hijackloader | hxxps://devltd[.]us/flomotg5[.]zip

Resubmissions

20/06/2026, 17:07

260620-vm2khsht3x10

17/06/2026, 15:54

260617-tcmsyaas5r4

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
318s
max time network
320s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://devltd.us/flomotg5.zip
Sample260620-vm2khsht3x

Score

10^/10

credential_access discovery hijackloader loader persistence ransomware spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\UI_net20
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral1/files/0x000300000001877f-444.dat	family_hijackloader

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\bit8a4f.tmp	taskmgr.exe

Executes dropped EXE 10 IoCs

pid	Process
4836	flomo.exe
1940	flomo.exe
848	flomo.exe
484	flomo.exe
4508	flomo.exe
4664	flomo.exe
5472	ToolkitFlu.exe
5060	ToolkitFlu.exe
7472	flomo.exe
3528	flomo.exe

Loads dropped DLL 18 IoCs

pid	Process
1940	flomo.exe
1940	flomo.exe
1940	flomo.exe
1940	flomo.exe
1940	flomo.exe
4664	flomo.exe
4664	flomo.exe
4664	flomo.exe
4664	flomo.exe
4664	flomo.exe
5472	ToolkitFlu.exe
5472	ToolkitFlu.exe
5060	ToolkitFlu.exe
5060	ToolkitFlu.exe
2616	MetManager.exe
6816	Crisp.exe
7472	flomo.exe
3528	flomo.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.flomo = "C:\\Users\\Admin\\Desktop\\flomo.exe"	flomo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.flomo = "C:\\Users\\Admin\\Desktop\\flomo.exe"	flomo.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\taskschd.msc	mmc.exe

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 5060 set thread context of 2616	5060	ToolkitFlu.exe	135
PID 2616 set thread context of 6484	2616	MetManager.exe	139
PID 5060 set thread context of 6816	5060	ToolkitFlu.exe	151
PID 2616 set thread context of 7528	2616	MetManager.exe	160
PID 2616 set thread context of 6504	2616	MetManager.exe	140
PID 2616 set thread context of 8024	2616	MetManager.exe	166
PID 2616 set thread context of 5508	2616	MetManager.exe	87

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	MetManager.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	MetManager.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt	MetManager.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	MetManager.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt	MetManager.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\notice.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	MetManager.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	MetManager.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	MetManager.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jmc.txt	MetManager.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jvisualvm.txt	MetManager.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	MetManager.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	MetManager.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt	MetManager.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Mocking.help.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	MetManager.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	MetManager.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt	MetManager.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_should.help.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	MetManager.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\README.txt	MetManager.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\COPYING.txt	MetManager.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_TestDrive.help.txt	MetManager.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	MetManager.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\THANKS.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	MetManager.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	MetManager.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\corehost_v5.job	Crisp.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MetManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
8052	msedge.exe
1260	msedge.exe
6716	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMajorRelease	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMinorRelease	msinfo32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264488484077633"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-487906980-2895880840-1957110281-1000\{91F02506-1A8B-4859-A81D-CA45D07ED2B5}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings	taskmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2616	MetManager.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5472	ToolkitFlu.exe
5060	ToolkitFlu.exe
5060	ToolkitFlu.exe
5060	ToolkitFlu.exe
5060	ToolkitFlu.exe
5060	ToolkitFlu.exe
5060	ToolkitFlu.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
296	msinfo32.exe
2616	MetManager.exe
5016	taskmgr.exe
8108	mmc.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
5060	ToolkitFlu.exe
5060	ToolkitFlu.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
6484	chrome.exe
6484	chrome.exe
6484	chrome.exe
6484	chrome.exe
6484	chrome.exe
6484	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4460	7zG.exe
Token: 35	4460	7zG.exe
Token: SeSecurityPrivilege	4460	7zG.exe
Token: SeSecurityPrivilege	4460	7zG.exe
Token: SeShutdownPrivilege	4836	flomo.exe
Token: SeCreatePagefilePrivilege	4836	flomo.exe
Token: SeShutdownPrivilege	4836	flomo.exe
Token: SeCreatePagefilePrivilege	4836	flomo.exe
Token: SeShutdownPrivilege	4836	flomo.exe
Token: SeCreatePagefilePrivilege	4836	flomo.exe
Token: SeShutdownPrivilege	484	flomo.exe
Token: SeCreatePagefilePrivilege	484	flomo.exe
Token: SeShutdownPrivilege	484	flomo.exe
Token: SeCreatePagefilePrivilege	484	flomo.exe
Token: SeShutdownPrivilege	4836	flomo.exe
Token: SeCreatePagefilePrivilege	4836	flomo.exe
Token: SeShutdownPrivilege	484	flomo.exe
Token: SeCreatePagefilePrivilege	484	flomo.exe
Token: SeShutdownPrivilege	4836	flomo.exe
Token: SeCreatePagefilePrivilege	4836	flomo.exe
Token: SeShutdownPrivilege	484	flomo.exe
Token: SeCreatePagefilePrivilege	484	flomo.exe
Token: SeShutdownPrivilege	4836	flomo.exe
Token: SeCreatePagefilePrivilege	4836	flomo.exe
Token: SeShutdownPrivilege	484	flomo.exe
Token: SeCreatePagefilePrivilege	484	flomo.exe
Token: SeShutdownPrivilege	4836	flomo.exe
Token: SeCreatePagefilePrivilege	4836	flomo.exe
Token: SeShutdownPrivilege	484	flomo.exe
Token: SeCreatePagefilePrivilege	484	flomo.exe
Token: SeShutdownPrivilege	4836	flomo.exe
Token: SeCreatePagefilePrivilege	4836	flomo.exe
Token: SeShutdownPrivilege	484	flomo.exe
Token: SeCreatePagefilePrivilege	484	flomo.exe
Token: SeShutdownPrivilege	4836	flomo.exe
Token: SeCreatePagefilePrivilege	4836	flomo.exe
Token: SeShutdownPrivilege	484	flomo.exe
Token: SeCreatePagefilePrivilege	484	flomo.exe
Token: SeShutdownPrivilege	4836	flomo.exe
Token: SeCreatePagefilePrivilege	4836	flomo.exe
Token: SeShutdownPrivilege	484	flomo.exe
Token: SeCreatePagefilePrivilege	484	flomo.exe
Token: SeShutdownPrivilege	4836	flomo.exe
Token: SeCreatePagefilePrivilege	4836	flomo.exe
Token: SeShutdownPrivilege	484	flomo.exe
Token: SeCreatePagefilePrivilege	484	flomo.exe
Token: SeShutdownPrivilege	4836	flomo.exe
Token: SeCreatePagefilePrivilege	4836	flomo.exe
Token: SeShutdownPrivilege	484	flomo.exe
Token: SeCreatePagefilePrivilege	484	flomo.exe
Token: SeShutdownPrivilege	4836	flomo.exe
Token: SeCreatePagefilePrivilege	4836	flomo.exe
Token: SeShutdownPrivilege	484	flomo.exe
Token: SeCreatePagefilePrivilege	484	flomo.exe
Token: SeShutdownPrivilege	4836	flomo.exe
Token: SeCreatePagefilePrivilege	4836	flomo.exe
Token: SeShutdownPrivilege	484	flomo.exe
Token: SeCreatePagefilePrivilege	484	flomo.exe
Token: SeShutdownPrivilege	4836	flomo.exe
Token: SeCreatePagefilePrivilege	4836	flomo.exe
Token: SeShutdownPrivilege	484	flomo.exe
Token: SeCreatePagefilePrivilege	484	flomo.exe
Token: SeShutdownPrivilege	4836	flomo.exe
Token: SeCreatePagefilePrivilege	4836	flomo.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
4460	7zG.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5508	msedge.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
6484	chrome.exe
6484	chrome.exe
6484	chrome.exe
6484	chrome.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5016	taskmgr.exe
5016	taskmgr.exe
5016	taskmgr.exe
8108	mmc.exe
8108	mmc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5508 wrote to memory of 3156	5508	msedge.exe	88
PID 5508 wrote to memory of 4752	5508	msedge.exe	91
PID 5508 wrote to memory of 1260	5508	msedge.exe	90
PID 5508 wrote to memory of 4752	5508	msedge.exe	91
PID 5508 wrote to memory of 4752	5508	msedge.exe	91
PID 5508 wrote to memory of 5840	5508	msedge.exe	92
PID 5508 wrote to memory of 5840	5508	msedge.exe	92
PID 5508 wrote to memory of 3620	5508	msedge.exe	93
PID 5508 wrote to memory of 3620	5508	msedge.exe	93
PID 5508 wrote to memory of 3620	5508	msedge.exe	93
PID 5508 wrote to memory of 2188	5508	msedge.exe	94
PID 5508 wrote to memory of 2188	5508	msedge.exe	94
PID 5508 wrote to memory of 2188	5508	msedge.exe	94
PID 5508 wrote to memory of 3668	5508	msedge.exe	95
PID 5508 wrote to memory of 3668	5508	msedge.exe	95
PID 5508 wrote to memory of 3668	5508	msedge.exe	95
PID 5508 wrote to memory of 1656	5508	msedge.exe	96
PID 5508 wrote to memory of 1656	5508	msedge.exe	96
PID 5508 wrote to memory of 1656	5508	msedge.exe	96
PID 5508 wrote to memory of 844	5508	msedge.exe	97
PID 5508 wrote to memory of 2744	5508	msedge.exe	98
PID 5508 wrote to memory of 844	5508	msedge.exe	97
PID 5508 wrote to memory of 2744	5508	msedge.exe	98
PID 5508 wrote to memory of 3712	5508	msedge.exe	100
PID 5508 wrote to memory of 4744	5508	msedge.exe	101
PID 5508 wrote to memory of 3712	5508	msedge.exe	100
PID 5508 wrote to memory of 4744	5508	msedge.exe	101
PID 5508 wrote to memory of 4744	5508	msedge.exe	101
PID 5508 wrote to memory of 1320	5508	msedge.exe	103
PID 5508 wrote to memory of 5624	5508	msedge.exe	106
PID 5508 wrote to memory of 5624	5508	msedge.exe	106
PID 5508 wrote to memory of 5624	5508	msedge.exe	106
PID 5508 wrote to memory of 5788	5508	msedge.exe	107
PID 5508 wrote to memory of 5788	5508	msedge.exe	107
PID 5508 wrote to memory of 5788	5508	msedge.exe	107
PID 5508 wrote to memory of 2740	5508	msedge.exe	108
PID 5508 wrote to memory of 6024	5508	msedge.exe	113
PID 5508 wrote to memory of 5572	5508	msedge.exe	114
PID 5508 wrote to memory of 1560	5508	msedge.exe	115
PID 4836 wrote to memory of 1940	4836	flomo.exe	119
PID 4836 wrote to memory of 848	4836	flomo.exe	120
PID 4836 wrote to memory of 1940	4836	flomo.exe	119
PID 484 wrote to memory of 4508	484	flomo.exe	123
PID 484 wrote to memory of 4664	484	flomo.exe	124
PID 484 wrote to memory of 4664	484	flomo.exe	124
PID 4836 wrote to memory of 5584	4836	flomo.exe	128
PID 5584 wrote to memory of 5472	5584	cmd.exe	130
PID 5472 wrote to memory of 5060	5472	ToolkitFlu.exe	131
PID 5508 wrote to memory of 6016	5508	msedge.exe	132
PID 5508 wrote to memory of 6016	5508	msedge.exe	132
PID 5060 wrote to memory of 2616	5060	ToolkitFlu.exe	135
PID 5060 wrote to memory of 2616	5060	ToolkitFlu.exe	135
PID 6484 wrote to memory of 6504	6484	chrome.exe	140
PID 6484 wrote to memory of 6716	6484	chrome.exe	141
PID 6484 wrote to memory of 6776	6484	chrome.exe	143
PID 6484 wrote to memory of 6776	6484	chrome.exe	143
PID 6484 wrote to memory of 6724	6484	chrome.exe	144
PID 6484 wrote to memory of 6724	6484	chrome.exe	144
PID 6484 wrote to memory of 6828	6484	chrome.exe	145
PID 6484 wrote to memory of 6836	6484	chrome.exe	146
PID 6484 wrote to memory of 6828	6484	chrome.exe	145
PID 6484 wrote to memory of 6836	6484	chrome.exe	146
PID 6484 wrote to memory of 7100	6484	chrome.exe	147
PID 6484 wrote to memory of 7100	6484	chrome.exe	147

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://devltd.us/flomotg5.zip
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ff8cb2bc188,0x7ff8cb2bc194,0x7ff8cb2bc1a0
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1684,i,10984800608595102750,5267623211361666345,524288 --field-trial-handle=2292,i,11845009153367273573,17766277907124807413,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,8899460724473944471,11470976381166630433,262144 --field-trial-handle=2292,i,11845009153367273573,17766277907124807413,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,46491640644377940,9578795824001806136,524288 --field-trial-handle=2292,i,11845009153367273573,17766277907124807413,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:13
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,5148520651370403422,15538196360398281551,2097152 --field-trial-handle=2292,i,11845009153367273573,17766277907124807413,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,2667986664032675,17821007894365099008,2097152 --field-trial-handle=2292,i,11845009153367273573,17766277907124807413,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,2020124687781618235,6958549394550555858,2097152 --field-trial-handle=2292,i,11845009153367273573,17766277907124807413,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,17268884591702389288,12079298581075809446,2097152 --field-trial-handle=2292,i,11845009153367273573,17766277907124807413,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:9
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,7562898279815160311,4883778840939556578,524288 --field-trial-handle=2292,i,11845009153367273573,17766277907124807413,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:14
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,2729571494247451518,11929891563440863389,524288 --field-trial-handle=2292,i,11845009153367273573,17766277907124807413,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:14
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,16652109529065615204,12537274451905662160,524288 --field-trial-handle=2292,i,11845009153367273573,17766277907124807413,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5888,i,13255961905995187733,8063526728227802787,2097152 --field-trial-handle=2292,i,11845009153367273573,17766277907124807413,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,10877417341130329449,3196360826183552835,524288 --field-trial-handle=2292,i,11845009153367273573,17766277907124807413,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:14
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,10877417341130329449,3196360826183552835,524288 --field-trial-handle=2292,i,11845009153367273573,17766277907124807413,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:14
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=7192,i,2944933337522697321,16987110321649954694,2097152 --field-trial-handle=2292,i,11845009153367273573,17766277907124807413,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5988,i,13111339523992509312,4645524899440176625,2097152 --field-trial-handle=2292,i,11845009153367273573,17766277907124807413,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,3399113810569970142,5307447835511889982,524288 --field-trial-handle=2292,i,11845009153367273573,17766277907124807413,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7208,i,7451304584319232418,7208837709371627281,524288 --field-trial-handle=2292,i,11845009153367273573,17766277907124807413,262144 --variations-seed-version --mojo-platform-channel-handle=7220 /prefetch:14
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7192,i,8824990684866912489,902663212304224541,524288 --field-trial-handle=2292,i,11845009153367273573,17766277907124807413,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7216,i,12857797541748862748,12898843746742071762,524288 --field-trial-handle=2292,i,11845009153367273573,17766277907124807413,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,9239486098984057285,761927693464173335,524288 --field-trial-handle=2292,i,11845009153367273573,17766277907124807413,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7204,i,18005915204780742304,3967404018648739524,262144 --field-trial-handle=2292,i,11845009153367273573,17766277907124807413,262144 --variations-seed-version --mojo-platform-channel-handle=1828 /prefetch:10
  2⤵
  PID:7952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,8111664783538008903,18056931182609372493,524288 --field-trial-handle=2292,i,11845009153367273573,17766277907124807413,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
  2⤵
  PID:7088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,13482012579102818529,17827773458598930654,524288 --field-trial-handle=2292,i,11845009153367273573,17766277907124807413,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,6444416970222820268,667059775569584646,524288 --field-trial-handle=2292,i,11845009153367273573,17766277907124807413,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:14
  2⤵
  PID:7576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1684,i,8820957941274487125,13669131807702472411,524288 --field-trial-handle=2292,i,11845009153367273573,17766277907124807413,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:11
  2⤵
  - System Time Discovery
  PID:8052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3480,i,6013432018025567669,11191637193680594982,524288 --field-trial-handle=2292,i,11845009153367273573,17766277907124807413,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:14
  2⤵
  PID:1856

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2420

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2720

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:3988

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap1756:74:7zEvent3182
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4460

C:\Users\Admin\Desktop\flomo.exe
"C:\Users\Admin\Desktop\flomo.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Users\Admin\Desktop\flomo.exe
  "C:\Users\Admin\Desktop\flomo.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\flomo卡片笔记" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1824,i,10734018338127571787,1621990242160472674,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1820 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1940
- C:\Users\Admin\Desktop\flomo.exe
  "C:\Users\Admin\Desktop\flomo.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\flomo卡片笔记" --field-trial-handle=1824,i,10734018338127571787,1621990242160472674,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:11
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\1781975293134\ToolkitFlu.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5584
- - C:\Users\Admin\AppData\Local\Temp\1781975293134\ToolkitFlu.exe
    "C:\Users\Admin\AppData\Local\Temp\1781975293134\ToolkitFlu.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5472
  - - C:\ProgramData\UI_net20\ToolkitFlu.exe
      C:\ProgramData\UI_net20\ToolkitFlu.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\MetManager.exe
        
        C:\Users\Admin\AppData\Local\Temp\MetManager.exe
        5⤵
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: GetForegroundWindowSpam
        
        PID:2616
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:7528
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:8024
    - - C:\Users\Admin\AppData\Roaming\UI_net20\Crisp.exe
        
        C:\Users\Admin\AppData\Roaming\UI_net20\Crisp.exe
        5⤵
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:6816
- C:\Users\Admin\Desktop\flomo.exe
  "C:\Users\Admin\Desktop\flomo.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\flomo卡片笔记" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1824,i,10734018338127571787,1621990242160472674,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:10
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:7472

C:\Users\Admin\Desktop\flomo.exe
C:\Users\Admin\Desktop\flomo.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:484
- C:\Users\Admin\Desktop\flomo.exe
  "C:\Users\Admin\Desktop\flomo.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\flomo卡片笔记" --field-trial-handle=2200,i,4017223765288765827,15060522706848354856,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:11
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Users\Admin\Desktop\flomo.exe
  "C:\Users\Admin\Desktop\flomo.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\flomo卡片笔记" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2200,i,4017223765288765827,15060522706848354856,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4664
- C:\Users\Admin\Desktop\flomo.exe
  "C:\Users\Admin\Desktop\flomo.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\flomo卡片笔记" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2200,i,4017223765288765827,15060522706848354856,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:10
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3528

C:\Windows\system32\msinfo32.exe
"C:\Windows\system32\msinfo32.exe" "C:\Users\Admin\Desktop\RegisterSkip.nfo"
1⤵
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
PID:296

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Drops startup file
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3984

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:6324

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8bffcc728,0x7ff8bffcc734,0x7ff8bffcc740
  2⤵
  PID:6504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1796,i,8460632383793493713,3091376455705599873,524288 --field-trial-handle=2080,i,16969339580148575805,4665499298293233665,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2208,i,2524127259272054108,14334531730534173110,524288 --field-trial-handle=2080,i,16969339580148575805,4665499298293233665,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:13
  2⤵
  PID:6776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,17277186100155805953,13896463087756008780,262144 --field-trial-handle=2080,i,16969339580148575805,4665499298293233665,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:6724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,13973118330764931154,2776484594164417196,2097152 --field-trial-handle=2080,i,16969339580148575805,4665499298293233665,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:6828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,15929703645624548214,10807941228339530814,2097152 --field-trial-handle=2080,i,16969339580148575805,4665499298293233665,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:6836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4572,i,3137821412666903869,2543250345099270412,2097152 --field-trial-handle=2080,i,16969339580148575805,4665499298293233665,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:7100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4836,i,13709140089916172300,754110261100523084,524288 --field-trial-handle=2080,i,16969339580148575805,4665499298293233665,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14
  2⤵
  PID:544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4992,i,14312354953896474663,8108469408551929668,524288 --field-trial-handle=2080,i,16969339580148575805,4665499298293233665,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
  2⤵
  PID:6264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5164,i,9091864108643842397,6886437122809440477,524288 --field-trial-handle=2080,i,16969339580148575805,4665499298293233665,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
  2⤵
  PID:6328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,541879857693118464,8614718420814406687,524288 --field-trial-handle=2080,i,16969339580148575805,4665499298293233665,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
  2⤵
  PID:6736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5664,i,6949762382249757729,2926710968078732221,2097152 --field-trial-handle=2080,i,16969339580148575805,4665499298293233665,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:5492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5708,i,5751233889958870475,2597576624625967498,2097152 --field-trial-handle=2080,i,16969339580148575805,4665499298293233665,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:6248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5768,i,470753486105034098,6760767652249261115,2097152 --field-trial-handle=2080,i,16969339580148575805,4665499298293233665,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:7476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5980,i,1725539291043862760,12322223084086343040,524288 --field-trial-handle=2080,i,16969339580148575805,4665499298293233665,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
  2⤵
  PID:7484

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:7120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6264

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5616

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:7560

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:8052

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:7180

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Enumerates connected drives
PID:4272
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1784

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s
1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:8108

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:2712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Path C:\Users\Admin\AppData\Local\D3DSCache\296068ebba9eecd\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Size 4B
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2f7b806168b3fb2314159551252362b5be273fccfae4408cd3f40499bd0521ba
MD5 affe9d93b07a766204b9f25fb3b215b8
SHA1 dbc2282dbb53ed464d72199482ebb524401bc241
SHA512 c1e159082a1de08c246a4f8d7b515b14effd7a81416777c090b82865d00ce010bf4f58243d98647e0c546dfa514a4ab73bd6ad666ae9060a3c5e279cfeabfd29
TLSH
T171417BF7C3D4CA6DC91156E4AB216E2ECD3D0A58522C3C52C9D8AF4B53E2972D20064E
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 de551a1c71e4806aa3845301b2534d8ca1b52bfa5b6aae0884d0f084103b5f4e
MD5 6de7fcb02624573cd4ff9c74fc2f5bd7
SHA1 a87ac6a28ea98c0379bbb78b4797cddf3ea2fae7
SHA512 57adcd26da3f0f26d6045c6203940f4050638d55d70c347d6cd6a4a4034a182c61f063e859957f065bb9c4600144a32a52b0c0be3cd8073ebb6fb8f8a7959a63
TLSH
T140F09EA7A67D796B10BB96BF1D00FC096679A43016D15CE4EFAB426DF0810F31F1241B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 f7ca0e71c389f049748f869d15608ef008ce735ba202f8b04772abf75844b827
MD5 abc082942092ce210d76bf07236175dc
SHA1 b65ea83ce79c660282dddcdbd36fa58b31305430
SHA512 53edc712a56923296038fb9e60927e7499753385ca514055b3ee7fcd5800a01e72654cc0736afc15a912b3b2e05455de4a02c79e2a353430c7bb3f41451c461b
SSDEEP 192:dRKueI0v7TAPRp2A9JHsb+WNnMz0vAe6YQPyIsnAUgR:dRKuNwSX/Hw40EYaR
TLSH
T1F932942AA914647B5CDBD22AFA227757D2F6102275943E84EAFC8A3C11E79CC2317417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 2b649fe7a06f351fd9445e033bb1abb5c3be2813f7cf289a16d54872e6a924e4
MD5 8a3dfe0650e00078b726fa4762d03379
SHA1 de9a584f126ec61b819df4c94ff7be67d97c9da7
SHA512 e8e367e74ad3bc6965921b926abd959ff88e077da171071605a04ea0e02db84c8f247a5c329641a8a9306a04344e1b2cdceae34e14b252b80c9f0b3e509f952f
SSDEEP 192:em94K6Y+7KxkXqK4I40pUZNCgVLHrKHfFKslEuuUXzKD/D6+ErUkKN90YRgvcXIF:H9j7+7KxkXqKf/pUZNCgVLH2HfgslGUX
TLSH
T16832E727948D6A7B4FDCD51CDC026F8F6DB4029776280D2496FB9D0803A9BCE124A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d81e3218-398e-458b-b7e9-5d387e8fc995.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d81e3218-398e-458b-b7e9-5d387e8fc995.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 d587f2050408254af1e6b2739abaa0ef69f4698eae294787676a8f4c6f039711
MD5 02a3a88c09b7c49412a9bf9438e138fa
SHA1 b433232ec433b9c97dd5096182fe951116c5f9ec
SHA512 975ce4f4b5c521f6c6c6fabec92664338226e53e81797b9fab6e2f125f86889498b8072cf32e44e3f726dc4c498d5e4b58ce73a74ccc1ef53cb0907e4568cd08
SSDEEP 96:VC6Zd+nxXdhtrXxtkWDfMt9qAGfRDotok5jIfDjgDB6EdGyvKvMRsVbEScv4a:VC+YZtLxtkW2wDUDc0drw9MRwbO
TLSH
T1E5A11A3254299D7754BAA189B9833E438F7871A7F9529F88E9EC5B0C20E74ED0382537
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 edccc62d7cc36e112b48877275dcc6bfc03e440ea1965026aa4a80166f44b31f
MD5 82b4f74a695c2417658f2522f719511b
SHA1 1b2e0dd1239cb2cff7b97ba1c80b902018d10fed
SHA512 bb5183efaf60e2a4b9dd9ab489bdadbc228fc872874636dcc50857a71c414ed62a3c45f0caa9dec70886b39040fcbf4b63eee08a7f917e7262634f7a769ccea4
SSDEEP 1536:ngmysAHTGto+SaoiIlaCTDqZzHuwBGvCwH76TU+z57oCvY34w8U8c/RVLpTx0E6Z:ftoSKa6qMwgCh3hodf8U8+RhpNq
TLSH
T19FC3123C1C86AC6B19F3E140B44BF7E68E1DC8A1B04D856441ED7E9E7091CE98193E6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 86bd3a0f7328ff17cf8f5c348bd8ac04b7d41c52ef238ad0b048b09e5a964859
MD5 c6e3af776b1f4463a76e29cca079d5e5
SHA1 19b7f1bc72393d7717302ee15e0e4afa431cea45
SHA512 b15ef012a17356e47acc81e1922c433a19e6e554795a46fdf0ae05df1e9abbc87a47b05bc831bac2c6c32faad3f39c7a7cb21ae65ceb4f96f3deb3ea0d83e9c6
TLSH
T1D7D080613B05A616D54B19729C18E7117237844234E3D9097171D10EDABD3C4F3C51F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 be05b8d7f0bed3c8d0e89a1a49e4bae1f45619d94149f9abd8291f558897f2f2
MD5 e02c579c3ab95f9c3a77f9c2199a30f0
SHA1 f96c7c58830f56a993117d75a3b0f9e30bfc93a7
SHA512 264a83561849b0e2a1c42c3e478b7d5a3b3fa31f901f29440fc853108e9046e73ba21a692d0dbdef7d9fd76e9b6aac64489fb603c47ab551280df09d26d7e2a4
TLSH
T140D080613B05A516D54B19729C19E7117237844224E3D9097171D11EDABD3C4F3C51E3
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 c4f9ddab5ce11d935227872345c480c73af982e435fc0718f6c86797c5351877
MD5 83f439591abc8c48de58f026f471e82b
SHA1 83ffe42c00d31c3152f8aa409e0d36b081e00baa
SHA512 21a787bfec1a3f104bc2cc4626146e1cb4bed876841e5c2ab68cdc8435491ed72301c43d7c27bf7ea263e741fa13a0e5c726d900cdb4a657f690506053e17a41
TLSH
T1F1E026A494E8C32EE601A46743BCE30CC281360F96C86D1E1704898970C3A55B2A2790
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 9c0722b3f35f16f4d8a9a7642ba04956ea0428f1a10de3bf77d336546819c60a
MD5 df9e7c120ead58c78ad43e8cc838fabc
SHA1 cd3d969df75e73c9164ed18cda960816ca3103b9
SHA512 496fd27ccd44530293945b7f4fdd52d179ce6bc36839b0d4c6d61d2b9c7e74b31e40aedf08dc313d7d744e98717f51939cc25452c47f1858e85c6ac5c48a55ae
TLSH
T1C0E0DFF6B2B0E3B58A42A88692FC629C485871CDA99DDC9E3304648CB882600CBA8580
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a4ff6dcb15154ab50b1e44b7a81e985b92fb34a0347567d38e20e3db807814da
MD5 a2c0c89bca4e3e14318794b6d7b57aac
SHA1 c0109396c05d78b52c5e83a5ac64456a468a8bc1
SHA512 3851169adf930c2c8d6ee213532fd3bada73e8e3eb0fdc75159cd70b24e072c79a4a9623fed79fa9ae1bacc85d2a51afe369a56bab3e527e6cb69310cdab32bb
TLSH
T1FF71B4905C122BF2EB1382B571C453CF33B80472861B3E06D185A278BB0E7ED87B225E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59259f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59259f.TMP
Size 3KB
SHA256 a370c6355516df5ef65ac781c946d16c665b1933764c03171fd9cc23df1d8caf
MD5 494e0cf4e47f8779811988a0a241ac88
SHA1 a92e6ef7cb6660fc6485d51911763c4f8f935426
SHA512 a55157700eb99d6ce902e97654bfab42969a1b98cfce7e054e8c2e2bfaecb3ecf861bd059df54f7518031d6de0243dd1fa5cac7dfbbd511c61c0cad7797645fa
TLSH
T1F871B6915C122BF1EB13827575C453CF33B8447286173E06D1856278BB0E7ED97B225E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4467c973751b3c13e056154fc9afa2f5443161cd655a06707a4a8d6536ae1bf3
MD5 b54f403749d0d11d11fc389b7293ffd7
SHA1 11fdc8853286c87136d43020c78b43201aa473c2
SHA512 413ff0bf04448c315b58638c54b4b797112c47f2d138244230e996f7e58d75d00261e9d99845bc7ea664f6fbb0ae94cd3c836a9222547a3a63ae74d22275a63c
TLSH
T19251ADF7C3E8856DD91186F4BB147E2BCE1D091483283D5AC9E4AF1B97E2871E24194E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b0e72befa20072600e0714643118b6a33fed86cdc5b34b6da5d65f0d50ce05d1
MD5 d5ae3d34c163be6614b4cd13fb9704c6
SHA1 bd65ff9eec3065461657f74c55a3da30952882e0
SHA512 56a9063a4ade4220549474cbef044f93771dea47bc99a835eec1640890f0d3d8aba31679c812542d2af48efa0bb15fba6820ce8659960631c8c2e346369cf070
SSDEEP 192:sxR6Rson/fUsyzyi1xzoA8pi/g6+WNIYAQzwWgY0GqIgIJ:sxR6Rn/fUsyzy8si/5IQwWgYas
TLSH
T1293297165928A93B8CCBE21DFB56BF53D2F95032B1941E48E6FC960C04E7ADD220750F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9c507536f4141f90e950c024ae8d49062d97678142d9dc6e22a97e38b4f5e3d8
MD5 7ca85072e3ed7e1262ad95dec1a018b6
SHA1 e457af4c1bf42654dbcb4fb88674c1ce67985223
SHA512 001672cdb1f503be3e1fd5ebb94473898b52af8f5410f3e2b3f337bcf99d581b35db3e1bee092e259aa948bbd44228ac44b97f58debb453e94384570cd75a37c
SSDEEP 192:sxRNRcyM/jK1Ml8wHn/fUs5zyi1xzoA8pi/g6+WNIYAQzwWgY0GqIgDcJ:sxRNGBn/fUs5zy8si/5IQwWgYac
TLSH
T15352CA169A34993BCCDBD20DFA567F53D6F81473B2941E44AAFC9A0C04E6ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 19bb42e067f7f197b0ccbfca83b47bbce53e31075607b2375a36a1b7bb411438
MD5 1fa9cef5491a8bc91dabfe1ee3b6abc4
SHA1 92d5bc648961387eede0ecfda15f67078fc58d0c
SHA512 9ae160f45c0799f47208867d91462a472612b018040ddc1f450391a0e624dc51d528cb407222ea5e0b154f980d9b58ec13622256ca9269336df3dd4b8f695e72
SSDEEP 192:sxRNRcyM/jK1Ml8UQoPHn/fUs5syi1xzoA8pw/g6+WNIYAZ5PzwWgY0GqIgD+J:sxRNGqmn/fUs5sy8sw/5IVtwWgYaG
TLSH
T19562C816AA24993BCCDBD20DF6567F53D6F85473A1941E44AAFC8B0C04E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 77d4222c8b211aa65ea74fa4b3932da34358faf3fd918357df07d983da06dfa8
MD5 2150747d7727ee861a09139bc70dc744
SHA1 70575a3ac3e00e11cb30f9d177b5ab8e6cac1ce0
SHA512 89baa32c5eeac789c0e58462f2403f78b8ce0a81da068fad4e96b813610044688cca61247672494e2d2bf4c3f8b0e04486dce8a7683b5f4f71adbaa679f9758b
SSDEEP 384:ll6ivnMfCtgICFfHzKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVV99zVRLaroQyi:lsivn+WgI+fHz8F1+UoAYDCx9Tuqh0Vt
TLSH
T195B2DA2F604CCB7E4F801A9DAC596F9B7DA802CB96588D4047FE994C02C77EE911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 5fe27a646d5ce8d21f98ec0d098fa49bf96051a3b433b9665dd6513c8bb7d11c
MD5 af5762f41ef98f83e8b69ea9efab274e
SHA1 896bf5336aef71a13458c95c372b95f48f2d7a1d
SHA512 169e657de13ac52e4c4e0efaf943cb202d2222e1c38eadcfdcf3fb3e759d6a444cd5bcc2b1966cb6b64af84e17daa1ef40b50d96c8bf2616a1dd715893a720d1
SSDEEP 768:l1Av9+WgI+f2z8F1+UoAYDCx9Tuqh0VfUC9xbog/OVZ7zVaro9sop:l1Av9+WgI+f2zu1jaM/VRSop
TLSH
T109C20A2F640CC77E4F841AADEC2AAED76DD801CB97584D5447EA890C03C67EF921A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fcda27c1-e513-418c-8f3f-248f0d55b902\index-dir\the-real-index
Size 744B
SHA256 141a42d87e76b0cd0ec9e4e6a29c7935a2585d1d5cd306f23a88f6ed522a5bc1
MD5 d9b2237f023d18f3dd06e527b5e4c3d8
SHA1 2d9a56d6522674f46a0e30042d41dad30559d000
SHA512 9fe15052ab9bcdf1ae9e22021214c80e8e8dd94cf4948b20aecc20c951af15b6bf686b3c9382a2e6a836bdeefabda278d07e5e0ac631670a4a3ae6320143cd57
TLSH
T171018BB67CE02987CE2119B66AB1B00C377386FC5A4C9943526CB43CCC97BB82A506C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d6ad2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fcda27c1-e513-418c-8f3f-248f0d55b902\index-dir\the-real-index~RFe5d6ad2.TMP
Size 744B
SHA256 92b6b4912bc433d3dc26b199f9d181f65bed636823ab9aa610a9e5546a89d64a
MD5 27b230eca940d980d1508b045807d2db
SHA1 39086e1df9fe134e41edfe73a81656530d9e9f12
SHA512 a8801d87a67482a2d1f6100d695c069b6f7a51a43bdee1ad93e0cf8d5b6e03f1660a32995a449d5cb7123569d47d69a1f49b1782fa45e4c2d2cdd1a44b0e9fc4
TLSH
T1F8010EE691E13FC7CE1111B4AA82E00C3337D9607D04DA0B60A0E13C8DEBBA536A01DD
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 fb42251f066e60034b3a62eb0c3da0e732ad0c360d9cc7ff689ccf03a25417c5
MD5 e503adb81267f661ed1fbf850d4ce0bd
SHA1 0610010d0ffba1de788a395d9e77e7dd008995e9
SHA512 f74f488767215007ffb67245df01b126dbb2e21e037d83696712fce87cae870f898f4c7ca0d87d3b7d9189bce68e9655b58e8034230309bda24f1b5dc798c235
SSDEEP 48:KoRIdKSgoXydzIJKIo84v8zf5VBkRVGPIGHkKrBThk3/0Mm5/5yh6IPKLiwZ:KoR2KSgK2z6KIo7MwK16+C68KLie
TLSH
T18EB10F51B77A26002C7E651D82A0C52FA6423473345AA63B3BFC15F61E6AE410FFCACD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

744f6f47-4b3c-4e48-85d7-fe303e00df02.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\744f6f47-4b3c-4e48-85d7-fe303e00df02.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a8fa42ef5000d6ba53b3efa68dcd51628ddb6de6b03255a16fd0163cffefd372
MD5 660beaaaa16291f6329a67878c20e1eb
SHA1 1f68b9b875631a0cbaeab0a9a9760ab3f6a9b687
SHA512 9553eaecf81115764130f6fc2f5b2d47400cf95e3bcc69f4920b583c5f5f6dd0b0f1f5367948185d15e9853265fc4e8e97f18514eed87ce83b38eb3c64ebbdf9
SSDEEP 768:WjaeqD4MlshiLdMm43Qxkj+dU5BwT7VWs+DoLSpG0/TIo54Y0qTK:WqcjhIdMf3sFVmoTiTm/n
TLSH
T14A03AE76B8A89C779CB6C7C5760765832FB00213C6C93F98D9DD7A0E06972DE130782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 86f3d51c05e9ff65ce8e96df57ed6a9b23bee642657e6db1c48a47235d3d2809
MD5 a650ae6cd7ae51611b7d861a20d36bac
SHA1 cdf27aebf9c946a775d994b4d0c70ef0ef5b6143
SHA512 8a5a24e2c4e912f542c7b231b32cdc27f9ec92b4cbef3956e9844b125baa136333d8f9d80a24e631a734d0ea9d9148180ef96771778227415e09132aa90f35a4
SSDEEP 768:bFlj+913Swgo8kj+d25BwT7VWs+DoLSpG0/TIo5414BV:S913EzVmoTiTm1W
TLSH
T10403AE72A8A8DE7BACEACBC4B60B36432FF40353C5C96A94D6DD6A0D05871DD1347C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 92c00b09d5824b35ebf360835070125b4a799e64280766bd392394aab809b53e
MD5 a70db88af7468bd7434e7a2117010905
SHA1 7333bcfa0dc6b4b25b28209bbc38c0d3adcf9c26
SHA512 641dbca308930893e7b5defb316f6fe16ebfad9f4eb8fd31f018b81eaea7f48bb2c96f1222f2a0e6e14f0e8dd5b9b3f037e3a654f2d3b9d7e39ce91ed20ed26e
SSDEEP 768:Nj+9+3wukj+de5BwT7VWs+DoLSpG0/TIo5414BV:o9+3hbVmoTiTm1W
TLSH
T191F2AE71B8A8DD679CE6C7C4760B6A432FF44313C2C92A98C9DD7B0D09C769E134782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3d716b55dfc5da170fc371dcd5cd6b118efe314acdb6d3bca61f81fe4eb73320
MD5 4fcf4307ad703babe28b687ade7a26b8
SHA1 132d1bd85e24bb49b2d0b2744bc285c0f4b45c41
SHA512 95070b7e49437ace752d17c379bed578f37e1bcc5f0b66727d2961a99e5519df71d664e12ccfdc67b4d2f6c9ebb0a1604df32237a7b86b63bb592dea12f0ed5b
SSDEEP 768:gj+9Y338kj+de5BwT7VWs+DoLSpG0/TIo5414BV:f9Y36bVmoTiTm1W
TLSH
T103F2AE71B8A8DD679CE6C7C5760B7A432FF4431386C82A98C9DD7B0D09C769E134782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a9f5bc64-1f7c-42fe-8087-7eb6b75acba8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a9f5bc64-1f7c-42fe-8087-7eb6b75acba8.tmp
Size 39KB
SHA256 7b329ae0feabe973c87263f3b3751f36df6a8abda335255307cf8cb4313c52e7
MD5 afd511f6d9a031441a1f11ffcb448f0d
SHA1 44fc43c6f3d15d849c863d9d21b57b2aaa238f08
SHA512 39a79b409b953ac04c04286460a616aa6ec87a6d4195134a2a68008bf4dce5cbbf22217867a9e6ae9acee86670edfe70aa630cb711f60a53da9a83503bdd9561
SSDEEP 768:ojaeqD4MlshiLdMmp3jyCj+du5BwT7VWs+DoLSpG0/TIok4+ApXGFTX:oqcjhIdMC3mLVmoTiTZ+KXi
TLSH
T16A03BE76A8A89D739CB6C7C1760BB6432F744353C6C83BD8D9DD6A0D05972DE230382A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

994e9881-9be2-4820-99e6-2f6802cc1e36.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\994e9881-9be2-4820-99e6-2f6802cc1e36.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

MSSP7ES.DLL

Path C:\Users\Admin\AppData\Local\Temp\1781975293134\MSSP7ES.DLL
Size 951KB
SHA256 c9785a88675430619ba1be58f5ff2020169c29d6071e7c12b6932ca76d4db5f0
MD5 7172463a13aa62207cb95f07d4f48617
SHA1 7c1cee6b0fa79b8e3b7a8ee0605567a6a926d7b0
SHA512 c0d0c56b16ffd686eb1383440b44fc967d7ce356b3a76d115bd063144bd1420d894e7f463b48987b0dd5a471906802300f139a60d96e4cef1db108cdd7cd0e6d
SSDEEP 12288:kTyhMDcQsoQCkdCMs0lkeHXOkaLjt+7X+9HjmC/j5qPG7/s29xt:kTyhU7QClEz3OkaLjt+7X+F5tq69xt
TLSH
T102252619B66840B3E526D134C867CDB2E3B3B8425E74D30F2291D72E2F773525A2BB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MaxxAudioAPOShell64.dll

Path C:\Users\Admin\AppData\Local\Temp\1781975293134\MaxxAudioAPOShell64.dll
Size 2.8MB
SHA256 bedd17e54c115b9b8f1e24bf67f0cee9f54241a8517f0a89a423a3270f944aab
MD5 13e0809d26e8cc5b45bbe3c70c2aa77b
SHA1 b843add05c1fd0352addf15ed160cd009470eb2b
SHA512 05c29203b1901ecf648b17b717acad5f2f8ead556842b4b7b64ce744ddcfedb5cdc2368de00d5a559f62ea31e685cb6726dc86056c05163d96a3fe24b1a8a5d2
SSDEEP 49152:FqXYTeVah6IjzQ7r1DRaJsXS9sEIuTFci0rAsURHFBrFvDPR3w0Vc6:4RaJAEIQQAVV
TLSH
T180D57C197AA880E5D066C17CCA978A87F3B170910F76DBCF0694826E2F77BE1953E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ToolkitFlu.exe

Path C:\Users\Admin\AppData\Local\Temp\1781975293134\ToolkitFlu.exe
Size 1.2MB
SHA256 72a55283785d1760df04bb05cdd400d9503c861c0f60ec4bac6137cdaa93cbe3
MD5 4a6a3390e0e3294bedc0a9dcb2505bf9
SHA1 ede486e635a2dfed2d5f9d965f32a9cbd5470c3e
SHA512 5022d0fb0572d67d267f17262eaa6ef1d6cd41fae759d5e200920244b29614b9fc2670205cf62e554b9ac83fde53b39194543e3f25aedd14ce790212cdcc5daa
SSDEEP 12288:k8FlAgQbx/CbiJ/r3K6mdyNKVn1YplwkGt+RLc5YRJn47G5+:U9CbiJ/uTMQVnqpJGt/mLyG5
TLSH
T113455B5A7A6080E4F126C33AC57189A7F7B17C611BE193DB16A0B39A5F376E40D39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Temp\1781975293134\msvcp_win.dll
Size 633KB
SHA256 0eff6854937b09b7cfe5804893bb6ff395c23d8ed4eb6a46d35df58afd91fb9f
MD5 26474171122fd4c5780157889918f293
SHA1 b67d93d6114de546c30388475eed44960077bf92
SHA512 a9415c2c75110de2cc80b4658a6f7e0120be17508e602e810de294c1d65534be0d4096dafa4e115b2119340e3bd16fb3d784f8b531aab71fecb541a602fbd1b6
SSDEEP 12288:rJ1WMV57pDXuJVBEreNQEKZm+jWodEEVUb9Fo9:r957pDgEreNQEKZm+jWodEESb9Fc
TLSH
T159D419267B494AA0D152A3BD95C38702E7F1BC064731A3C342EBE26D1F677C56B3B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

queue.cfg

Path C:\Users\Admin\AppData\Local\Temp\1781975293134\queue.cfg
Size 4.4MB
SHA256 18056d4fe33dce649e79754548d9794440c770253ec392684b8379a5f8a0316a
MD5 c5f173ee659df7baf8b634a750fbe160
SHA1 0868b8c2f192c8efa5acc5f39ef53b1a0c18dcc6
SHA512 bfc2c7ff921412088661381efdb4e05aba0d0ed5fcb337663e0835e73d6a047eb3986bce671692c994261fda91876a502c7836d110333d010c4a1c4369832304
SSDEEP 98304:G8Y+GgCsJ5zNZ+6WEUvp4FBj642QyIGuWaQHZ7A:/HHJUvqFB6JQGI
TLSH
T13326338041898F3FE7FBC3B4F73D22453B0174725AFDA9508528FA895AB5DA2264DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

render.rc

Path C:\Users\Admin\AppData\Local\Temp\1781975293134\render.rc
Size 20KB
SHA256 23eeac88955b9ca5333df362174b85449a3d9a0b52189e6080290bab62ca196b
MD5 7ab80c03290ff4a0d0f28bf8eee73381
SHA1 65e7797d2abe39090a0bb2159fac8dc4fe628762
SHA512 fc9aafecbcad8c8f4f8c111f7d0cdad61d9be52634f29072c8c105d3a9c840eb52750b7491e3da429136c944a08bbfe7824dc8db293c8f10bbe76cc7df89cc05
SSDEEP 384:lnu+V/Q6RUkIr1/fU7r1LRtgYU3ix+XmcDX6iaQyAntNqewkIYmfSj3Ixf+1tk3K:NVZxS/fUd0YU3ixGm26iasnDqm8qYpqp
TLSH
T1F2A27CDEA19F0AE5FCA46D3F6288A013F210F4BBED4706C375CACC1A7A210B58524D67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\1781975293134\ucrtbase.dll
Size 1.1MB
SHA256 6b817ec9874cd110a0b17ae89422bbe3362e3eadce91a5e66729801f57758ec4
MD5 185420a98824f7718dc5d8197e2b3471
SHA1 f083dcb3dea4b7aab4a110431274f9f4970dbc60
SHA512 bc8cd1f08aba813475f6cc9290a99ab90071fc441373cb72dd35f4c497d8a0d565db28fc43765464e1d0dece052e6595ef2e93502ab3f715af05a38cbfe4aa88
SSDEEP 24576:uJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFB:QVGrT6SAk3eB
TLSH
T139359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bsDbsx.7z

Path C:\Users\Admin\AppData\Local\Temp\bsDbsx.7z
Size 19KB
SHA256 cda15b0378bee691dfc88978a436de5dec7b5e5b129b134527615cbc556cd17f
MD5 1f23eab41abf5b0727d70d17ccc96865
SHA1 a4f2dbb54e89ad83b4c8199e47878716cdbb6b39
SHA512 a0ae19e87d7db52376df5a5fb3a295b99d256912842490d28f37a680e25dec66f49bb55538fffdb6345abc373b294c003ec35cc9a9c6efd13b8b5cef9aaa52a6
SSDEEP 384:1CQvBYmwR8/3fk5bKpSh2HGzZdK2KMs9jmGp0gozFguH8m5/txDQrTkteDlB2327:o+w2ffGMG2Od9KMs9jmG0zmzm5clUi
TLSH
T1EE92D03F12D63E6D7C01D42308EB60E4A581CE1EDA6441AA7D8CD5C0CE356D4EABD8BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\flomo卡片笔记\Local State
Size 434B
SHA256 9e113fd9fd287c9c1474ce691b546e8edc24a42459a0775902912b7fefb0c709
MD5 81cd59249e5f06a7e9b99a7798452aca
SHA1 fe401fb24c5c26607f10d1569372f5b1c05674f5
SHA512 4cf28d3e44ba2fddfba6ea9dca8755c31dd63500b8d1ae27f5f04dd19a29d0249f842821f6d63758666fe76247b81b8bd44fac1da29aeca4df99bafaabe737a9
TLSH
T1EDE0ABB76C212BE8AA46922D870532055E7806AB4A99DE20756A27B9437B4A06206871
MD5 SHA1 SHA512 TLSH

Submit Download

setup.txt

Path C:\Users\Admin\AppData\Roaming\setup.txt
Size 8B
SHA256 4d20cd2df3eaeeb257ddeb8fde7926d10b6b88722c5a43a803e51fd6ab8ea93a
MD5 485af9798cc5b3e825c794830692cbd8
SHA1 defb3cebe70655926d3e5a543d78d78fe8e11ac0
SHA512 efb5af4fac16f698cb356550a0c3b78839a733b3e3d81828cd94f12e474dd0eb65c88c84010312ea3c479619df0aeebbc26315bbed62bfc1ef499cd8152cd5bc
MD5 SHA1 SHA512

Submit Download

D3DCompiler_47.dll

Path C:\Users\Admin\Desktop\D3DCompiler_47.dll
Size 4.7MB
SHA256 2e79c59f71594b59d63755e0a86aa1f13272846faa54519a1b4700fc9aa3b57c
MD5 1e416e9d403559429238cf69d8867d5d
SHA1 defdb91b8cd75dbef1c059d067a1c6ff1b2c91f4
SHA512 16c88fc64dc46db4e72b1ad566a1fcdaccaa5ddbbe72e25c3cdb902c17d9602ca2d2522b2ac2c7445f8ee6495e681b6a54e0844e290d20eadc7cdf6bf0f87557
SSDEEP 49152:0CZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRNZ:TG2QCwmHjnog/pzHAo/Ay
TLSH
T15A367C5673E640B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\Desktop\chrome_100_percent.pak
Size 143KB
SHA256 34353e0c595236b0e3d256618aa31afe270d6238ee3c251ab8e294203a7e34c5
MD5 4c51169d4633ad96f8ddbf39537c5d1b
SHA1 1abbc66e254960fb3013df03b28a56eefb986dde
SHA512 844147962bfe3282a9abe786775d9604f1e04bbaf36300700de0e4c9aeb4e007999e6024189f9ae95bd834a93c137d5bc26b911c51db4864719c3bc93251d2a0
SSDEEP 3072:Yz8gCGIQRTw1CLjQBHUP1L2o418Gb0+VRLf0ld0GY3cQ3ERVh2I:Yz86I2ThjQB05K18Gb0OV8ld0GecQ3Er
TLSH
T1DFE3D1E7B3F0EE7DCB9756F752164071EDB346290691024B464AE8762A36788CCD87C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\Desktop\chrome_200_percent.pak
Size 212KB
SHA256 ff54bda9cb24c2ce5825ec8d5c5b3217c2738b43c2882bc3d63638250dee37bf
MD5 e1949c364853c5a3a5499eba16fc1a6b
SHA1 c72c097a54c864eb0474938ea2446d06188860db
SHA512 381e3b634615903f07d5f24378fcac9778bf2d27a2c1c81ce721300672053c9baedacd4740b89423bbdbbb6d30c76a79bfdccd36d0b170079123993c65d4cfc6
SSDEEP 6144:dDQYasN6svyAEW7cyjQB0ugx5GMRejnbdZnVE6Yoppx4:yfsN6svyA1tjK0a6edhVELoXx4
TLSH
T15524F1D7B3B49D7DC9670AB3521601F1FCF215395AB6420F068FAC357A66BC988C9283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\Desktop\icudtl.dat
Size 10.0MB
SHA256 a9f6072e858ea29cb66501847856d403c862f23d03cac2656d1e0fa2865fdc7b
MD5 ba9e45bfca3621e4086e6a1870f8cc41
SHA1 8d1b2d42707812608907f8000041c16e7755532a
SHA512 07ac486039098753d77b53ce0638a172c583620d6feae0447da9b8931fe9e0f8b108ca7c8282b6596bdcfb252b3600bdfe7cb01c96b3564605084a932dc7298b
SSDEEP 196608:fwPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2YEs:fswkpHiXUxY/iJ53IWhlVjEeIHs
TLSH
T199B63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\Desktop\libEGL.dll
Size 492KB
SHA256 0b739a65ca84923639657f9d8bb646d00e07bcc732a9eaa22ed809f740185485
MD5 7a0df9d8a7c45e17469a1639021a161c
SHA1 ac719a2769188820eacb1fb09b398bdd041f472d
SHA512 77861b0e579232ff31db6dbdf98af447299dac0e6c653a096c21e9d7b0bb590ab004ded780669f5afae7856955ed7dfeed9c5e385784fd34d22148f3282e7db0
SSDEEP 6144:3Krfdptu9AvnJUCu536qq6Z64Vc+ALNwYyn23cCVK:a7dpvnS506Z64VcJFg2MCVK
TLSH
T12FB48D15B3D848A9E06AD1748A474643DB7678860B65FADF03E093792F37BF46B3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Users\Admin\Desktop\libglesv2.dll
Size 7.6MB
SHA256 1331f4c6909dbf154e54510dd368fb01011e88086aed310cf3ed172ec91595c2
MD5 1999a8987f906dff4f9950027cb48542
SHA1 bff437c5573fcc73798c92998edb3ccb1191d1ee
SHA512 89fede89eeb0432f59a02afd16327aeddfa1dc5d5436ab22cf75849be96962021c2d2281b1874ff801deb0b57141d9746a20d9971cc759df8a855c5f4070b201
SSDEEP 98304:zaeBlw64Uag0hVPrTg0gQo1JiYIjGJXKt7q:WeBlfwCoqw2
TLSH
T166867B03F39940DAC04DE2B8D7579626FA35B8850734B6CF269407292F67BE0EB7A714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\Desktop\locales\en-US.pak
Size 499KB
SHA256 2a2ebefac8c3569580434729ffd71598cf05ea36447b62a64d6f8aa26dac88e5
MD5 ced4e7989442a389cbe97280217cef61
SHA1 ad6bfd4c719183bbdc7f070086a8d9fd8885ad76
SHA512 cf87a9f955646c88644a9815d1626f8f69e75180d6f3103a4af47d00172a6e473389980dbc322c82c0e00e1eacaf546106fdd7b7291cd7c01cbd1441d153afd0
SSDEEP 6144:qCCHh5sdyMuTsSBNMP9e+Qtt3faY7jsyo0X5v+juangH8/gFwB:qCCHAAM4NMvQtte+5GjIwB
TLSH
T144B44C1FF7441229069352A27F0995B2FF36D06CA35112563CBD812C33B7B6A83B76E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

readme.txt

Path C:\Users\Admin\Desktop\readme.txt
Size 9B
SHA256 050b3d8b668808e967b824d31ed760aafed98af58dc1a6b145842081ea4fc9d5
MD5 f5e085ee6b5e92c52d46d5a1acae7107
SHA1 07116bb3f3011065aacb2f95f2e8d02ba1994fb3
SHA512 8acd5fbe17531a40b4a4d5347ac9f70294b54234f782d916bb462d8f27ae681ec5329618dc5ff11a82482712fe158403ead7a2c071c3713c56c3fd41a5f655dd
MD5 SHA1 SHA512

Submit Download

resources.pak

Path C:\Users\Admin\Desktop\resources.pak
Size 5.8MB
SHA256 d1d9992e4e28a3a6add0a2652194685cae481a3ba846a89a030199a5d0bdc04f
MD5 285e571e01bfa2c1bb1ff8167247e37b
SHA1 20f26d3213cebd7cb0d397d662b784729f10387d
SHA512 f7cfbe6220db5620451e55b441c9b1194c9779d4ffb1c724279f2492bcdbd8d02c7b098901ae7c1e225b1c860f6af3301155cfefff1fbe0ba229e0ac5b381390
SSDEEP 98304:sn8Xa8NPOXD1VsZRwwQLIMPXjNbrjrwrw5TJB2zfQzQz8oaUUQz8hB0Pxtq+GrVd:PKmWXD1/wQZbnkrw7MfQQQFPc8X03VGL
TLSH
T19A5633B27B46089FF51C83BD00AAC2B1426CE9266554616F11CD7220BE36A2FDFD587F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\Desktop\resources\app.asar
Size 40.4MB
SHA256 7a534b6f952b592b65863cc37d134090dcd5dc77e778521494794ab280325469
MD5 372f3484edd0ee079b07a4e245fa639f
SHA1 51e6cd2647cb69e9b6554d4c6f33165f3f256a2e
SHA512 a6305ea2652384a9c1dc6858b57b4099a6d3ca66fb72a7d7ff8c101b4cd40b2242b30c00c7844ac6a48e5b4c874bc0f923e7e9a82089ffc8b80fdb5453576bac
SSDEEP 786432:DN2DTvUsvvd+xyMp6plTmvsVBwlDsK9rX9:D+7Usd+Gpliv46sCrX9
TLSH
T18997DF53B3812B79F68901F0402B2407A2F9D8263455459AF7FE99EB3E399C435F6B38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\Desktop\v8_context_snapshot.bin
Size 695KB
SHA256 6370b1fba2ff33f9f279e9d308450bc8e06987bc6c0647d926ce70e8b5e76dd4
MD5 7a10a1a95219111303de82baff73f491
SHA1 5d8135015d40ee6a0fe7385fb5931ede67ece742
SHA512 6d7a0d67d7c634b9ab19b337bd24980c4a78248290d38b5af56805a5c2494a8af05d8035f170a4c593639a8c11e7374289ae1989f05eaded8a379440e004dcc7
SSDEEP 6144:Cc1tbR7t+y3pwdZOXk/V2uL/xlTGOEy+aG2g9iOaybaO:d1t8gk/V5xNGeGNOybaO
TLSH
T14AE49496F70EDF27CBCC45B5DEF59A473CB4F08EAF8B811B210817BD6035A680A25259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\Desktop\vk_swiftshader.dll
Size 5.3MB
SHA256 fa5aedd749117ec4c68727c83ff138aa51c8ad984092c7b1f3b06c88f0fe6114
MD5 961cb27b5ecf8bc10b407b860fc2c0cd
SHA1 6fa02032fe5ea147de668ec9cadf26bfbb044e19
SHA512 0efb58ddd1af863b17a1da472c98e6a1242032344bf500bbc8466a4e5f052f119a3df3eaea25750a946eab615b57b1c6982abb7bf2c751c73b8bb8044b9c51b8
SSDEEP 49152:REhLYagK1ubn6vRClpqPO/NeitQj6LSnYClUmJY3I8fhtWgq12bGlQZ4jOQUPVdk:R+LDgKwtk2kJe4V
TLSH
T1B8463903F28680E9F05DD679875BA622F671BC811B62B6DF52A01F192E37FE06739701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\Desktop\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\Desktop\vulkan-1.dll
Size 897KB
SHA256 e85e73e823fafee6998106da4d4e1504cd9f2eb8d1cc8bf4d8b69d5b1e6da35a
MD5 7dba0ae8c0b862d699d458bbd1d300d9
SHA1 06f4a4897dc549894ef55bd330995cb1277c3882
SHA512 d4b9c7ce82309b3f04a708134d93a0098b5d74869105fdaf3b01d5253af2ee2693e73cfd005d929a7641e780964a8ac1a321774c59e38c91c49ca189f742a7b8
SSDEEP 24576:xIaCHa0jpNtRZLAXb2F8Kx6Z5WSDYsHS6g3P0zAk7m7kMVt:ua+/jpDRdAXE16Z5WSDYsHS6g3P0zAkA
TLSH
T142155B22E6948969D47AD034C9C28707C9B174922326B9CF02A81714BF6FFF47B7DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2616-537-0x0000000001100000-0x00000000014C5000-memory.dmp

Download

memory/2616-810-0x0000000001100000-0x00000000014C5000-memory.dmp

Download

memory/2616-521-0x0000000001100000-0x00000000014C5000-memory.dmp

Download

memory/2616-834-0x0000000001100000-0x00000000014C5000-memory.dmp

Download

memory/2616-833-0x0000000001100000-0x00000000014C5000-memory.dmp

Download

memory/2616-610-0x0000000001100000-0x00000000014C5000-memory.dmp

Download

memory/2616-821-0x0000000001100000-0x00000000014C5000-memory.dmp

Download

memory/2616-776-0x0000000001100000-0x00000000014C5000-memory.dmp

Download

memory/2616-522-0x0000000001100000-0x00000000014C5000-memory.dmp

Download

memory/2616-762-0x0000000001100000-0x00000000014C5000-memory.dmp

Download

memory/2616-524-0x00007FF8ED580000-0x00007FF8ED7E3000-memory.dmp

Download

memory/2616-525-0x0000000001100000-0x00000000014C5000-memory.dmp

Download

memory/2616-732-0x0000000001100000-0x00000000014C5000-memory.dmp

Download

memory/2616-711-0x0000000001100000-0x00000000014C5000-memory.dmp

Download

memory/2616-717-0x0000000001100000-0x00000000014C5000-memory.dmp

Download

memory/5016-479-0x000001D500700000-0x000001D500701000-memory.dmp

Download

memory/5016-482-0x000001D500700000-0x000001D500701000-memory.dmp

Download

memory/5016-471-0x000001D500700000-0x000001D500701000-memory.dmp

Download

memory/5016-477-0x000001D500700000-0x000001D500701000-memory.dmp

Download

memory/5016-480-0x000001D500700000-0x000001D500701000-memory.dmp

Download

memory/5016-481-0x000001D500700000-0x000001D500701000-memory.dmp

Download

memory/5016-473-0x000001D500700000-0x000001D500701000-memory.dmp

Download

memory/5016-478-0x000001D500700000-0x000001D500701000-memory.dmp

Download

memory/5060-458-0x00007FF8C5030000-0x00007FF8C5093000-memory.dmp

Download

memory/5060-534-0x00007FF7B07E0000-0x00007FF7B0917000-memory.dmp

Download

memory/5060-519-0x00007FF8C5030000-0x00007FF8C5093000-memory.dmp

Download

memory/5060-456-0x00007FF8C5030000-0x00007FF8C5093000-memory.dmp

Download

memory/5472-445-0x00007FF8E4D80000-0x00007FF8E4DE3000-memory.dmp

Download

memory/6816-712-0x0000000074430000-0x0000000074482000-memory.dmp

Download

memory/6816-709-0x00007FF8ED580000-0x00007FF8ED7E3000-memory.dmp

Download