90bbf3e2606e26fb9207724e86916e30eb3a691b8738c932646e773e6af5260c

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 03:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FlewHaul-Setup.exe
Size 11.6MB
Sample260828-dnmpbaswbz
SHA256 90bbf3e2606e26fb9207724e86916e30eb3a691b8738c932646e773e6af5260c
MD5 ac0aeefcc82337bd56e12ee1c9b2af5e
SHA1 fa1959126a209a56c9f0e3a7bc7201de232bf778
SHA512 6af751ff1828747ce578521d9b6b1fd09b95286a3ed346996c98aeb3b1fc82dc91a27ae495df4ceeb1e2006bf77068282402976a8b25119d64d53ddea6085115
SSDEEP 196608:jDXkwklwodqQcsDg10Tm+EI7NIW/QSXlQQe50CBS6NdgrouaYYKZrPOSVf:jDNb7z0Tm+EIvVXFevAbdrPO+
TLSH
T135C6233FB28B653EF02E1A3A7672A610943F7A61A5174C569AE4C84CCF150B11D3FB87
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution installer persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
5676	FlewHaul-Setup.tmp
2404	FlewHaul.exe
5380	FlewHaul_engine.exe
4724	FlewHaul.exe

Loads dropped DLL 20 IoCs

pid	Process
2404	FlewHaul.exe
2404	FlewHaul.exe
2404	FlewHaul.exe
2404	FlewHaul.exe
2404	FlewHaul.exe
2404	FlewHaul.exe
2404	FlewHaul.exe
2404	FlewHaul.exe
2404	FlewHaul.exe
2404	FlewHaul.exe
2404	FlewHaul.exe
5380	FlewHaul_engine.exe
4724	FlewHaul.exe
4724	FlewHaul.exe
4724	FlewHaul.exe
4724	FlewHaul.exe
4724	FlewHaul.exe
4724	FlewHaul.exe
4724	FlewHaul.exe
4724	FlewHaul.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FlewHaul = "\"C:\\Program Files\\FlewHaul\\FlewHaul.exe\""	FlewHaul-Setup.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Discovers running processes 1 TTPs 64 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5932	tasklist.exe
716	tasklist.exe
3048	tasklist.exe
3900	tasklist.exe
984	tasklist.exe
5704	tasklist.exe
3316	tasklist.exe
3332	tasklist.exe
2280	tasklist.exe
2820	tasklist.exe
2804	tasklist.exe
3408	tasklist.exe
5732	tasklist.exe
632	tasklist.exe
1720	tasklist.exe
5984	tasklist.exe
3416	tasklist.exe
4120	tasklist.exe
4996	tasklist.exe
2580	tasklist.exe
6056	tasklist.exe
2672	tasklist.exe
2516	tasklist.exe
3256	tasklist.exe
4204	tasklist.exe
4412	tasklist.exe
4208	tasklist.exe
5388	tasklist.exe
2276	tasklist.exe
3356	tasklist.exe
3516	tasklist.exe
1932	tasklist.exe
1380	tasklist.exe
1636	tasklist.exe
4364	tasklist.exe
3732	tasklist.exe
1484	tasklist.exe
2984	tasklist.exe
5336	tasklist.exe
3752	tasklist.exe
468	tasklist.exe
3880	tasklist.exe
5212	tasklist.exe
6100	tasklist.exe
4696	tasklist.exe
4720	tasklist.exe
4568	tasklist.exe
4712	tasklist.exe
4216	tasklist.exe
4364	tasklist.exe
1380	tasklist.exe
1852	tasklist.exe
1328	tasklist.exe
3332	tasklist.exe
3020	tasklist.exe
3980	tasklist.exe
4400	tasklist.exe
2424	tasklist.exe
1172	tasklist.exe
1636	tasklist.exe
3528	tasklist.exe
3160	tasklist.exe
3032	tasklist.exe
4416	tasklist.exe

Drops file in Program Files directory 49 IoCs

description	ioc	Process
File created	C:\Program Files\FlewHaul\is-DYXHWWHZYO.tmp	FlewHaul-Setup.tmp
File created	C:\Program Files\FlewHaul\is-J0WNDSQMZ5.tmp	FlewHaul-Setup.tmp
File created	C:\Program Files\FlewHaul\data\is-FRNGORF8OR.tmp	FlewHaul-Setup.tmp
File created	C:\Program Files\FlewHaul\data\flutter_assets\is-TZDYPME8GU.tmp	FlewHaul-Setup.tmp
File created	C:\Program Files\FlewHaul\is-0GZS322CIY.tmp	FlewHaul-Setup.tmp
File opened for modification	C:\Program Files\FlewHaul\concrt140.dll	FlewHaul-Setup.tmp
File created	C:\Program Files\FlewHaul\is-5T4BSNB1VB.tmp	FlewHaul-Setup.tmp
File created	C:\Program Files\FlewHaul\data\is-OV63CEP37P.tmp	FlewHaul-Setup.tmp
File created	C:\Program Files\FlewHaul\is-0C280SULD6.tmp	FlewHaul-Setup.tmp
File created	C:\Program Files\FlewHaul\is-349XHFDWJI.tmp	FlewHaul-Setup.tmp
File opened for modification	C:\Program Files\FlewHaul\FlewHaul.exe	FlewHaul-Setup.tmp
File opened for modification	C:\Program Files\FlewHaul\vcruntime140.dll	FlewHaul-Setup.tmp
File created	C:\Program Files\FlewHaul\unins000.dat	FlewHaul-Setup.tmp
File created	C:\Program Files\FlewHaul\is-YZ1TMIID0B.tmp	FlewHaul-Setup.tmp
File created	C:\Program Files\FlewHaul\is-E2NM97YT5M.tmp	FlewHaul-Setup.tmp
File created	C:\Program Files\FlewHaul\is-95VGGB5Q2O.tmp	FlewHaul-Setup.tmp
File opened for modification	C:\Program Files\FlewHaul\window_manager_plugin.dll	FlewHaul-Setup.tmp
File created	C:\Program Files\FlewHaul\is-MVZDJWWZ8K.tmp	FlewHaul-Setup.tmp
File created	C:\Program Files\FlewHaul\data\flutter_assets\is-D0OXHAKV4Z.tmp	FlewHaul-Setup.tmp
File created	C:\Program Files\FlewHaul\data\flutter_assets\is-OS2F1PWR95.tmp	FlewHaul-Setup.tmp
File created	C:\Program Files\FlewHaul\data\flutter_assets\packages\cupertino_icons\assets\is-S0LE9QGPWR.tmp	FlewHaul-Setup.tmp
File created	C:\Program Files\FlewHaul\data\flutter_assets\shaders\is-S1H8MFPANI.tmp	FlewHaul-Setup.tmp
File opened for modification	C:\Program Files\FlewHaul\vcruntime140_1.dll	FlewHaul-Setup.tmp
File created	C:\Program Files\FlewHaul\is-U958YK8SC0.tmp	FlewHaul-Setup.tmp
File created	C:\Program Files\FlewHaul\is-M6NDEXG2SB.tmp	FlewHaul-Setup.tmp
File created	C:\Program Files\FlewHaul\is-PP8SP0CQ61.tmp	FlewHaul-Setup.tmp
File created	C:\Program Files\FlewHaul\data\flutter_assets\assets\is-LJRLRTQD75.tmp	FlewHaul-Setup.tmp
File created	C:\Program Files\FlewHaul\data\flutter_assets\assets\is-KXMN06IGIK.tmp	FlewHaul-Setup.tmp
File created	C:\Program Files\FlewHaul\data\flutter_assets\fonts\is-G9DNL619VR.tmp	FlewHaul-Setup.tmp
File created	C:\Program Files\FlewHaul\is-TP7BWTRONS.tmp	FlewHaul-Setup.tmp
File opened for modification	C:\Program Files\FlewHaul\msvcp140_1.dll	FlewHaul-Setup.tmp
File opened for modification	C:\Program Files\FlewHaul\screen_retriever_windows_plugin.dll	FlewHaul-Setup.tmp
File created	C:\Program Files\FlewHaul\is-5R1RWMIGG5.tmp	FlewHaul-Setup.tmp
File created	C:\Program Files\FlewHaul\is-S5H8N8SQT6.tmp	FlewHaul-Setup.tmp
File created	C:\Program Files\FlewHaul\data\flutter_assets\is-Y0RXB5WWQ6.tmp	FlewHaul-Setup.tmp
File opened for modification	C:\Program Files\FlewHaul\msvcp140_2.dll	FlewHaul-Setup.tmp
File opened for modification	C:\Program Files\FlewHaul\msvcp140.dll	FlewHaul-Setup.tmp
File opened for modification	C:\Program Files\FlewHaul\vccorlib140.dll	FlewHaul-Setup.tmp
File created	C:\Program Files\FlewHaul\is-ERP1WTCXVC.tmp	FlewHaul-Setup.tmp
File opened for modification	C:\Program Files\FlewHaul\unins000.dat	FlewHaul-Setup.tmp
File opened for modification	C:\Program Files\FlewHaul\FlewHaul_engine.exe	FlewHaul-Setup.tmp
File opened for modification	C:\Program Files\FlewHaul\flutter_windows.dll	FlewHaul-Setup.tmp
File opened for modification	C:\Program Files\FlewHaul\local_notifier_plugin.dll	FlewHaul-Setup.tmp
File created	C:\Program Files\FlewHaul\is-PIZJN3TA8V.tmp	FlewHaul-Setup.tmp
File created	C:\Program Files\FlewHaul\is-J54687HXWW.tmp	FlewHaul-Setup.tmp
File created	C:\Program Files\FlewHaul\is-WNFRD7UMWR.tmp	FlewHaul-Setup.tmp
File created	C:\Program Files\FlewHaul\is-GT5YG9T7NC.tmp	FlewHaul-Setup.tmp
File created	C:\Program Files\FlewHaul\data\flutter_assets\shaders\is-QAM6NEWSSI.tmp	FlewHaul-Setup.tmp
File opened for modification	C:\Program Files\FlewHaul\tray_manager_plugin.dll	FlewHaul-Setup.tmp

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2492	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FlewHaul-Setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FlewHaul-Setup.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/1356-0-0x0000000000D40000-0x0000000000E1E000-memory.dmp	innosetup
behavioral2/memory/1356-8-0x0000000000D40000-0x0000000000E1E000-memory.dmp	innosetup
behavioral2/memory/1356-163-0x0000000000D40000-0x0000000000E1E000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	FlewHaul_engine.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	FlewHaul_engine.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
4608	reg.exe
2532	reg.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
5676	FlewHaul-Setup.tmp
5676	FlewHaul-Setup.tmp
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
5380	FlewHaul_engine.exe
5380	FlewHaul_engine.exe
5380	FlewHaul_engine.exe
5380	FlewHaul_engine.exe
5380	FlewHaul_engine.exe
5380	FlewHaul_engine.exe
5380	FlewHaul_engine.exe
5380	FlewHaul_engine.exe
5380	FlewHaul_engine.exe
5380	FlewHaul_engine.exe
5380	FlewHaul_engine.exe
5380	FlewHaul_engine.exe
5380	FlewHaul_engine.exe
5380	FlewHaul_engine.exe
5380	FlewHaul_engine.exe
5380	FlewHaul_engine.exe
5380	FlewHaul_engine.exe
5380	FlewHaul_engine.exe
5380	FlewHaul_engine.exe
5380	FlewHaul_engine.exe
5380	FlewHaul_engine.exe
5380	FlewHaul_engine.exe
5380	FlewHaul_engine.exe
5380	FlewHaul_engine.exe
5380	FlewHaul_engine.exe
5380	FlewHaul_engine.exe
5380	FlewHaul_engine.exe
5380	FlewHaul_engine.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5380	FlewHaul_engine.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5440	tasklist.exe
Token: SeDebugPrivilege	4268	tasklist.exe
Token: SeDebugPrivilege	1720	tasklist.exe
Token: SeDebugPrivilege	2492	powershell.exe
Token: SeDebugPrivilege	1904	tasklist.exe
Token: SeDebugPrivilege	1104	tasklist.exe
Token: SeDebugPrivilege	2672	tasklist.exe
Token: SeDebugPrivilege	632	tasklist.exe
Token: SeDebugPrivilege	1484	tasklist.exe
Token: SeDebugPrivilege	4208	tasklist.exe
Token: SeDebugPrivilege	5932	tasklist.exe
Token: SeDebugPrivilege	2280	tasklist.exe
Token: SeDebugPrivilege	4568	tasklist.exe
Token: SeDebugPrivilege	4712	tasklist.exe
Token: SeDebugPrivilege	1660	tasklist.exe
Token: SeDebugPrivilege	716	tasklist.exe
Token: SeDebugPrivilege	2516	tasklist.exe
Token: SeDebugPrivilege	5388	tasklist.exe
Token: SeDebugPrivilege	4352	tasklist.exe
Token: SeDebugPrivilege	5984	tasklist.exe
Token: SeDebugPrivilege	5776	tasklist.exe
Token: SeDebugPrivilege	3268	tasklist.exe
Token: SeDebugPrivilege	3160	tasklist.exe
Token: SeDebugPrivilege	3048	tasklist.exe
Token: SeDebugPrivilege	2804	tasklist.exe
Token: SeDebugPrivilege	2984	tasklist.exe
Token: SeDebugPrivilege	5728	tasklist.exe
Token: SeDebugPrivilege	940	tasklist.exe
Token: SeDebugPrivilege	1636	tasklist.exe
Token: SeDebugPrivilege	1036	tasklist.exe
Token: SeDebugPrivilege	3528	tasklist.exe
Token: SeDebugPrivilege	3416	tasklist.exe
Token: SeDebugPrivilege	3332	tasklist.exe
Token: SeDebugPrivilege	4996	tasklist.exe
Token: SeDebugPrivilege	6100	tasklist.exe
Token: SeDebugPrivilege	3256	tasklist.exe
Token: SeDebugPrivilege	3032	tasklist.exe
Token: SeDebugPrivilege	4120	tasklist.exe
Token: SeDebugPrivilege	2984	tasklist.exe
Token: SeDebugPrivilege	5336	tasklist.exe
Token: SeDebugPrivilege	940	tasklist.exe
Token: SeDebugPrivilege	4372	tasklist.exe
Token: SeDebugPrivilege	4216	tasklist.exe
Token: SeDebugPrivilege	4624	tasklist.exe
Token: SeDebugPrivilege	4464	tasklist.exe
Token: SeDebugPrivilege	480	tasklist.exe
Token: SeDebugPrivilege	4364	tasklist.exe
Token: SeDebugPrivilege	4416	tasklist.exe
Token: SeDebugPrivilege	2580	tasklist.exe
Token: SeDebugPrivilege	3576	tasklist.exe
Token: SeDebugPrivilege	1380	tasklist.exe
Token: SeDebugPrivilege	1932	tasklist.exe
Token: SeDebugPrivilege	2276	tasklist.exe
Token: SeDebugPrivilege	1076	tasklist.exe
Token: SeDebugPrivilege	2424	tasklist.exe
Token: SeDebugPrivilege	3900	tasklist.exe
Token: SeDebugPrivilege	3020	tasklist.exe
Token: SeDebugPrivilege	5596	tasklist.exe
Token: SeDebugPrivilege	5604	tasklist.exe
Token: SeDebugPrivilege	5704	tasklist.exe
Token: SeDebugPrivilege	124	tasklist.exe
Token: SeDebugPrivilege	4996	tasklist.exe
Token: SeDebugPrivilege	1540	tasklist.exe
Token: SeDebugPrivilege	2580	tasklist.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
5676	FlewHaul-Setup.tmp
2404	FlewHaul.exe
2404	FlewHaul.exe
4724	FlewHaul.exe
4724	FlewHaul.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2404	FlewHaul.exe
2404	FlewHaul.exe
4724	FlewHaul.exe
4724	FlewHaul.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2404	FlewHaul.exe
2404	FlewHaul.exe
4724	FlewHaul.exe
4724	FlewHaul.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 5676	1356	FlewHaul-Setup.exe	89
PID 2404 wrote to memory of 4608	2404	FlewHaul.exe	93
PID 2404 wrote to memory of 5440	2404	FlewHaul.exe	94
PID 2404 wrote to memory of 4268	2404	FlewHaul.exe	95
PID 2404 wrote to memory of 1720	2404	FlewHaul.exe	100
PID 2404 wrote to memory of 1220	2404	FlewHaul.exe	102
PID 2404 wrote to memory of 2492	2404	FlewHaul.exe	104
PID 2404 wrote to memory of 5380	2404	FlewHaul.exe	107
PID 5676 wrote to memory of 4724	5676	FlewHaul-Setup.tmp	108
PID 2404 wrote to memory of 1904	2404	FlewHaul.exe	109
PID 2404 wrote to memory of 1104	2404	FlewHaul.exe	111
PID 2404 wrote to memory of 3028	2404	FlewHaul.exe	113
PID 4724 wrote to memory of 2532	4724	FlewHaul.exe	115
PID 4724 wrote to memory of 632	4724	FlewHaul.exe	116
PID 4724 wrote to memory of 2672	4724	FlewHaul.exe	117
PID 4724 wrote to memory of 264	4724	FlewHaul.exe	121
PID 2404 wrote to memory of 1484	2404	FlewHaul.exe	123
PID 2404 wrote to memory of 4416	2404	FlewHaul.exe	125
PID 4724 wrote to memory of 4208	4724	FlewHaul.exe	127
PID 4724 wrote to memory of 5176	4724	FlewHaul.exe	129
PID 2404 wrote to memory of 5932	2404	FlewHaul.exe	131
PID 2404 wrote to memory of 3756	2404	FlewHaul.exe	133
PID 4724 wrote to memory of 2280	4724	FlewHaul.exe	135
PID 4724 wrote to memory of 3620	4724	FlewHaul.exe	137
PID 2404 wrote to memory of 4568	2404	FlewHaul.exe	139
PID 2404 wrote to memory of 2328	2404	FlewHaul.exe	141
PID 4724 wrote to memory of 4712	4724	FlewHaul.exe	143
PID 4724 wrote to memory of 5144	4724	FlewHaul.exe	145
PID 2404 wrote to memory of 1660	2404	FlewHaul.exe	147
PID 2404 wrote to memory of 4672	2404	FlewHaul.exe	149
PID 4724 wrote to memory of 716	4724	FlewHaul.exe	151
PID 4724 wrote to memory of 2964	4724	FlewHaul.exe	153
PID 2404 wrote to memory of 2516	2404	FlewHaul.exe	155
PID 2404 wrote to memory of 6116	2404	FlewHaul.exe	157
PID 4724 wrote to memory of 5388	4724	FlewHaul.exe	159
PID 4724 wrote to memory of 988	4724	FlewHaul.exe	161
PID 2404 wrote to memory of 4352	2404	FlewHaul.exe	163
PID 2404 wrote to memory of 1852	2404	FlewHaul.exe	165
PID 4724 wrote to memory of 5984	4724	FlewHaul.exe	167
PID 4724 wrote to memory of 1160	4724	FlewHaul.exe	169
PID 2404 wrote to memory of 5776	2404	FlewHaul.exe	171
PID 2404 wrote to memory of 3372	2404	FlewHaul.exe	173
PID 4724 wrote to memory of 3268	4724	FlewHaul.exe	175
PID 4724 wrote to memory of 3512	4724	FlewHaul.exe	177
PID 2404 wrote to memory of 3160	2404	FlewHaul.exe	179
PID 2404 wrote to memory of 3576	2404	FlewHaul.exe	181
PID 4724 wrote to memory of 3048	4724	FlewHaul.exe	183
PID 4724 wrote to memory of 3468	4724	FlewHaul.exe	185
PID 2404 wrote to memory of 2804	2404	FlewHaul.exe	187
PID 2404 wrote to memory of 2280	2404	FlewHaul.exe	189
PID 4724 wrote to memory of 2984	4724	FlewHaul.exe	191
PID 4724 wrote to memory of 3220	4724	FlewHaul.exe	193
PID 2404 wrote to memory of 5728	2404	FlewHaul.exe	195
PID 2404 wrote to memory of 2676	2404	FlewHaul.exe	197
PID 4724 wrote to memory of 940	4724	FlewHaul.exe	199
PID 4724 wrote to memory of 1880	4724	FlewHaul.exe	201
PID 2404 wrote to memory of 1636	2404	FlewHaul.exe	203
PID 2404 wrote to memory of 3956	2404	FlewHaul.exe	205
PID 4724 wrote to memory of 1036	4724	FlewHaul.exe	207
PID 4724 wrote to memory of 3260	4724	FlewHaul.exe	209
PID 2404 wrote to memory of 3528	2404	FlewHaul.exe	211
PID 2404 wrote to memory of 1104	2404	FlewHaul.exe	213
PID 4724 wrote to memory of 3416	4724	FlewHaul.exe	215
PID 4724 wrote to memory of 3312	4724	FlewHaul.exe	217

C:\Users\Admin\AppData\Local\Temp\FlewHaul-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\FlewHaul-Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Users\Admin\AppData\Local\Temp\is-4LQBURPZZ6.tmp\FlewHaul-Setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-4LQBURPZZ6.tmp\FlewHaul-Setup.tmp" /SL5="$4011A,10969583,849408,C:\Users\Admin\AppData\Local\Temp\FlewHaul-Setup.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5676
- - C:\Program Files\FlewHaul\FlewHaul.exe
    "C:\Program Files\FlewHaul\FlewHaul.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4724
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v FlewHaul
      4⤵
      Modifies registry key
      PID:2532
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:632
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2672
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:264
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4208
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:5176
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2280
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:3620
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4712
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:5144
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:716
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:2964
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5388
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:988
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5984
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:1160
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3268
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:3512
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3048
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:3468
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2984
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:3220
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:940
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:1880
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1036
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:3260
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3416
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:3312
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4996
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:2036
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3256
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:2164
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4120
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:5196
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5336
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:4136
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4372
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:3248
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4624
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:4768
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:480
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:3388
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4416
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:1352
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3576
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:2352
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1932
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:5096
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1076
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:5144
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3900
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:1372
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5596
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:2472
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5704
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:5948
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4996
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:1856
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2580
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:4788
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Discovers running processes
      PID:1380
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:2280
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      PID:5092
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:1332
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      PID:3864
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:5936
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      PID:5084
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:4848
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Discovers running processes
      PID:4696
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:5988
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      PID:6016
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:5164
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      PID:2668
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:4456
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      PID:1896
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:1336
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      PID:5096
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:4404
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Discovers running processes
      PID:5732
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:1660
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Discovers running processes
      PID:1636
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:4216
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Discovers running processes
      PID:3528
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:4144
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Discovers running processes
      PID:3980
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:2596
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      PID:5688
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:4184
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Discovers running processes
      PID:4364
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:5436
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      PID:5188
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:2476
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      PID:1596
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:2280
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Discovers running processes
      PID:984
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:5212
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      PID:5548
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:940
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      PID:3408
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:2204
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      PID:3196
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:5604
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Discovers running processes
      PID:1852
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:5428
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Discovers running processes
      PID:632
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:4184
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Discovers running processes
      PID:3356
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:3700
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      PID:1364
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:5756
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Discovers running processes
      PID:3880
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:1052
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Discovers running processes
      PID:2820
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:2148
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      PID:1744
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:5732
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      Discovers running processes
      PID:4412
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:3408
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      PID:3704
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:2920
  - - C:\Windows\System32\tasklist.exe
      C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
      4⤵
      PID:2532
  - - C:\Windows\System32\fltmc.exe
      C:\Windows\System32\fltmc.exe filters
      4⤵
      PID:2372

C:\Program Files\FlewHaul\FlewHaul.exe
"C:\Program Files\FlewHaul\FlewHaul.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\System32\reg.exe
  C:\Windows\System32\reg.exe query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v FlewHaul
  2⤵
  - Modifies registry key
  PID:4608
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5440
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4268
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1720
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:1220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Command ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2492
- C:\Program Files\FlewHaul\FlewHaul_engine.exe
  "C:\Program Files\FlewHaul\FlewHaul_engine.exe" run
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:5380
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1904
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1104
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:3028
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1484
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:4416
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5932
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:3756
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4568
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:2328
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1660
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:4672
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2516
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:6116
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4352
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:1852
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5776
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:3372
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3160
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:3576
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2804
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:2280
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5728
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:2676
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1636
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:3956
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3528
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:1104
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3332
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:5984
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:6100
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:2180
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3032
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:800
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2984
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:3712
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:940
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:1548
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4216
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:5528
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4464
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:2532
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4364
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:5164
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2580
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:5756
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1380
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:3540
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2276
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:2232
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2424
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:4672
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3020
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:5508
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5604
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:5412
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:124
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:1556
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1540
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:468
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  PID:1668
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:6004
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  PID:1932
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:5728
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  PID:5336
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:2424
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Discovers running processes
  PID:3408
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:1036
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Discovers running processes
  PID:3752
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:1104
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  PID:5948
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:6024
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Discovers running processes
  PID:1172
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:2544
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  PID:4092
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:5760
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  PID:4840
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:4676
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  PID:6056
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:4532
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  PID:1180
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:4828
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  PID:620
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:4176
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  PID:4596
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:2348
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  PID:2876
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:1848
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Discovers running processes
  PID:3316
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:908
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  PID:5796
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:3272
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  PID:4884
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:4812
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Discovers running processes
  PID:4720
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:436
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Discovers running processes
  PID:6056
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:2692
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Discovers running processes
  PID:3732
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:4348
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  PID:5748
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:4680
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Discovers running processes
  PID:4400
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:5448
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Discovers running processes
  PID:1328
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:1368
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Discovers running processes
  PID:3332
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:5840
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Discovers running processes
  PID:468
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:2916
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Discovers running processes
  PID:3516
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:4212
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  PID:4308
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:4720
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Discovers running processes
  PID:5212
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:4532
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  - Discovers running processes
  PID:4204
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:4340
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  PID:1276
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:1468
- C:\Windows\System32\tasklist.exe
  C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq FlewHaul_engine.exe" /NH
  2⤵
  PID:6128
- C:\Windows\System32\fltmc.exe
  C:\Windows\System32\fltmc.exe filters
  2⤵
  PID:1104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FlewHaul.exe

Path C:\Program Files\FlewHaul\FlewHaul.exe
Size 67KB
SHA256 dc4040fcd8d01dd45ef9c014b802c301f220d12addb3c6144bef72aaa156008c
MD5 99cd83df7d3a6442b2b2e900fdda0209
SHA1 8d5f9d26fa681d8bb471bcf1eba9186831e81848
SHA512 edc916bffedeca01a4105f8fe8e0edea1db982b8556c109f6edff6370eedeb1ffa37cc33c11723065f7824725372744c139abb7d6b50e531c8188ca53a5b953b
SSDEEP 1536:sEIn8CY12BBC68GxGCBfrWLMsEgRJlrX:sEInz8P6rx3BfrEMs3rX
TLSH
T1A9634B17DA2640EBD35D8978C9430A05DA72FCDA4BE1E7CF97400DEA0D62AD49F3E602
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FlewHaul_engine.exe

Path C:\Program Files\FlewHaul\FlewHaul_engine.exe
Size 519KB
SHA256 7096581042e29a4f9e7d3a814ee785ce792927c64b1c9b566cf3cfafaff2f220
MD5 bb9b67b0c6d02e7bef3694be1fa2f6fa
SHA1 470674fb6d1b98cb426457dbc5753c080da1057c
SHA512 d7029db63668d6990ce6d687cb9afe44a397b35aa39ecd677e1424cd2f6870ca45a38d07a87282c128a66d7e898e425f4811cc95ae93d34b59f08a16f22b9759
SSDEEP 6144:G0RBiQjGScMBkutfPb540h9j9lh8ie8xc2KusTiwaHanUEV8yewsD8C2QIlrI:G0qQwMBkuZb5dxhX/xGEa2wsf2s
TLSH
T105B44A17EA5852F8D05AC07483599A37B636B8CE0731B9EF07E865202F79FE46B2D704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.so

Path C:\Program Files\FlewHaul\data\app.so
Size 5.3MB
SHA256 ac94e9babd0fd9116426e4ef4c81ad452faf79c1d1f846581f023bea0146e055
MD5 a6fef555b71031b89f873544998452c8
SHA1 16f3e2d8b3ada456f91b2b4e9ea289f38df86f26
SHA512 1f66dba32b10491c78ca6333a4364df7bab41e75262ee040fc5c34f297d834a1e6a66879a8a912c050b6652d77f4cef0077b79a0317c5b7c6b061ecdfc104479
SSDEEP 49152:3Zh2MeOu9gaCW5wUoLiAva/AB5sfh+j7zrVoO4sGliaoZl76ZIpj2Mec8CnLOeeE:3+cuIU8iAA8GyZleZIleJCniee
TLSH
T1A846F857D0E48360E472E772B75F66A59E143CCC5E70BA8706C85B553E8ACE48ACF232
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FontManifest.json

Path C:\Program Files\FlewHaul\data\flutter_assets\FontManifest.json
Size 208B
SHA256 cd7e03645bc44b2dd47b7cb626f51c4ecbf55a197ab77241628b47ac165fbe21
MD5 dc3d03800ccca4601324923c0b1d6d57
SHA1 bca264548730f8b1871672891b0ad0c02444bfaf
SHA512 eda04affa31ef1d3fe4b081762380a6a5a9364a48e7b6998e870c84495f51a9658724e3f496d90a574f7d5e13740dcf47ccc1c7914b77b6ef0826fe87379cdf8
TLSH
T106D0C74B581909F6458D9845F0E11253BC4429579E46DCCDE3A40E54D3A11641739213
MD5 SHA1 SHA512 TLSH

Submit Download

NativeAssetsManifest.json

Path C:\Program Files\FlewHaul\data\flutter_assets\NativeAssetsManifest.json
Size 45B
SHA256 9548a31e4a048135c1d94f919328bfb62ae2c7bb3cab96557c7941daa97776cb
MD5 f3a664e105b4f792c6c7fe4e4d22c398
SHA1 adee29ec4f2b3cb2ec37ec3368f37ff805695d36
SHA512 b7df555970e20c6a50f650cd0df6ab782fba7004782b3f7921ccfd314db53bfb61523986628d2e05d085f4c2263dfcf54000ffdfc946b0158c5766fc6f1d0a86
MD5 SHA1 SHA512

Submit Download

tray_ok.png

Path C:\Program Files\FlewHaul\data\flutter_assets\assets\tray_ok.png
Size 881B
SHA256 e051621e7a95c5a3161e386295b3b612910b7ed589a4d5e67d26a0a7455b0377
MD5 6a9bd8ae5538c6f8a7dc0cd8188e38dc
SHA1 76df3d46b91c18266b236c9780450d01edac9637
SHA512 7911967425a3e3c0d101d8508ea3e482e41771f50792144947570758df463562fe5142adbac7c11a4f6458be9dd787c62ec5eac3248faa248ee9d6dbc3e47aca
TLSH
T18A1163835E8578E47E2255FF3BABD6608A10C7EBB89A4DCEB550E5A424044A114AB3E2
MD5 SHA1 SHA512 TLSH

Submit Download

MaterialIcons-Regular.otf

Path C:\Program Files\FlewHaul\data\flutter_assets\fonts\MaterialIcons-Regular.otf
Size 1.6MB
SHA256 d9865b671a09d683d13a863089d8825e0f61a37696ce5d7d448bc8023aa62453
MD5 e7069dfd19b331be16bed984668fe080
SHA1 fc25284ee3d0aaa75ec5fc8e4fd96926157ed8c4
SHA512 27d9662a22c3e9fe66c261c45bf309e81be7a738ae5dc5b07ad90d207d9901785f3f11dc227c75ca683186b4553b0aa5a621f541c039475b0f032b7688aaa484
SSDEEP 24576:PsSIRolMKvGXtkXKLkMp2fXrNsAxI6zD2/qxDoq4eeeDrG2eOeGr2lkzhlTMrRoV:P9njdzbwc9
TLSH
T1787529100276EF4CC1EF507D43B74A48F4C59AFEA53ABB1AF9B64795220BDBDA1C8181
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Program Files\FlewHaul\data\icudtl.dat
Size 842KB
SHA256 998367809a821d595928089c197b3f7959f0420f81f79d4d0daee53378492ed5
MD5 018361032ba13dfeab636138ab6b9831
SHA1 8f9c259d3a330786ab8bbd49e7e79abfa1d552ed
SHA512 d7d3fffb41576cf2c90cd260727cc0ea23c5a4c458f84b01426c2a4578004b94168047c7282222e9ffade2f082e189cf167146cc3303bd7dbbb252a593236967
SSDEEP 12288:8Mlhw771h0jM7ykPG07rr4c8w0P4N48Rkjt3dPHz982VYhq:Zhw3zVtjLbGu4RjTPHzMhq
TLSH
T199056A17B0435E6FE0C48277C652E7B65637838DEB3317EAB698B5593E8A1C20241BCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_windows.dll

Path C:\Program Files\FlewHaul\flutter_windows.dll
Size 19.8MB
SHA256 c0304beba5fe98477177e151c673adad98d0442f50efa25d03ff5f207cc21056
MD5 d58a8db7631d3577b3cc9abe14cce466
SHA1 c42e1571ddb6191789331f3db60783cc8a539b78
SHA512 89bdff0faa6ea9f3d89a8bde8e381f82996931f22fc695d1c26e28fac59eff9428ca8e65461373337035233fc4e732c8643b2460290af5393d63e643e626955e
SSDEEP 98304:QPe71P0UiyfxPUBJt4D5hrwgRk244TtFkJp7KYx8m3aIw3v8sDM0p1Vw3/tJjkad:Q+CYrwgRPLYFUZw3vjRfIS5XQe8I
TLSH
T1C9276B03F29640EDC459E178971BAA23F671B8490720BADF27584B223F66FE05B3E754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

local_notifier_plugin.dll

Path C:\Program Files\FlewHaul\local_notifier_plugin.dll
Size 161KB
SHA256 7ffb85e3d7eeb4af9128de1e1fb3f788855d669d93c14d184ebef1aa2ab36960
MD5 993f98f2a4d4186b0335e4b42a8b7a99
SHA1 2b1ee18efd74f6f9a21a1e70d0660ecb66aca320
SHA512 f3648a1acd057662a80ff083a6b27b05a5194c19b460c3d0b35e326830d4cf4daa60a3a012989e5107efd240d46f71526ae9e857486bc4583eceea274017080a
SSDEEP 3072:ityqo94mR9xlTIdv26JBtxQ9/PNk2wTjcDBMAzT3YFg2:itXo94OTIde6JbxrctMAzT3YFg
TLSH
T118F35C27B75D40EAE267D5788A478942E773B887479157CB1B810BBA1F23BD86F39300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Program Files\FlewHaul\msvcp140.dll
Size 533KB
SHA256 8b3e7b3bd95147c47272b300c566f98607525b620afe6b289a887759d5519edf
MD5 3392041477c06a40f74ea8add4e80e09
SHA1 6202e0965cc587e57f79aaea3d0a65e0ffe6eb98
SHA512 25b32073d00fe5715b6aad2bf96958dff2c8fbc47c0fc72668b27dd2d832329224496a01e34c9ccf08bc164959447d00725b9d0a8d692864d644cf456ed8bca4
SSDEEP 12288:82CAzHk7U54LeNX2b0lhllnQEKZm+jWodEEV6ljlR:829Hk7amAlh/nQEKZm+jWodEEoljlR
TLSH
T16BC41A27F74906B0E195E3B8A1838702D7F1BC4A8322E3C752EB955D2F673D0A67B650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screen_retriever_windows_plugin.dll

Path C:\Program Files\FlewHaul\screen_retriever_windows_plugin.dll
Size 117KB
SHA256 46fc988f4f5f7b6bc99457a873ef3db6fdd348eed24f7b004c5d09a743e9e9a9
MD5 00e1045809e5828ca3d97138ed3e9572
SHA1 626b4b3428d31b463e905f866b8de7a1af02b99d
SHA512 de5b8c9bd65c8ff50e05dd9ffeec0e56e07150c3bd2167671d4352bae85ad08e726e80c3508c50abde644f94dfca9ac0138165ba734934d553d484fcc3c7d48e
SSDEEP 1536:HCH2NGAzBL+1y5zWzE6P1wx65ID3hhrSjYcxcmZMp+zC1AOi6p:H9NDiE6PO3LGjYqMp+zC1AOBp
TLSH
T12AC32B2BB75940ABD269C4B9CE538D42DB72B8914B91A7CF17504A9B0F27BE84F3D301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tray_manager_plugin.dll

Path C:\Program Files\FlewHaul\tray_manager_plugin.dll
Size 105KB
SHA256 ea838907e0f41b9e731075b1ba3677aa0a98ce356b5506a6e4300a852144556c
MD5 729707741a7fd3c225ebe685d3a00f23
SHA1 7c445dd1ff4be21d8a7c131f5da91f8c6a51bb96
SHA512 e12008bb8ce75208f3aa66c8c6d326f52922fe6b129fc96ae5df16cf65bdb919ca064559f30be8716db8fc3762a95af25895db49b89bb6b5e2d44aa584ecae9c
SSDEEP 1536:AWayD5XU/yF0KJ6hl5xPYC1mFtM4Xu8GOI7d4OmvpZJlzCgP0nPf:AWacF0K6f5IPXu8g2lvpZJ1CgP0P
TLSH
T19AB33D2BEA5D50ABD269C47CC9534945DBB2BC8547A1A7CF07900ADB0F27BE44F3E601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Program Files\FlewHaul\vcruntime140.dll
Size 110KB
SHA256 3dd51ceefab6c79e5c22b72bf2c11da7d28f390fc4b7852cc71656a61f51f261
MD5 7b9dd969df904567de5038daad3076a1
SHA1 63051adf731ccc71cc6980439d90ed9094f9a0eb
SHA512 48d88891d33a3d5224a899d4c2f45dd7b23057979751ef2f3a41cf4980bf669dde5f223fdcf474bde0bbf25bb18141955da585ba65ad577b1a10a5f8d7b9b58c
SSDEEP 3072:Lv8lTs2K9DaZeDTyNIcNvPefecbmmI0wWi574I:Tk0WyyNIcxkecbmmIbX5d
TLSH
T17CB36A02B2B441FBC16AD274C1A29E27FBB2F80587609BDF07A95A650F53BE05D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Program Files\FlewHaul\vcruntime140_1.dll
Size 37KB
SHA256 3667158e396e409345578d93e82167594e45626941daa8766ac17e062c4f214f
MD5 ee05b415e0c02fdf3904e0d4ddc6fe2a
SHA1 d26e3c9ec5faaf633eb7f53aaa2d897982135eed
SHA512 ff0068e846e9f1b23cd24ca95b194489c03e19e24aab94125f4f2f8ae59af1b611cfc6744a51042ae8c83b4e75ed7c18d00c6146389216eb3a6b7d176428cb5f
SSDEEP 768:pgh4JwNoYDDX6TSyyeEP3Cda4wpKCwWtQU9zZY+D:pClQzyXP3Cd+3JzRD
TLSH
T108034A82A3680096D8ABD534C0D76E17FE3CF6615760939B0BA4C14C1E277E0A73E36B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

window_manager_plugin.dll

Path C:\Program Files\FlewHaul\window_manager_plugin.dll
Size 127KB
SHA256 dd0a86521adbb1b32a2637f1500c421d83671df676e01df667722f3a308b0785
MD5 3478605a8a37a0f8299771626a0ca606
SHA1 00d1b8a4786a14ad51d7fa26fc429c858d11ea64
SHA512 e06f08afe1d6c933152ea419f78051e4dcc8f05d8ec7704f6db51b3195e45fbfa08da077781925944640a7089e5c3d6769961473a1203c7df3b7a7c0930fe344
SSDEEP 3072:VyOa10efMoaAXI67ik3X4O2IyeSYuivpZJTTRK4:VyOauefMoa96793B5vpZJTTRK4
TLSH
T14BD34D1BF65D00A7D26AD4B8CD839946DB72F8C54B52A7CF07900A9B5F23BE44E3E211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FlewHaul.config.json

Path C:\ProgramData\FlewHaul\FlewHaul.config.json
Size 744B
SHA256 c81dc89851f6e69f6377c98eafcf58f314991f6affdab34edcbc92ae5f8190a2
MD5 465826b84d8c709c0675ccfce92de83b
SHA1 5e929d298db05cb00873278bf7eb0eb92d2c6e5b
SHA512 f92bb2648bf0d3f832d9fdf511622db4f7d0114201369c2b2262686e065190058019fc2ea6bc75159b8c104e81b3ac3bf7f342cee4266d5e50133582d938e8d3
TLSH
T1DB0140206B7856BB11E8C74548BC730339E29C2201A57D3595B38B2C3D0E73335764DC
MD5 SHA1 SHA512 TLSH

Submit Download

FlewHaul.conns.json

Path C:\ProgramData\FlewHaul\FlewHaul.conns.json
Size 3KB
SHA256 40306495006c8f008e4e8c66a97f1c1785bf61a74191951ffdfd15fcfe3d568e
MD5 6dd870739ac66eb09ae547481a01622d
SHA1 ff39b996314a7b5324327b224804258a6c58ceae
SHA512 6bb0f586e89df6bac2f4b27ed57d863c8d7684602000c91e0c43ba610681232ea83b17a131308e96c699890dc13f43fa9a8c79874d204513e226e6be9b48bfb6
TLSH
T11161D400028F6C7E4FB86ED56E8FD26592299E8C759D27D85CFB1B18C4743AED21D50C
MD5 SHA1 SHA512 TLSH

Submit Download

FlewHaul.conns.json

Path C:\ProgramData\FlewHaul\FlewHaul.conns.json
Size 4KB
SHA256 51bd759ea8c514076d312e47d2c76d993b3be45423611ec4c6fee4c466cfb145
MD5 5b44e9cc648b671dcbfb1dc360c7b3fa
SHA1 83a1705837ab04e345753cccd0e575d54484ab4e
SHA512 3ebe4580eb14ed313593f375844ffc7c1cb32eda8ac46fd5eb28f8846c0271d151c51c4bf83d0f8c070dadf1e7d97cc7206ad7ff65bf59fb596e63e69f45190c
SSDEEP 96:MoRMGX50eQliAt9epRLGwxjZPewxLx8x+a3y:vNY+/
TLSH
T1EC91C200028F9C6E4EB96ED56E8F926492799F8C749D26DD5CFA1F08C8743AEE31D41C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FlewHaul.conns.json

Path C:\ProgramData\FlewHaul\FlewHaul.conns.json
Size 3KB
SHA256 39f59067422c0e8c37c9bbcff1a22db482175944b07f12340dbff8afd7f95dd4
MD5 852cfb935e163e9b4d374a952b15884f
SHA1 bd0ad05463b3bc35ffed48728cedc998fca45560
SHA512 2a9bdd261fef893aaa7373bab1b3bc8e6ee237d83323940c3f03c191c9b50b407179c320780d666ca85805a376190484c99d096f09808620e7ae0060b95c8103
TLSH
T1C751D200028F6C6E4FB86EE56E8FD26492299E8D749D27D95CFA1B18C4743AEE21D50C
MD5 SHA1 SHA512 TLSH

Submit Download

FlewHaul.conns.json

Path C:\ProgramData\FlewHaul\FlewHaul.conns.json
Size 3KB
SHA256 530b0058fe517898a7275fd5206134e86f54f2880d9c0e2e8e3223439a22f655
MD5 0742894599f0d67680a6c2f5f34b0380
SHA1 d6f37b57188df4c2f34347a1760dc7f1adb096a6
SHA512 94360b1d1a611a2e0fb35bb02949c9a93a67a42598da01b05a98d073ea0a859f8a5a578230a793c060bdd61c75dae1d2c73949e6a4852dbd0e5f1e7d322f3fb7
TLSH
T15051E300028F6C7E4FB86EE56E8FD26492299E8C749D27D85CFB1B18C4743AEE21D50C
MD5 SHA1 SHA512 TLSH

Submit Download

FlewHaul.conns.json

Path C:\ProgramData\FlewHaul\FlewHaul.conns.json
Size 3KB
SHA256 298b74e6133692577ef0d4d99d751c852e2714e3a4ea412465fadc60b7877ab6
MD5 4d08f2f24d3f9e7eb157d2dc0edbf724
SHA1 8e1eda2618b87afeba4bf34d0e75e5f621f3c20e
SHA512 cd03d7834c5fd4644082710a234fd54f21f6959fc5da078fb1ca3a820cd06fd297b33248e1114c090512e28f20de69aeddc40557614e70eac07f26495a7a533a
TLSH
T16B61C300028FAC6E4FB86ED56E8FD26492299F8C759D27D95CFA1B18C4743AEE21D50C
MD5 SHA1 SHA512 TLSH

Submit Download

FlewHaul.conns.json

Path C:\ProgramData\FlewHaul\FlewHaul.conns.json
Size 3KB
SHA256 1424567976034570313679c1df634a6cb15508c2011b693038ff076164b9cf2f
MD5 35c938634f1fff3b7d12bdc88018c828
SHA1 7be3a073d918ffc5b9634c4e2b508f83dc57ee43
SHA512 c7d0afe622e8e91dd84a0a9f61559f3f4b007ac15e1caf5189d838320287571e7644288539766cc4c65b63cb4f05769f8787e51c42f5eaf654f9cf2124c1c544
TLSH
T14A51E300068F6C7E4FB86EE56E8FD26492299E8C749D27D85CFB1B18C4743AEE21D50C
MD5 SHA1 SHA512 TLSH

Submit Download

FlewHaul.conns.json

Path C:\ProgramData\FlewHaul\FlewHaul.conns.json
Size 3KB
SHA256 3976111c67e467b50b1817e0112e1413115393037691b98f410dd472d8373950
MD5 bb2787d3f5b60a15463b8c70ca351adf
SHA1 2d14eb232ba5a9f77ddadee688a0c51552213130
SHA512 5070fc88ad982a12dd19f558ffe30a2701d1aa84037d2b8ba7161fc431549736e2602070e054460ff468d3f3407b212019487c01d54e3ff00d8f00a1c5dafd65
TLSH
T12451D200028F6C6E4FB86EE56E8FD26492299E8D749D27D95CFA1B18C4743AEE21D50C
MD5 SHA1 SHA512 TLSH

Submit Download

FlewHaul.conns.json

Path C:\ProgramData\FlewHaul\FlewHaul.conns.json
Size 3KB
SHA256 0f12ed0b6a1454f8ebdd82bf16045e309e16f7a3f02f872c08f2de24b92abb51
MD5 0317b4d842c04c4f876adb45f3b1060f
SHA1 106eed413ad0249152855f71c5f4121fd187252c
SHA512 f0ca139ab142cfb95c5b474f526249b4eee67c0e680220245b799b3eb833b5951a0c897cebbf6cc89be4d32d9dc20b7f4d1e84a3d9c6878486e9bee6fbc5827a
TLSH
T11151E300028F6C7E4FB86EE56E8FD26492299E8C759D27D85CFB1B18C4743AEE21D50C
MD5 SHA1 SHA512 TLSH

Submit Download

FlewHaul.conns.json

Path C:\ProgramData\FlewHaul\FlewHaul.conns.json
Size 3KB
SHA256 38107dde22ad2578d09838ba1026ca2df3aa2bae318881e8d3efa66fc61e9dc4
MD5 36da28100c552aa3978b0ee8cefe1a5d
SHA1 058c59bb8e8c352993f68529dfb6edda029e03f5
SHA512 0bf6f34c95a55e3afc0e0ee6069c8380f41fbd56ee1a2807bc35d93800e7c3a8905539b4fdbb2d99b70d5ced514c8d1ed86301300287ee6e40dc30222f7008c3
TLSH
T12451E200068F6C6E4FB86EE56E8FD26492399E8C749D27D85CFB1B18C4743AEE21D50C
MD5 SHA1 SHA512 TLSH

Submit Download

FlewHaul.conns.json

Path C:\ProgramData\FlewHaul\FlewHaul.conns.json
Size 3KB
SHA256 5673016ec001b8ba876d47454fd7408bd5de48993c88cf791cc1fac1e39ec2c5
MD5 57f50f528cb26f508cf8c67a66a35909
SHA1 cc8259ef434d11b6a82e9a02326df28b2a915d58
SHA512 56798bb13814a4e894bca650f48861d66722fa74ed1206b7df13d6e582d297091ce8e8434b2ec64510c475821e2776d9010e00b2d524afccd35f6e721fc94be2
TLSH
T10351E300028F6C6E4FB86ED56E8FD26492299E8D749D27D85CFB1B18C4743AED21D50C
MD5 SHA1 SHA512 TLSH

Submit Download

FlewHaul.conns.json

Path C:\ProgramData\FlewHaul\FlewHaul.conns.json
Size 3KB
SHA256 2bbbf369b43ee0d30f4b3423f29487952410ccea9060d9511c772f9579d299d3
MD5 eda874c1a4acc9c0e0dce92d6952e583
SHA1 710579970ca5f09b7eaf8393fe1e1461f5277bec
SHA512 257410022d8afb87e0c1d606913a8d63bc56ca5f698bf3846567d7a6fc999e3147fc6334c4691fb1959caca65c406377c0183e6f57829ad952133cdb132519dc
TLSH
T1B951E300028F6C6E4FB86ED56E8FD26492299E8C759D27D85CFB1B18C4743AED21D50C
MD5 SHA1 SHA512 TLSH

Submit Download

FlewHaul.conns.json

Path C:\ProgramData\FlewHaul\FlewHaul.conns.json
Size 3KB
SHA256 35d1a48f3858a12d61f1bbd210badc8ce49e30d5bdddaddc2b932c4f159f2361
MD5 9354214f38d56f597bd9afd691cd4335
SHA1 4e6aced12745f2c870482913f1e854b71669d611
SHA512 6704cfd065d00f3e9ac319afc246035da848390f96d3c3eecd751394c27c5f6a61c57cc5b33563f7e82c09a8598ba585c53e3e13f7e5ada5b4e6003801fbcbf3
TLSH
T1B451E200028F6C7E4FB86EE56E8FD26492299E8C749D27D85CFB1B18C4743AEE21D50C
MD5 SHA1 SHA512 TLSH

Submit Download

FlewHaul.log.jsonl

Path C:\ProgramData\FlewHaul\FlewHaul.log.jsonl
Size 475B
SHA256 155ffbc68e745d6137824cb4154daf4492a72c435e3c416cb73e3e91a8f5cc0f
MD5 fc9fe41aaf812dc8e75b4676f366cb3a
SHA1 82a77c8f81e92960425a66afe523d5aac402d5bf
SHA512 0d20fca58347f1880b0c167b1a4a8fe0afa46afe3c59bd52b1fe47bfba1c9c60d3dfedcf66b908f033542609e6a78d4ceb1f8c72ab9ad06dec98bc1ee09272b6
TLSH
T141F0274645B40AF50BCA54536690EB4E877C123761A95DFC98F0CAC00968328637FD2E
MD5 SHA1 SHA512 TLSH

Submit Download

FlewHaul.stats.json

Path C:\ProgramData\FlewHaul\FlewHaul.stats.json
Size 196B
SHA256 205ab8982417f3a0f35ed3872bd270f8feb2150e3592d0839eedf8b46028f0a1
MD5 6372f8d3a5653f14e18bbf0ec0574268
SHA1 b4efa3027396f53f100d6455d7127e759e8d1f9f
SHA512 4edb5971ffdc1f559fd7c4f6a60183c1344dc9b53d402ecac5f8ad0dc1c8136663ff2700dec31840d7e955e5cf5b07c6599e39d67be84f6726238a7b7219c786
TLSH
T147D02211902013F522E89F3D056483430BE2DFA380B73C10DEB3840A3B0F8E62073982
MD5 SHA1 SHA512 TLSH

Submit Download

FlewHaul.stats.json

Path C:\ProgramData\FlewHaul\FlewHaul.stats.json
Size 195B
SHA256 cf4fbe51ca5166a10fe1f665d344331845123c8fc774a7bbe91bd92e86e12d88
MD5 0dbad33f4cf6399748a8b85db62632c5
SHA1 963c89a65ca8a18ac0edba9b8ec854c3a8b118c4
SHA512 1446c14a6aec99a977f1a682ba81ab63bdb183e40c4eb5dac6f84e2184a31c181a61e0a89b2b35d80fae5d1f34e2951422c40f3840229ee99df7c35ccfa98276
TLSH
T1E7D01212952056F532E85F7D456493431BE69FA281773C61DEB3941A3B1F8E62073887
MD5 SHA1 SHA512 TLSH

Submit Download

FlewHaul.stats.json

Path C:\ProgramData\FlewHaul\FlewHaul.stats.json
Size 195B
SHA256 ae9153a67590d5ac074c5e485f5ae8a7aa43fdff740e1ca4b0d6519349800887
MD5 14278f1adcfbfc1aaae44759f9e47819
SHA1 ef3b562403c3176f9c897d5a90e1ba431865b8a3
SHA512 670397bbcbfa5f68cdc4a1c3c70f7714619b2f9df908cfa52d7e326c9573b8f871f8ea482732402d014dc27ba7b1c5a867610b0bae4a3f2d639d67089abe8654
TLSH
T106D02211902012F522F8AF3D046083430BE29FA380773C11DEB3810A3B0F8E62073883
MD5 SHA1 SHA512 TLSH

Submit Download

FlewHaul.stats.json

Path C:\ProgramData\FlewHaul\FlewHaul.stats.json
Size 196B
SHA256 c4cf16d1c6eeaaef20b41e1184301064b016e2f2a92bf82df731713977cbbf5a
MD5 a3d79ae450f783098fcde8d253f9ab16
SHA1 90edeab395a6857f105fccc59b331b5c81fa7e14
SHA512 33e768d5c96db7da7701d83c061ef4ab883fa22a4bd396737b64830decb56deb800d7465d97d231c698057f53ce3623b63c2357d0648d222b5736b1588e01cca
TLSH
T1A4D0C912952056F522E89E79456483431BE69FA281773D259EB3950A2A1E8A62073887
MD5 SHA1 SHA512 TLSH

Submit Download

FlewHaul.stats.json

Path C:\ProgramData\FlewHaul\FlewHaul.stats.json
Size 196B
SHA256 c585c9163f961d51003d932ab20ab812c84d11669ad8fab561f6ef4f2dbc5e35
MD5 83c6ec8b5ae029f991428b7074a508e5
SHA1 3b0bd4373a3978a36c67009941a23b32d45be624
SHA512 26b36ace44dd46eac7525f65eb6cfcf6b1eb13d876d672e7fe52e1c3fa4fe64fcf477d7c592a4e5a43ed64aa8e67cc80b766a7e622f4622ea57db9c53b548855
TLSH
T14DD02211902012F622E89F7D046083430BE2DFA380373C10DEB3880A3B0F8E62073983
MD5 SHA1 SHA512 TLSH

Submit Download

FlewHaul.stats.json

Path C:\ProgramData\FlewHaul\FlewHaul.stats.json
Size 196B
SHA256 61da0d21ba2a09b370a7fa4afb9781203b7f521fc1616f6c21be707539e69630
MD5 4e48a6cb616281d73429315f3935d546
SHA1 d3ce120ba502bd1c938b562a08276039d3642188
SHA512 f68b14e9aba7ae9ff6d193c2a34dfb64986d33bb649bc906ad39e2046c8f62622177e8649bb602ed9d3a59db8418a392c053a61bb352d95b22830c1bb9b10fcc
TLSH
T119D0C711552056F531D49E694564434317D55FA281773C119D735409261E8D61073846
MD5 SHA1 SHA512 TLSH

Submit Download

FlewHaul.stats.json

Path C:\ProgramData\FlewHaul\FlewHaul.stats.json
Size 196B
SHA256 20a585d729c25798639639a3eb1e2f402e36fad78be907e6d911873bd28f8a34
MD5 fdd9b56d20c12d1236784c447a4c9b26
SHA1 f4e63479db30a67de5c6765f39f5e4b2b4d98e0e
SHA512 3a74fe41413381c3354aa2e6feef7c8e2fb79047e34993e4067e0ced8da81096814f5fda8b56bf3b22e749c2e08b9a9365e22efcba4db2b07be470fcdc341c84
TLSH
T1DAD01212952056F532E89F7D457483431BE69FA281773C21DEB3980E3B1F9E62073C86
MD5 SHA1 SHA512 TLSH

Submit Download

FlewHaul.stats.json

Path C:\ProgramData\FlewHaul\FlewHaul.stats.json
Size 196B
SHA256 cf4487da5e910c1adcd774c8489d0133ed5f457c0f87b2a6801293310fb2cbbf
MD5 294fedf068b75f2cf08ac7b5cc0ee292
SHA1 249920c4dddec0a293bb22d61a2dcec1e2a11da9
SHA512 eb07b3a990d19626ed45f7ad4c5184f9b5ddee5ad0a4b861d42e558888a154dc572fda13aa22d6463194c1f089681ed49584b84fac52e0acb8303ca96158b04b
TLSH
T153D0C911952056B932E89A6D456483431BE6AFA281763C119EB3950A2A1E8E62073986
MD5 SHA1 SHA512 TLSH

Submit Download

FlewHaul-Setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-4LQBURPZZ6.tmp\FlewHaul-Setup.tmp
Size 4.1MB
SHA256 f7282a95edf73bc4f85702301d335f7c258817e95d12475c39243fcce2cf42ff
MD5 e64190e22590dcb243cbf60436f361bb
SHA1 e4fc619d8ee29eafb5c00f0a0867c628262442e9
SHA512 d2fd3485f0db3dd7b64c3f12144a462be2a4efb05278d9541d522f264485b2a8d5af9f56557c74465df6a8aac2df41cbe9a43a284dfbe21972f25b8d8c4e6ecb
SSDEEP 98304:h9SZUvl30aj90ZFcvdQ0hdgvminQLMj+JP333a:+ItJj90Z6RgKwl
TLSH
T166168E03B388753EE4B71A3A883FA654583F7A213A26CD4B6BF40D5C4F396416D2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FlewHaul.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FlewHaul.lnk
Size 1KB
SHA256 a9a98b8193e09db7f8ab319a167b1620fdf9f998c52425577978a8382ebe5588
MD5 9b4fa07bc78e778e547a2c97fc4f864a
SHA1 1c6ff28c9c69482ce43b17f213edc3d018fb7d8d
SHA512 6b418f1d566d4a525befd2be553e1db4230efdad3cc75f16921a177ac40875eaa44b2551efbb627f326a42b9350c749eb6085ead4ea8f2626626ad83f7dad3dc
TLSH
T15A217B050AD11FB9D3B3C1367DB137214B337A07F2A54F6EC0C5868058696805999F5D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1356-8-0x0000000000D40000-0x0000000000E1E000-memory.dmp

Download

memory/1356-0-0x0000000000D40000-0x0000000000E1E000-memory.dmp

Download

memory/1356-163-0x0000000000D40000-0x0000000000E1E000-memory.dmp

Download

memory/2404-113-0x0000017382150000-0x0000017382691000-memory.dmp

Download

memory/2404-114-0x0000017382150000-0x0000017382691000-memory.dmp

Download

memory/2404-112-0x0000017382110000-0x0000017382111000-memory.dmp

Download

memory/2404-115-0x0000017382150000-0x0000017382691000-memory.dmp

Download

memory/2404-116-0x0000017382120000-0x0000017382121000-memory.dmp

Download

memory/2492-129-0x0000022EE41E0000-0x0000022EE4202000-memory.dmp

Download

memory/5676-6-0x0000000001390000-0x0000000001391000-memory.dmp

Download

memory/5676-12-0x0000000000790000-0x0000000000BC9000-memory.dmp

Download

memory/5676-9-0x0000000000790000-0x0000000000BC9000-memory.dmp

Download

memory/5676-10-0x0000000001390000-0x0000000001391000-memory.dmp

Download

memory/5676-162-0x0000000000790000-0x0000000000BC9000-memory.dmp

Download