SHA256
f687f5b69e102b8a292b896135ebcdb31106404872e98a356ef3bd62ea2b0f77

SHA512
29668083208e1ce2b5cb8a46fb72f27d25ebbd97980f51d455b7d3979e69e253396dbe50df958a887d93e0053dc0c0c2b6ba523c5fcf620913d426982483fe6f

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Plugins\Flow.Launcher.Plugin.Url\zh-Hans\Microsoft.VisualStudio.Threading.resources.dll

Filesize
15KB

MD5
7958da04168f51d0c626976aed6b6340

SHA1
f6a91b3a8927071a089de1d7ee59016d25ec9fe7

SHA256
81df23e9728731fee90facee4b9b174c0283e66e1309851ae5adcc75a5ff697b

SHA512
1e56def444d423744fc450c1a3c2915c1b4779cf313bf9e630b0bd89c4a9de00b9ebcf1e6c97c3ca3d167daef79db9303ea504bfb15472cd40f629ea4bb33428

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\Plugins\Flow.Launcher.Plugin.Url\zh-Hant\Microsoft.VisualStudio.Threading.resources.dll

Filesize
16KB

MD5
23fcd32ca257918ea244696b18c611b5

SHA1
d3127268eb11de9ae83d4440af886f03822ca992

SHA256
00d802a3a2c879d818ad54b3bd55193b74dc2d1410071afb9b6f36240b0dcc43

SHA512
93ccc5faaa1728aa8e65974c5cc36c58b25c60adea315cdbd9c5c68ae7fafe2b2e9304b5cc4439e8ad1b067ccd9162502ffc0dbf578f97e16d8554b83ded0c25

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\PresentationCore.dll

Filesize
2.1MB

MD5
18e647e2c248fbe21225cff71f3178c9

SHA1
1a092dccab96e5a1c735978357acaa8eb286c12b

SHA256
8406a6fcb983baf4b532bb6266bef29e4eaa9d762fb664902be009f4cbd9192d

SHA512
f6dab4b909cace9c1fad370563a950c1006e304475b6e7bde0657dfa61737001902ea57791c494f15fd3258f270590acceb55bf7f1e6fb783f7352bc0b8665ba

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\PresentationCore.dll

Filesize
2.0MB

MD5
721f90247f392e057605bb8dbb81a17b

SHA1
fde9fa9c81a787e25ac6df90dd5f18f45ad0dc25

SHA256
2af3a5dede37d7489a0912ad2f0783f0ab9e341b9572f048ba9023b015e976bf

SHA512
40b48002b5772b475ec86c959378e0dd772c57cc866fa686ab5c2f0025b65a3dc624ebdc3ab8dbf5b0d5fc123a4b1ed6d9ce1784f4d8e5dc447bffc1ae3ae0f7

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\PresentationFramework.dll

Filesize
2.6MB

MD5
c877d00e317fbed27994f272fe825d21

SHA1
ae15f02c3f1aeb8f00a74a324d764f12bd4effe9

SHA256
7d3e2c019c4abdeb0f0d64487d8c6bf1af359bcd812221c32c8c8e039d8b5f64

SHA512
3f2eae4e3ed29548549d531b9d11b486257ea72f365904d38298b4857c14f38badc572e92e961970f6b0f4252128ec3d2fa4f0eda9b64fc029a1d714c66baf87

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\PresentationFramework.dll

Filesize
2.6MB

MD5
2238b9b94f52b9365787833a3d4bda83

SHA1
5d9d9ac1a8e1eb0eed6637423bf8916fde8aaf4a

SHA256
4bc7fa0148a026b4008c507267ff5ecb22e2c6f8d581594a2d233f761bf6fa48

SHA512
902996d955bb3c514d58cd176fad39d83506a135f5ad16418851f08da266c2114ea1c4d7cf34d8dbd9ca7bea1ea2027de1b73e40b97c2e3a94a860cdb5359eaa

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\System.Collections.Concurrent.dll

Filesize
258KB

MD5
202dc26d67a96dff4d44da646947059b

SHA1
ea88bad51d1d5e56eb528eabdc0ab4a0f6736627

SHA256
c42b9eac4009ef0bff6f633d3675a1de7d9f304cc71833895d7e5571f21c31bb

SHA512
10f67238b8cf53cbfaecd4f8e251315fb1e0c9cba0bb9a07b44a674d7609d0ef49724b47bfa0fc83ea7e9bc3748891fa01fc09d3b0c98626766ffbccf4dea7c3

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\System.Collections.Specialized.dll

Filesize
106KB

MD5
36d418d7fc8a3fd9288b3fa113dc3275

SHA1
83017ee4fde91c2d1e26aafa9daab2ef26d97d87

SHA256
9421634ab862d789d24661fe99fd39e0d518e62ec26ddcb814ad9845d9f742c6

SHA512
7a5c4a6fde516787abf024e084b41a873c592ae93fd9dc137764d1bc2d28ce872ed2fb0a49b28e78af74644befdf3acbdd7cd501ed6ed9fbc0d0b852a2dec183

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\System.Collections.dll

Filesize
262KB

MD5
5f0f8ded98aa2af7c86c86e51d8fa4d0

SHA1
186a59fe9fda0de1d4c199b394288d4d9f890fa8

SHA256
948874e91786bd4d684bc87564c9fa6550c9aa32a8eed88c9bd187c02574be1b

SHA512
8b33b35a24b03f4fc405cb458e441c129319c879c05eed6f81884435d1fda08906973642c20af5ea48be2017149f2e1b501b4036509f754d1b33663848075994

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\System.ComponentModel.Primitives.dll

Filesize
82KB

MD5
e457f2e1d3a827161ff42c82deaa10e6

SHA1
7b5db9e28f0b1a71986f480b19d1f3954db13ed4

SHA256
914172f591b155856166bef91af1b4fd2650a98ed4a4daf9d396644eebeba86e

SHA512
6cebd83c7d6eca336429ff78f08f499d3acfe5ca64bb51aa8375464c30ba38be3cb9aabec03cab52d022f58f746f6153e4e03d86eb0be24d8cee6b62dfd23f06

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\System.ComponentModel.TypeConverter.dll

Filesize
384KB

MD5
2615ebbfb93a8ee1adbbcb4f31359d83

SHA1
a56f57371a972faafe062916841bc5443eb5be0e

SHA256
4ea6cda104777232c5a1b672576e85013cb8797f34ee726db496be7b48901e6e

SHA512
ee07a7743e17d8a686ed5ec1af19505d1cbec668ac16c48b751c5301d33dc97d85d73519e6d86c252d8664ed6aeabaccaebec9c76882c9d09e111f314cdd821a

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\System.Configuration.ConfigurationManager.dll

Filesize
1.0MB

MD5
522bfd6a3ec08aa711cf3c9dc29f3b37

SHA1
ec442797146ab59de6538380c229b9b4676892b7

SHA256
6d02612b09219f476f593ffb39bfacd7598b8e7bf6910a3e1571f6f8c307b37e

SHA512
47390eafc91a48715e87353a156d855775802a986bdc701beec344d338bb8a40158c2b86fa4944acc302989d25490a2527caef34dd8cc55bc4e92e01333655bb

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\System.IO.Pipes.dll

Filesize
182KB

MD5
0d3aba7ccbb576392ee76f384ee3cbc0

SHA1
a1dd45be85037c7f0cdfdb9cb242a89c5db024e6

SHA256
00786e88341121391d384fb3c6ade808f6f0cff33f7d0b36faf98952c88739ab

SHA512
6e23c1ca0ba3a06d87df871882d39089a81edb8fcb323b5d804ad1273b59a8034ec83c760200fefe66038eb41d1720218676fcdfb8fe0dbdda6c424610416492

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\System.Memory.dll

Filesize
158KB

MD5
f757e53b913ad55bdc64f1853ac93ca3

SHA1
49c63f32af1e5abadcd8c2228cdb05a6237902db

SHA256
e3d328a91ca76f1f4c2b1fd56246a05cc0f42d9830d870f67315691c4d2c447e

SHA512
0153a67b7afe8e542e4fc06e6ebd7e4230a8fc9dc58793015cca5b88bb61ef220689bf87f4337d877fee147be67b2546578a74e3eacaa2e3575eb47f2084afd2

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\System.ObjectModel.dll

Filesize
82KB

MD5
895d21e7800b8a142c4461b532992276

SHA1
a440d319bc1343037b9bc306112e2ec0a82c133f

SHA256
cb3c667a93ade41646cf3b038a924bec96c88d53bca24543a8e7d6c77006effc

SHA512
2b01a405c33c81326fdf6386b65a806dd45ddc5d245e5aa3c9cd23199504c4ab680c72ff4abbb303c4116efee8ef6e35a32a3b45fb68740de90fec432dd459ee

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\System.Private.CoreLib.dll

Filesize
3.1MB

MD5
5eb1a1c894507477f11f63cb03a1c68b

SHA1
35f5ed710e7b6b24b66ced467a912b93576dcc28

SHA256
e24ca597e9421aa2724ba91235c21d372adc0c127b0565a9d61fcd7d34d50566

SHA512
67dab57c3f33e0699b67ac3bb3fa61f3e91fcdfa71b04f656124434d1d3c68c2aebfa49159038cac2f889e72ee04fa2525e80e6fb84bfa7abebb4fb5c654594e

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\System.Private.CoreLib.dll

Filesize
832KB

MD5
9e3f89f78df2dc143dd183efb49feb93

SHA1
26ddf7a2313a068c98afc1a11cd6e4c884efc2d1

SHA256
888f6430792f7a1ed968f7e0a7162494e79f0d7c024476366dac183ff2a8151b

SHA512
8fd32818c83ec4541cb46fbcf9e67b313e897566c15f7980a62602ce841fb7ffdc76945e1a0adaa05b495aa9b990e5ccf9d96e4ea7cdbfdaa34864bff6de983c

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\System.Private.Uri.dll

Filesize
258KB

MD5
ce836f5e7c26a9d63ac4ba6aef50d809

SHA1
4002aa281909abb678bfe4f9b27971c7330bd17e

SHA256
ff2edde99f8a2b8793ba82fc0b309fe17c36b39ebfb57f23e81b07c59b78ca4a

SHA512
6dc40708d074520de1b6b81b1fcae95b93d550ecc2a75b763779ff79139f76ce9aa2085fc97fbd2fdf9b9f69c76f56101e7c76721aa946e3b82b842495041f56

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\System.Private.Xml.dll

Filesize
320KB

MD5
504707281d08c5908cd58a8cdefc57be

SHA1
cf061b1f555a8fe391daf621b0913bf34aa12a71

SHA256
fd1660ab229f5b08456ecd4334175924faa3684e1aaf1017c9e8b2bfe4ae3c35

SHA512
9c5f03a7e83a5916e381855c371c09ab44c311a042c32550b8d47630a1368eb810c82f075055eb156afce161a67c9221a00d4c61708d9066a64d34277c88109f

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\System.Runtime.InteropServices.dll

Filesize
62KB

MD5
0235875e0b1038e1993f35dc886c122c

SHA1
7c17c81ded71c3771c7d58aa7ccdcc5d6b0f6bad

SHA256
05fd1eb3f5d1a4e8e5ab1ada833e7433812bef5941b7750dcb7f46fc1adbe111

SHA512
2e3849db4733ce13d938473ef261f0a3cb92a06e29e0ccf86e52e24844a279655c0cd18d3bb696f20f24c476f52b78077b7c1cd61f9f0d9b184b5803f286d20a

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\System.Runtime.dll

Filesize
42KB

MD5
c23ed081a89b259d048f87ca3ab3f895

SHA1
49e0557c40cb299cae9e3b98a8143d467e60d5f4

SHA256
0af392172e750506de96739373a3c34b53c52069813b6d8bee0f57795eefb890

SHA512
1124319a5ab1c9ae6cfa3c925cc94d0eeaaec8d15a744ab679c3e1f8bb9bb462b4a296de0fd3ac504275f8b8682788fa9c397bb98d841e8824321eb025644ec8

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\System.Security.AccessControl.dll

Filesize
234KB

MD5
6aafe9c9eaf0688fa2a453aeb39d0c58

SHA1
823386a2b71f223abf3391da5486ec91a5218ab9

SHA256
4cbf793c23c0f2aa6bef5a6ce1ad76f50b9b9f4e61cd5aab2153c1faa44ac230

SHA512
7739bb7171c493e5004aa26d973a2b5c83948794b90d4842f8d09a351988f854b329e22bec781b7265548febe85b9ffc1600cbcda64b3f67b217ebc379177c93

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\System.Security.Cryptography.dll

Filesize
1.9MB

MD5
1ed531624755df2e206fdaffdd3267b9

SHA1
416ccbb085ccfb7e9c67e9b6f3c93043ecbb0ba9

SHA256
090310997a4a46c388cefc2ec693399679823d965f1ecc58dab51d00e71fd94e

SHA512
32f08241288606328c3affb6eccd8a3ffd32c70d2d5fe52ad2ef8a8dce00a243c6d49281eeedf7debebcfaa542070f4d5c7acaa39a8f69c372117677f9da9c6d

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\System.Security.Cryptography.dll

Filesize
1.9MB

MD5
1fefcc15e239e2e0651cf119882c53eb

SHA1
4da69986073db3a77edb702a28f1348e9fe7b142

SHA256
088cc8a74ec20073da6e9be40909eee1e52bea678e29d558d2b5cccbb232075c

SHA512
988ade00cf305b9cdb675d17e18e5bef1142065fa4f22693df5a79aa53133b4a3e831fd95863c02f5d440736643404b5709800ba918b87788e21a7b815f96fed

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\System.Security.Principal.Windows.dll

Filesize
186KB

MD5
53a2542c4101e7c76c392cf4a5e02c58

SHA1
2b4f1b6acbd2e88bfa98ebb7d453d761647cad63

SHA256
2fbbe8397780ccb232cfcafeb01d03b6f9cba52fa7ffd5fab38b13a2090d5391

SHA512
5e27c7358020df3fa99d1f908733ddd41c3ef4b86fa834f88bf19b7e26b06f9d274e98b0640393e1afe77569e27d1bac42600650c75ef2ea99b45aa7a71dcdeb

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\System.Threading.ThreadPool.dll

Filesize
15KB

MD5
44e52fee56e56c99c368a0697c9e0302

SHA1
b4469ecee59b2091425186b1dd887c89ee1bc125

SHA256
93c6ad6f5f23c2f1c9bfcaeb34be9d4d498760bb102d1f9d477fb06d2fd0823c

SHA512
299ce0bbd59b024b3959704ca6f20e244c50ecd04192a33afd165a243587dc1f0ecc0cb7a21b4bfb4f8a576d35646ae27b0546effac0695002da09edcf105dd4

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\System.Threading.dll

Filesize
86KB

MD5
80ccd7d5407cbfb4ec6e525bbb776521

SHA1
f624c89ae7df22d30ae3989d9bf9b07d07ec4193

SHA256
dfe3954d1c9e7050d99c0038c94bc765a9d3ab037391e9dbc22b9a60e68d6a8c

SHA512
a6e7aef73c57c2c48508a02ade3b4df4f8d578b4ccdcb941ff5ce8f170a460947757d11675bf36c1dffc610d66d2692a3c82afcdfa7eac00b3ae770baf2cbba6

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\System.Xaml.dll

Filesize
1.4MB

MD5
83f298392865b6c9cdd4c5ccb3947d2c

SHA1
60bef2dec83e1be0d4880d9a123d22c88fc3ea5a

SHA256
bf8b4ff8741dfa045e4aa58fdb7a9525a2794cf1f84c75322f7dae58bd1403ca

SHA512
8d9702ac46b0c1bce0b667e9f9d8c131552116df8a803d9e73f7608ae2766f9ca1a55a5894a0b0c9128853ef1fdd26f30ebb670240d9763adf3afbbf778d5eec

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\System.Xaml.dll

Filesize
637KB

MD5
7b2935d0821dbf9172c1fdb77327eb4f

SHA1
968dc2244812a73f4aac3fcb49d189b1542631b5

SHA256
fd374663fc5312f995ee8f1d01bf9ee803131c8591c5334efc49e7560529610a

SHA512
da764da8c209b87fe48096a260994d55b2321ac0fcc864de8050768c3adc7019de65f4cbd94800d7f9697fe3d141394eb34a51c76bef92cca7716ad1018595b5

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\System.Xml.ReaderWriter.dll

Filesize
21KB

MD5
e4aed6b73dbff910766a5041b2b3bc13

SHA1
4801254fcc692a9b7cf798c595de629508cabec6

SHA256
546a4485fee1f1d3dc73def94b14e8eaaf92a75fb56527a1d70a5a05e03321b4

SHA512
06c7faed7f9404f317b74341810fc3c4293369997d380eb0438b8a99723518d16fdbaf989b7ddac3826d01211c43e5243a21196c2944a71b202cc49059b76263

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\WindowsBase.dll

Filesize
640KB

MD5
215a5210fed7656aba2330b1740980be

SHA1
58bbd966a6fdb82687604f27edc43b0e42f2b0b7

SHA256
eafb7ca9d16f79631119d342518b9dd8f20769551842bd659f5b56d2bc437a75

SHA512
ae5c23b5d7871f0293d7fc658a5ed330c73860925efe794ab1fd75db8a05c07521e2f89568f432459910ca4d9881d6ffdae8e20d4d88a9df0fe052b8035056ad

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\WindowsBase.dll

Filesize
2.2MB

MD5
4ad49a8f8482af5b2c76d5e76a963326

SHA1
0fd70e75725f24bafff95d44fff14127cee515a5

SHA256
56a3c896703bb94194dae815768be648501d5adcd2aea002e3a79c775e773c56

SHA512
cd62b25e8c884ba93473ea1a1e3a2d67b65884e48cacae64dc5220b161e516bb53d18b582cbdc8168f0ce1264bca7a6bc29875149e1b02e581c68c37af4a5745

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\clrjit.dll

Filesize
1.5MB

MD5
7ba92e5b9e48071f8da9cf4785758727

SHA1
43a4371bd7721fc37ffabe683491f9758e129986

SHA256
b2a965cf7caa8a44dc15ea87d1426a6eb428cc9e76b8e3a7170450c449bd9239

SHA512
9f517788b67344e33c75c63fc1d18629f0c3d914b38b786bbc89422ca1a54ed93c3b7bc9de526a797f575d98283e586fe9faad20b0a7b77891dfc69589b3dd47

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\coreclr.dll

Filesize
4.9MB

MD5
cabb0b42e5b30bac992467c21e0c67d4

SHA1
fc93bc4c76f3108e8764d9566a20fd86a0802f82

SHA256
4ea1fc47cf560dfb00974f0903b0f1099a6941da071985f4dc6ad23bf9a4f89f

SHA512
0100310005a8aa1370c016abeadb8e2957a1213d72495e8676983af4644ce01e83c62ba37d10d3290579f674ad496f844c2bdbe6be0e40cb52beeeaedf8b1db1

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\coreclr.dll

Filesize
4.6MB

MD5
ae3699ca1c912da5152270690936dee8

SHA1
73628f9f6ac3ed9d980186e74c49598424db57d9

SHA256
70019cb55040348b08f58811191ddd5f776913a73768e644c34d71859accea27

SHA512
f74c181f2e0a78f7701b448b1630d9b2addc0a9e5367094ed537f393a56994e3ef401abdef75c14265133ab144bfe879cffbfcb424240241bd2323b0808908a6

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\hostfxr.dll

Filesize
374KB

MD5
369af51c1b5094fbb184220eb2ecc986

SHA1
b4fe3b11a97ced5f87465c7700d49cf138a41a47

SHA256
5482aa80dd44d778326d3eedf06073e0306b83e69eed35d13386e9b7570371d2

SHA512
0dc6c418c0bd20d7258e01281f5d75d9ee3b82ab2f1bf7307d6df9230f137c0ef45c89bab73d97b61e9a05a0c7f5222973ccd4fb836d6bfb450950b7ddcfed41

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\app-1.17.2\hostpolicy.dll

Filesize
385KB

MD5
35b4d68101d2f1a90425733fa846fdc1

SHA1
ced0ba3a9c2a3bbb2b68690638a127102b54a2e8

SHA256
ba6ce75b6e98e72ddad64e48362751ca0919861793bb1692dca9c920292b3533

SHA512
4d16e0f5c1f682ceebb7a1bebc2068f24f3530a9b2d956e7519ffb06504bb9013e72f5f8ade5f4181058709b8c8c519727b3c61e603845c053adead3b4fc0c54

Download Submit
C:\Users\Admin\AppData\Local\FlowLauncher\packages\FlowLauncher-1.17.2-full.nupkg

Filesize
7.0MB

MD5
eb5955b395cd6cb566d841ddbf264ddb

SHA1
81c07cad560794d73862131ac287fee1fb078695

SHA256
b406632fdd7225622a187c36fb53ed2cdb418cee146bef4842c8ac31c075cd6c

SHA512
e2c6f2a6c55146fc1fdde6a334ca33a0f819b9c2f770bad800245b1773e342d98eaba43fe911c45ec01b946b302e4f6935c3d67174ba5d2e00a83ca38a4884ca

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\FlowLauncher-1.17.2-full.nupkg

Filesize
12.9MB

MD5
043b79cd7145565498a09439b1a9182b

SHA1
02d4171e4c2276859773beb79d40c2e719933e43

SHA256
33bde851491db0d5a508583f7574ab2cc26ab3bcc3b87e1a9590b7116161cd63

SHA512
46350ac56dc0b27aefe582e396ba1c07d827066be907e03578f7e096dd0f1a9de8b449c8e5c6b2bccc44d628a4118acacaaa9118daf52866af6458caa577e168

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES

Filesize
84B

MD5
075a0a5d501f4f3b38280b12cee574f4

SHA1
ad343e327a942d5a167f92b57fb9ecae646e805d

SHA256
d549ff7f0238b756817eb9ea19c4291d5ee13ffe974037022dac740d38e55aa3

SHA512
f1e3e5a568d5a84dd9f7256023702a4be96433175ce4be6ef5d102abec7ca38b50929baa8176dacb104d296d5361893a4a4aa06482e4b7b4e1a94f0001353dca

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe

Filesize
1.5MB

MD5
babf268e110b9f6f3a8adb36d5e71f2e

SHA1
89add45f8e3a2a10ff564c5696dbd75c60993295

SHA256
aaee036e8793f8df967a708c41be56eee9c2db881691bb2899ee30b5308e2bd1

SHA512
0de7c825ca59e76dee83500135db57efba9d4f66c4388ee7d92cb16e4a49f6d61194728d7b0f7e56e9f32187bc37c79c80203582e332403a66e0a5aebf40e561

Download Submit
C:\Users\Admin\AppData\Local\Temp\524f8aa9-7a47-4d0d-9742-b3cc77281c7e.png

Filesize
5KB

MD5
662147d13a9d3b658d4c6bf4ac91fbc2

SHA1
dff1991e9197743cb5ea8a551aae1516b9312ef0

SHA256
1541469676d84bbc26f86dd59d5dba26c58375f83321132d6ac07903830b6460

SHA512
915488d68ce443e98fa81bf411c9254ad6091d8641b3f32bed522ab565ce9969cd4e1fa94498237f9536967411a0b156d54e9296f5b19f4e933734f857c0349a

Download Submit
C:\Users\Admin\AppData\Roaming\FlowLauncher\Logs\1.17.2\2024-02-22.txt

Filesize
9KB

MD5
55d2ffee68ff936c2137d9845fd252f7

SHA1
89ecf85d936818d89808cda56cc1a108375f2751

SHA256
8c2c944c9d63110a175deec60b38c0f01baf337fade2c0d8d009308801397afa

SHA512
eb10a8067424ca1d846d6d7a0b8721e22cd55b576d6a1ba0d4a6930500886e8f321dff15fd826e0a5b42dc82db272fd26564719c8c138e87ee92d43f25d3bb1b

Download Submit
C:\Users\Admin\AppData\Roaming\FlowLauncher\Settings\History.json.tmp

Filesize
19B

MD5
8577e561165ab5d681559f9e3ed2a6a7

SHA1
8d9d107b0d245d60408296d669496d4e03eadca9

SHA256
e9753df621f65c6fdc3721c6a0d5054d4584182cfd42b2bf15622c77af39a7a9

SHA512
602bd20026448ef0a994b3810daf5b7a5114656207d0e9bf4c80de1860ebc697cefb505e125b198113272e350b3fb83ccd7edda1f5344cbf5e5bce5d3a9917e7

Download Submit
C:\Users\Admin\AppData\Roaming\FlowLauncher\Settings\Plugins\Flow.Launcher.Plugin.BrowserBookmark\Settings.json.tmp

Filesize
187B

MD5
1f3b5b5542816f7a5468a44825a06120

SHA1
b3a7323f62483b5bdc543e0a5e8b28aec5181267

SHA256
229be7cada049501020fd0bb6afd03803956d42f7e6a89c73a998e52dd5702f3

SHA512
3c57e65e3872eee9e2186e8b6f5ddfe68a8afb1d252ed269ba43ecf22e285f164831c4b2a7f071243e189b38f3d20aff248d156ed4440870d2fa6c891b475f95

Download Submit
C:\Users\Admin\AppData\Roaming\FlowLauncher\Settings\Plugins\Flow.Launcher.Plugin.Caculator\Settings.json.tmp

Filesize
56B

MD5
e870839eff466c1dbb5a0a1bdcd19ca9

SHA1
ec2fb011f73622b000ae65f72a31f2b4262c655d

SHA256
c929af3bb0afa4afcf7d33cfdf09221068dfa1f35537f1fd9015bce5020085d6

SHA512
058077f97e3256aed9e0e2d390a798a50f3715f69c7b7302aa3b0d1832693bbb715c5c1bde4ac1e9c18ea1fad1094268f174fef15e2bdac18af98426b04aa5fc

Download Submit
C:\Users\Admin\AppData\Roaming\FlowLauncher\Settings\Plugins\Flow.Launcher.Plugin.Explorer\Settings.json.tmp

Filesize
962B

MD5
237055840b2e5ba4b0ec3c5b0f5ff063

SHA1
ab761279842e4d61531c3bc0f10b11081a042de9

SHA256
d1a42a24ce1d317f7c4c096deeaa806b3a21d07add22cb9aeb697a92331d2e42

SHA512
f5f62ba90e01261da96b591211ca73cb2c52daee9351ca712a133883d5b4fd9a3529669ae959ad9616391207b332ce85cf143c463f54b43519684a81795dceed

Download Submit
C:\Users\Admin\AppData\Roaming\FlowLauncher\Settings\Plugins\Flow.Launcher.Plugin.PluginsManager\Settings.json.tmp

Filesize
74B

MD5
bf5e544e66a31fc51df677b9d567af46

SHA1
036b458454950fa4e123c425f5e1ea28a2361431

SHA256
83fd1ca62e754f226f73c76e68b2d1d3cc6bd63cb0f72bf0343ca4038b4a65bb

SHA512
45159565f2151da83b7c3b24d2beae4e89fd2218caaef5963dc55dbc439b6ee1daf814091b5231d5213771627d69ba83dd5a61a73264d16c1fde764c9da6a0da

Download Submit
C:\Users\Admin\AppData\Roaming\FlowLauncher\Settings\Plugins\Flow.Launcher.Plugin.Program\Settings.json.bak

Filesize
597B

MD5
4e162f3107fa94917db4be1a015a0486

SHA1
d7d536ff20cf9bbca888d6508793a0f856dd462d

SHA256
4d4ffb7e65acbfaf11ea2f6962ea6f080170ff477402223b6ac9320a28e3c71a

SHA512
e1518a38a489f0128a0ae75884d3aa136b0c13e54ffe15a2d9aff6fa4ad5345bded7d724ddf82f9b4aca4160675b2fcbb20c1cefb5d902a8cfe66e66f93fc405

Download Submit
C:\Users\Admin\AppData\Roaming\FlowLauncher\Settings\Plugins\Flow.Launcher.Plugin.Shell\Settings.json.tmp

Filesize
231B

MD5
92306a908592ce5705ed40e5919f5507

SHA1
18d659f6103077f6861de5904300d636038fe5b5

SHA256
14413a27502531072312bed25b70f75a150d520d51b37fe328a93607e0e22779

SHA512
72491df12886f07d1cdbdc5eb75e879480fc89beee0489e4a92b983eaf9d090f8aa272a165e9ceb54c0f76dc9231fb5a622d64f7b1947062657de31caee5f476

Download Submit
C:\Users\Admin\AppData\Roaming\FlowLauncher\Settings\Plugins\Flow.Launcher.Plugin.Url\Settings.json.tmp

Filesize
62B

MD5
4bb99838f62184d6f223cdfebfde79ed

SHA1
940e82edf44ad87f4ce3c8f8eed014c316344ff9

SHA256
3c22186a4f5e2e824ce4be3a430d8916e533f80dcf98c665d4d96772523336b8

SHA512
1155de065b0e8c8ee21299a10aee87e917105f5ca31cd838fa4c8a8e410c908c0179b3bced68407ddeb2e6b9309dbc0e0fa67f6b3facbc11f26338c0bdb2d7ae

Download Submit
C:\Users\Admin\AppData\Roaming\FlowLauncher\Settings\Plugins\Flow.Launcher.Plugin.WebSearch\Settings.json.tmp

Filesize
4KB

MD5
606b9a12afe3b350cc55323ab282e739

SHA1
7df4023b632e31c3c08956d7a948645506da8d16

SHA256
3790334bb62f7d922d8a13aa7cf8f46999fcb158c45d3087de534927872db354

SHA512
e3f1ec8078d2f690c3e366bb0c58aee0c28cedfa2dc9b02f344a904a4648b21d952939a6c87f1adfc591cbf3fc1460eff7c79d2c4eb753b94014abef8e8324d5

Download Submit
C:\Users\Admin\AppData\Roaming\FlowLauncher\Settings\Settings.json

Filesize
7KB

MD5
f7d43aa1d1f0999823af043e01aef0ef

SHA1
671dc5f4837d80a034dbf8e4c7166e78da74ccd7

SHA256
e629060fbebe4574d4e614b493232374212a4c0d62ea61eb0baf04fa0ecdad88

SHA512
8725a0484533e492889237dedcdc9564649cd709629d19e531455bbfe245162b0e3ae169abde80b5e4cba1eebc4ff547a2ec69c12a38fb3e979d90d43d5d21e5

Download Submit
C:\Users\Admin\AppData\Roaming\FlowLauncher\Settings\Settings.json.bak

Filesize
7KB

MD5
befd27af3c60ee7970a2ce47f82dea8a

SHA1
7df57d76eb7523a3393668a79cfd05141a4db2e8

SHA256
56502c39620dcdcf74cb53c0758c8d47e59cfc94639674dc7ef9a3f1058c75dd

SHA512
68c321f4183c5960f968130f10c5b922811a6b6d38c25bb04c6cfadd4f26c1290fcab5a7fa86c595f68aeb8c66c15a42a217d6378286eba086ec2957c46d17b1

Download Submit
C:\Users\Admin\AppData\Roaming\FlowLauncher\Settings\TopMostRecord.json.tmp

Filesize
21B

MD5
2258a677933a8265f0885b9ee6d06865

SHA1
d264b0ee408804a32621fee1adb348d357d4edea

SHA256
0794a89560129e01ab25cd471443743ce7187458c23d4c9fa5b4dcc006aac4d2

SHA512
16cdc776ecadf856b88ae2142485d7c52807af5f75c2c1cb35c7c4b468fa76d9cc7766789dbf0e6cbf87a5cff474350b643dc31d8679e32b3f2101aa0fd2d199

Download Submit
C:\Users\Admin\AppData\Roaming\FlowLauncher\Settings\UserSelectedRecord.json.tmp

Filesize
30B

MD5
76cb3b309f831f6683fda1d65dc2aa8e

SHA1
6d00416fe784efe72782dc9098331dc3aa3a2896

SHA256
2841c720776d876f021c6287f97410e0334b43fb226e9e33468a3afc69bbd0c1

SHA512
61076fa2ae82543f677bd5a5578c512924c6aa3f6ee83d64cb82519285afea5f2c58bf5812d1729725dc72f1633e9e0866b71eb1d5de6017ee253b0cd4223d7c

Download Submit
memory/2984-1255-0x0000000008050000-0x0000000008088000-memory.dmp

Filesize
224KB

Download
memory/2984-8-0x0000000004D60000-0x0000000004D70000-memory.dmp

Filesize
64KB

Download
memory/2984-1290-0x0000000004D60000-0x0000000004D70000-memory.dmp

Filesize
64KB

Download
memory/2984-1401-0x0000000073B40000-0x00000000742F0000-memory.dmp

Filesize
7.7MB

Download
memory/2984-612-0x0000000007690000-0x0000000007698000-memory.dmp

Filesize
32KB

Download
memory/2984-1298-0x000000000A2F0000-0x000000000A310000-memory.dmp

Filesize
128KB

Download
memory/2984-1386-0x000000000AD60000-0x000000000ADF2000-memory.dmp

Filesize
584KB

Download
memory/2984-7-0x0000000073B40000-0x00000000742F0000-memory.dmp

Filesize
7.7MB

Download
memory/2984-6-0x0000000000230000-0x00000000003AA000-memory.dmp

Filesize
1.5MB

Download
memory/2984-1264-0x0000000008020000-0x000000000802E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads