f4101ecaf6463e95398da0e137ddd647a2344daa2f1a6ee768493124b6772222

Analysis

user interaction
yes
max time kernel
150s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 18:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PortFlow_update.exe
Size 45.0MB
Sample260623-w39rhaft3k
SHA256 f4101ecaf6463e95398da0e137ddd647a2344daa2f1a6ee768493124b6772222
MD5 d42cefc1aded29e65696210e90305dcb
SHA1 814aa899fa5b584f4e6a0437f78d8e6b6dcf7ef0
SHA512 80cbb94853498edacf1b6d94cac683b7df707abe9eb5b9cc964eeafb38b9b8504c8655cecbc266d4b6a16ff7b8a9963afbb25cf2bf7b361b5307dd52a1e2d023
SSDEEP 393216:hvYKvo9eihzRjvcuQIXAU8N1Dd4O4J+cJWGgk:hwAo4qzhcMAU8DDDrGj
TLSH
T104A71953F8E21994D4EAC174D672823BFBB13869077813E70690F3205F3ABD09AB6B55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation trojan

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1364	netsh.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	PortFlow_update.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\CLSID\{0F82E845-CB89-4039-BDBF-67CA33254C76}	PortFlow_update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\CLSID\{0F82E845-CB89-4039-BDBF-67CA33254C76}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PortFlow_update.exe"	PortFlow_update.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\AppUserModelId\PortFlow_update.exe	PortFlow_update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\AppUserModelId\PortFlow_update.exe\CustomActivator = "{456216a4-b99b-4c1e-b291-63814b7acd63}"	PortFlow_update.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\CLSID	PortFlow_update.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\CLSID\{456216a4-b99b-4c1e-b291-63814b7acd63}	PortFlow_update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\AppUserModelId\PortFlow_update.exe\IconUri = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PortFlow_update.exe{456216a4-b99b-4c1e-b291-63814b7acd63}.png"	PortFlow_update.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\CLSID\{0F82E845-CB89-4039-BDBF-67CA33254C76}\LocalServer32	PortFlow_update.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\AppUserModelId	PortFlow_update.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\CLSID\{456216a4-b99b-4c1e-b291-63814b7acd63}\LocalServer32	PortFlow_update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\CLSID\{456216a4-b99b-4c1e-b291-63814b7acd63}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\PortFlow_update.exe\" %1"	PortFlow_update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\AppUserModelId\PortFlow_update.exe\DisplayName = "PortFlow_update.exe"	PortFlow_update.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5944	msedgewebview2.exe
5944	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1724	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1216	PortFlow_update.exe
1216	PortFlow_update.exe
1216	PortFlow_update.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1216	PortFlow_update.exe
1216	PortFlow_update.exe
1216	PortFlow_update.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 1724	1216	PortFlow_update.exe	88
PID 1724 wrote to memory of 1884	1724	msedgewebview2.exe	89
PID 1724 wrote to memory of 2908	1724	msedgewebview2.exe	90
PID 1724 wrote to memory of 2908	1724	msedgewebview2.exe	90
PID 1724 wrote to memory of 2908	1724	msedgewebview2.exe	90
PID 1724 wrote to memory of 2908	1724	msedgewebview2.exe	90
PID 1724 wrote to memory of 4180	1724	msedgewebview2.exe	91
PID 1724 wrote to memory of 3276	1724	msedgewebview2.exe	92
PID 1724 wrote to memory of 3276	1724	msedgewebview2.exe	92
PID 1724 wrote to memory of 3276	1724	msedgewebview2.exe	92
PID 1724 wrote to memory of 4160	1724	msedgewebview2.exe	93
PID 1724 wrote to memory of 4160	1724	msedgewebview2.exe	93
PID 1724 wrote to memory of 4160	1724	msedgewebview2.exe	93
PID 1724 wrote to memory of 4160	1724	msedgewebview2.exe	93
PID 1724 wrote to memory of 4160	1724	msedgewebview2.exe	93
PID 1216 wrote to memory of 1364	1216	PortFlow_update.exe	94
PID 1724 wrote to memory of 5944	1724	msedgewebview2.exe	99

C:\Users\Admin\AppData\Local\Temp\PortFlow_update.exe
"C:\Users\Admin\AppData\Local\Temp\PortFlow_update.exe"
1⤵
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=PortFlow_update.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=1216.3684.12570939764839233468 /pfhostedapp:ec1b66b092008dba3de57216d0b6cde6fcc355f5
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView /prefetch:4 /pfhostedapp:ec1b66b092008dba3de57216d0b6cde6fcc355f5 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7fff59845fd8,0x7fff59845fe4,0x7fff59845ff0
    3⤵
    PID:1884
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView" --webview-exe-name=PortFlow_update.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1768 --field-trial-handle=1772,i,7806026040131388132,6809096938135009423,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:ec1b66b092008dba3de57216d0b6cde6fcc355f5
    3⤵
    PID:2908
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView" --webview-exe-name=PortFlow_update.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2168 --field-trial-handle=1772,i,7806026040131388132,6809096938135009423,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:ec1b66b092008dba3de57216d0b6cde6fcc355f5
    3⤵
    PID:4180
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView" --webview-exe-name=PortFlow_update.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2332 --field-trial-handle=1772,i,7806026040131388132,6809096938135009423,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:ec1b66b092008dba3de57216d0b6cde6fcc355f5
    3⤵
    PID:3276
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView" --webview-exe-name=PortFlow_update.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3532 --field-trial-handle=1772,i,7806026040131388132,6809096938135009423,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:ec1b66b092008dba3de57216d0b6cde6fcc355f5 /prefetch:1
    3⤵
    PID:4160
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView" --webview-exe-name=PortFlow_update.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4576 --field-trial-handle=1772,i,7806026040131388132,6809096938135009423,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:ec1b66b092008dba3de57216d0b6cde6fcc355f5
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5944
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall show rule "name=PortFlow Launcher"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9e54f1d3c6da730e2d9207dfd4ceea6c9fd4b878bb85e5fc54b5cd8975001fc0
MD5 c879741c5a4ccbd52738d4d8241e587d
SHA1 0d74c005ed7c2915ce16b66e9351b2402018fe10
SHA512 4e9a658504fd9eb3a32455d6b3b16a4702788049fe1bea9f43399d2f451758c474a3c805dbf7bc9bbe1d1774a36e098a1649c027f2959871b4e60793857542a5
TLSH
T1ABD0121736074A78C01020330002A60C0402D10F90854145D839867E5B140501E17442
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 898c15910c2f90bbd7bd7edfc0517cbebdca5e7101b35866acd23e8a8e261f91
MD5 a7d25342f60aff023031b5214a4d8cf0
SHA1 58045f87bce3c5f5bba50f5f1f459e0c582ae5c9
SHA512 8d08763071b832b0d87faf77ee4736c1632cdec229b13b1233db750b67861c37be546b1377b37156f30bfac41e309b92a492643e768de7a53ddaef6d9bf26a76
TLSH
T1E3D00415550F5D55D04110310014C7044113540470C10345C531017545500001517101
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 90e0cc9af2374a3f44a244eee5de1b6c170f089ed6399cee0d05d7492b89c5dd
MD5 087bf0858ec093ede7877f93c7d44883
SHA1 610541359243a206c024c69c2a73a6467eab4e0f
SHA512 8093668eca50fc6e93770ab69dd9fb8ba1d9f00c733edfb8a58accbb5c873ad09209191e3a080f5661ef505ab62a7dc3badbc2f4ee01148edd113666300ed7cc
TLSH
T170B0223C0302088AC38033BCA0E2F000333ACC8002230B00C0800232AC20380003C080
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d567.TMP

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59d567.TMP
Size 48B
SHA256 ab87d4e33f6ad4195b070753690181c282587b574b33abbbc42a9fc454b8adb9
MD5 76d9ce6ad06186ad627aed13b156e787
SHA1 ecf312ebc3c4d01455a522fd744296190eadfa7c
SHA512 127cae16792a67185b5e225439add28eebdf266662b2748ee010fe3928461f322676e2f9b2111b85f60d490303191ad478773330cc673d1e573be7cdd27a6028
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 870a7dd549e3a6042d82757fc06eb2fcdf6998da99976f2aaf834c3273885a9c
MD5 5c3bdbb76c098f8a8ce1d3237f9432ae
SHA1 75b841edbc45e4adba3c06e527fd20264b087918
SHA512 fcc49ecf1edb0bf998f1045eaa2ffcb5ddfc72d7b6c997efd7da826404e12ff188c1c394d3ead16814f4493150eeb4eaddeeb49d2c4d251657fd55190856ad2e
TLSH
T1E7318FB7C2E4C63D884126E837247827CD2E051952283D27CDEAEBE96BE1471E71090E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a9869.TMP

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Default\Network\Network Persistent State~RFe5a9869.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Default\Network\TransportSecurity
Size 523B
SHA256 6b881be2824974d64b5d4e36350e5794c50e0e21e793e488b62ce0b6de816b27
MD5 4eea8e8ea931ec52ae8700434b752749
SHA1 3618c65d1956e3e87e379dc86d492dceef8348cb
SHA512 03b328f66c0f639fd1ca6d5574513af13a96624cba494ebb3a1fb003a5d490e890ba9c90a59227ce7be4f4a6d9e8b57ee607944d6c923fdce867b076614781e4
TLSH
T113F050EF90BFF1B7105D5A7B1C487C556A7A707221C124E4DA8347BCF0584BB1E06422
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Default\Network\TransportSecurity
Size 523B
SHA256 ce5dffe62db579582e1e276560adf3c472b7a12dd9a5941b6e4eb867a5348577
MD5 f38b036df21c97e93b9a9f63173faef4
SHA1 0d1288e6ef858f7ebf0835b6df2c98e0e1c84b74
SHA512 ddd69023fdf78ab3800a6e57ad7013e159a20ffdee2dae000c3a24e6ec781f8b6029fd4b78f399d729b3a8c8ecb9a49a74df4bee9b98b7d5c8a1b7c82dfed821
TLSH
T1F9F050DF90BFF1B7105E5A7B19487C515A7A707221C134E4DAC343FCB0544BB1E16422
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Default\Network\TransportSecurity
Size 521B
SHA256 70d97a2bd40e7896d9f58595f403ca07a213a63efe64c7faa8dfee455fd1a975
MD5 a58274cee9f86639ae2985637e2a4855
SHA1 3e3bf5d24403be8aa5d179b820aff6658796a939
SHA512 fa7c25ff814b3e5bd859a5538277c348a37f57bc80ed630bdf329d937845c3cd9f7ed795a21cf1ae4fce2e6b7eb656291329eaa1c2752a7077c2f261c0b576b9
TLSH
T1DCF0249F90BBE177106D5B7F0848BC559A3BB07222A164E5EA8282BCB0545AB1E06022
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Default\Network\TransportSecurity
Size 521B
SHA256 3803acf4ce0111ded8fb2f660236aa46d1fab2eb8931fc8276f63a881f58d2da
MD5 7854ef4f2cd31d67e02bf29dc5f500f1
SHA1 21a59563ad8efdfba1d5da28f29186afdab3c87a
SHA512 60fdc78ddf907ddd6de937e6df79b65ea70e4faa223fb569fbae9a2473e893697aba6081ea9d96845f1ce410534bc4c30c378e5ab489c28b7ae594a230f09910
TLSH
T16BF0249F90BBE577106D5B7B09487C519A3AB07222A164E5EA8282BCB0545AB1E06422
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Default\Network\TransportSecurity
Size 523B
SHA256 eccfd58a07b19d295820a21b1480b076354857ec90cb1300b7879633cfc8e1ce
MD5 8e16823d66b1ea7a8389c399dfca65b5
SHA1 4650eab32bf5b2691a8dd91fdc32011854517b5e
SHA512 ba833c124242947d336c9cfaf4f69c396c4b2600ed120e70ebde2aa3674fa8c41e4ebba3b0f705fdd48cf9de8e5a83511e26eab7c4acd3e51d565521b1c3045c
TLSH
T19AF02BAF90BBE5A7105D5B3F0848BC55AB3AB072229164E4DA83427CB0504B75E06022
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Default\Network\TransportSecurity
Size 521B
SHA256 bf5cc30333a073ce0c52c13342f459fa48d02ae2735c8c5f56c117a6f5a090b2
MD5 0fbd76c3c7376dc29a523185d76b860d
SHA1 9bb21c54c88a5ec52ec8de2ce32404663f24e6bb
SHA512 79e3a4e769a9bd432b09ffcd9ec9ef1cbf85ad84312d36d487bc6108b5536368590b7510ec5b564bebbd563e3adb75da5f01f4c6e595240945242a243a9ef0f3
TLSH
T196F024DF90BBE577106D5B7B08487C919A3AB07222A164E5EA8282BCB0545AB1E06022
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5a00ad.TMP

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Default\Network\TransportSecurity~RFe5a00ad.TMP
Size 523B
SHA256 bbd51996183c1363eccd7a1d13f94e443a32905e218cae2954fef7ae2cfa1498
MD5 6fa2a1af053026f019a5c1cc0ed0cf98
SHA1 c426f61027a6e625c7faa6428a90a5dcf0c92662
SHA512 0320eed17afc598f569ec80575b8bb66b6966154f7acc2a280fc8a5110f1fd9380704f6ccc1456cc609b8b619c98063f87def6682c195ca6a95e84916c4d884e
TLSH
T101F050DF90BFF1B7105D5B7B0848BC519A7E707251C134E4EA8346BCF0544BB1E06022
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 24dd9be7b04e883834e915466474d12d406812c4d733fd0cc28886196ef49f00
MD5 0c674d4f629c9854a12bd4da08ed40a7
SHA1 f26bf41974a818af50f1d5d4a1e777c57ee305f9
SHA512 bf5ef0d301ffbbdbf4ebd8e9fe92b61760303042fa6fe7755b80c1a83df81d95af2c9078d0d106f024270830b9abe136c2ebdf49984a78c0de33c0236a0f70a5
SSDEEP 96:stD/dcWYGZb9sEkTo5h16Z5fs7/x+6MhmuecSdGrj0jeKK+gqaST/728XM1C7K:st7uJE+oKfsV+F2Er4jS+G6K
TLSH
T146D1A6025E68687B4CC6E519BB35BA13E2F9547271941E5CEBFD472C08DAACC6307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc2ec283-3e74-42ad-9124-d8f945f265a3.tmp

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Default\bc2ec283-3e74-42ad-9124-d8f945f265a3.tmp
Size 6KB
SHA256 5184b7185ca9e45d836aec10354c664b007f7393f2127e607bb4cc41adf26355
MD5 3e85d97e5e4944877e308d4cf84080a4
SHA1 e26841cbf248b3abab52949a3c2665ef32585103
SHA512 a2d409fe6de13c927ca9e17f400c1a680f2fe44e91434d85d7b3a7f6cd9a3de80e7022734f68399a9247ac92d5fcef513e340e5aaab08547555b7f595e6b2488
SSDEEP 96:stD/dcWRZb9sEkTo5h16Z5fs7/x+6MhmuecSdGrj0jeKK+gq/Ts728XM1C7K:st7ubE+oKfsV+F2Er4jS3G6K
TLSH
T1E9D1A5025E28A97B4CC6E509BB35BA13E2F9547271D51E58EBFD472C08DA6CC6307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Local State
Size 15KB
SHA256 14dd3915715c762f2ef47d6c55f21e286218cee2d2a25d1bae6c616044c7b04f
MD5 798778acef1a0c52663d8e0fdba1e0fc
SHA1 fa6e1f4f2b4fa94c420db2d872106c122a027699
SHA512 a87e52ecfa49d3e0d022bc55ee7477e81fb6fb2a0856bed54361933e25cf822a15ca4bb834942eb74368fa54ce4c5d76522d30e65c1855d331f3d6f5b9cb39f2
SSDEEP 384:VOjae3af7pOMe4tyUOh8iqLyWpMmGrNBS5p98zKisdcYJa:4jaeqD4MlshiLdMm99YKis6/
TLSH
T144729EAB58B83DB79D33C80ABE866A5B5B3041E9C6917F9DECD92B0D01D70CE1206C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Local State
Size 2KB
SHA256 8aefbbbf608361a48679350d1d73ffa992cf996eebeb1d37e5f29a99e7bcef28
MD5 2c9fd80bb73102b45dc0035f2f0dbb46
SHA1 a594a84d3587be1ff5bf3c2cad2d4cec87225d7e
SHA512 2b6a6378e1bb0706e82cb8a255d127b9cdb87f483df6cb47f3b0efc8431db8a4bccddc7b281c9e1761903e7714cf1fb1bb83af941d4156018d1781904636989d
TLSH
T1BA51B3337854AA36A9F287087F962E539A3951A5AB612F64EADD0B0C01C789C1707C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Local State
Size 3KB
SHA256 3973b6e007e843aa4d2da985ed6ccadba57f5d3c94c543e69c3e4664e2334083
MD5 95b3a10c20449d572c79bf6c02c8ac8e
SHA1 ac95167a1f77bdff4242f571688b63c07ddab7e1
SHA512 fa48ba2362bf06baf1c743444c70eb8b801426f8d9d667e40fc34be8d9c72c726034af3280640a8ad8b3bb77ac45c5a5e88ac52a481d3e782eb19f3571460a52
TLSH
T1C071887B68A4E9375DF38A087E862F46A7655136EA913FA8D9EC0F0C01C769C1353C16
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59834f.TMP

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Local State~RFe59834f.TMP
Size 1KB
SHA256 2ff16a0d999fd0f7ee5213680a149a45575db59ed05f4cc8a1cbda6bf2659973
MD5 b4720a3fbc42c50a784898a1c732b11d
SHA1 09be9750179083994bfa6084d6207309851112c2
SHA512 54f41b2eefc2890f02a02c6520987ea7874577fa5f1395685ca8b4ad4ab28f6b8ee24733089df747814b8e9a19d22c8d80c14352210ce204f075eaa0885363cd
TLSH
T1F93174B7A4A49E31B8A2420A3792AECB1F24007A83100F48F9CE470D02D789C5A2FC32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2908-26-0x00007FFF79ED0000-0x00007FFF79ED1000-memory.dmp

Download

memory/4160-119-0x00007FFF79ED0000-0x00007FFF79ED1000-memory.dmp

Download

memory/5944-299-0x0000023611050000-0x0000023611051000-memory.dmp

Download

memory/5944-308-0x0000023611050000-0x0000023611051000-memory.dmp

Download

memory/5944-305-0x0000023611050000-0x0000023611051000-memory.dmp

Download

memory/5944-307-0x0000023611050000-0x0000023611051000-memory.dmp

Download

memory/5944-306-0x0000023611050000-0x0000023611051000-memory.dmp

Download

memory/5944-304-0x0000023611050000-0x0000023611051000-memory.dmp

Download

memory/5944-303-0x0000023611050000-0x0000023611051000-memory.dmp

Download

memory/5944-297-0x0000023611050000-0x0000023611051000-memory.dmp

Download