f4101ecaf6463e95398da0e137ddd647a2344daa2f1a6ee768493124b6772222

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 18:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PortFlow_update.exe
Size 45.0MB
Sample260623-w6f9csft5j
SHA256 f4101ecaf6463e95398da0e137ddd647a2344daa2f1a6ee768493124b6772222
MD5 d42cefc1aded29e65696210e90305dcb
SHA1 814aa899fa5b584f4e6a0437f78d8e6b6dcf7ef0
SHA512 80cbb94853498edacf1b6d94cac683b7df707abe9eb5b9cc964eeafb38b9b8504c8655cecbc266d4b6a16ff7b8a9963afbb25cf2bf7b361b5307dd52a1e2d023
SSDEEP 393216:hvYKvo9eihzRjvcuQIXAU8N1Dd4O4J+cJWGgk:hwAo4qzhcMAU8DDDrGj
TLSH
T104A71953F8E21994D4EAC174D672823BFBB13869077813E70690F3205F3ABD09AB6B55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation trojan

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4816	netsh.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	PortFlow_update.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1538128085\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1809354167\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1809354167\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1538128085\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1538128085\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1809354167\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1809354167\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1809354167\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1538128085\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1809354167\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1809354167\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1809354167\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-sk.hyb	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1809354167\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-hi.hyb	msedgewebview2.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\AppUserModelId\PortFlow_update.exe	PortFlow_update.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\AppUserModelId	PortFlow_update.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\CLSID\{1dcf8ad4-d2cf-4972-8d34-263d41b9a60f}	PortFlow_update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\AppUserModelId\PortFlow_update.exe\IconUri = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PortFlow_update.exe{1dcf8ad4-d2cf-4972-8d34-263d41b9a60f}.png"	PortFlow_update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\CLSID\{0F82E845-CB89-4039-BDBF-67CA33254C76}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PortFlow_update.exe"	PortFlow_update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\AppUserModelId\PortFlow_update.exe\CustomActivator = "{1dcf8ad4-d2cf-4972-8d34-263d41b9a60f}"	PortFlow_update.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\CLSID\{1dcf8ad4-d2cf-4972-8d34-263d41b9a60f}\LocalServer32	PortFlow_update.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\CLSID	PortFlow_update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\CLSID\{1dcf8ad4-d2cf-4972-8d34-263d41b9a60f}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\PortFlow_update.exe\" %1"	PortFlow_update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\AppUserModelId\PortFlow_update.exe\DisplayName = "PortFlow_update.exe"	PortFlow_update.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\CLSID\{0F82E845-CB89-4039-BDBF-67CA33254C76}\LocalServer32	PortFlow_update.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\CLSID\{0F82E845-CB89-4039-BDBF-67CA33254C76}	PortFlow_update.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4752	msedgewebview2.exe
4752	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2636	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2160	PortFlow_update.exe
2160	PortFlow_update.exe
2160	PortFlow_update.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2160	PortFlow_update.exe
2160	PortFlow_update.exe
2160	PortFlow_update.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2636	2160	PortFlow_update.exe	88
PID 2636 wrote to memory of 3368	2636	msedgewebview2.exe	89
PID 2636 wrote to memory of 884	2636	msedgewebview2.exe	90
PID 2636 wrote to memory of 884	2636	msedgewebview2.exe	90
PID 2636 wrote to memory of 884	2636	msedgewebview2.exe	90
PID 2636 wrote to memory of 884	2636	msedgewebview2.exe	90
PID 2636 wrote to memory of 4316	2636	msedgewebview2.exe	91
PID 2636 wrote to memory of 1892	2636	msedgewebview2.exe	92
PID 2636 wrote to memory of 1892	2636	msedgewebview2.exe	92
PID 2636 wrote to memory of 1892	2636	msedgewebview2.exe	92
PID 2636 wrote to memory of 3656	2636	msedgewebview2.exe	93
PID 2636 wrote to memory of 3656	2636	msedgewebview2.exe	93
PID 2636 wrote to memory of 3656	2636	msedgewebview2.exe	93
PID 2636 wrote to memory of 3656	2636	msedgewebview2.exe	93
PID 2636 wrote to memory of 3656	2636	msedgewebview2.exe	93
PID 2160 wrote to memory of 4816	2160	PortFlow_update.exe	94
PID 2636 wrote to memory of 844	2636	msedgewebview2.exe	99
PID 2636 wrote to memory of 844	2636	msedgewebview2.exe	99
PID 2636 wrote to memory of 844	2636	msedgewebview2.exe	99
PID 2636 wrote to memory of 5444	2636	msedgewebview2.exe	100
PID 2636 wrote to memory of 5444	2636	msedgewebview2.exe	100
PID 2636 wrote to memory of 5444	2636	msedgewebview2.exe	100
PID 2636 wrote to memory of 4752	2636	msedgewebview2.exe	101
PID 2636 wrote to memory of 4812	2636	msedgewebview2.exe	102
PID 2636 wrote to memory of 4812	2636	msedgewebview2.exe	102
PID 2636 wrote to memory of 4812	2636	msedgewebview2.exe	102

C:\Users\Admin\AppData\Local\Temp\PortFlow_update.exe
"C:\Users\Admin\AppData\Local\Temp\PortFlow_update.exe"
1⤵
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=PortFlow_update.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=2160.2796.499428389914193096 /pfhostedapp:ec1b66b092008dba3de57216d0b6cde6fcc355f5
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView /prefetch:4 /pfhostedapp:ec1b66b092008dba3de57216d0b6cde6fcc355f5 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x104,0x194,0x7ffe790f5fd8,0x7ffe790f5fe4,0x7ffe790f5ff0
    3⤵
    PID:3368
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView" --webview-exe-name=PortFlow_update.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1716 --field-trial-handle=1732,i,4578086794198194810,6477742654118300111,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:ec1b66b092008dba3de57216d0b6cde6fcc355f5
    3⤵
    PID:884
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView" --webview-exe-name=PortFlow_update.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=1984 --field-trial-handle=1732,i,4578086794198194810,6477742654118300111,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:ec1b66b092008dba3de57216d0b6cde6fcc355f5
    3⤵
    PID:4316
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView" --webview-exe-name=PortFlow_update.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2288 --field-trial-handle=1732,i,4578086794198194810,6477742654118300111,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:ec1b66b092008dba3de57216d0b6cde6fcc355f5
    3⤵
    PID:1892
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView" --webview-exe-name=PortFlow_update.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3552 --field-trial-handle=1732,i,4578086794198194810,6477742654118300111,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:ec1b66b092008dba3de57216d0b6cde6fcc355f5 /prefetch:1
    3⤵
    PID:3656
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView" --webview-exe-name=PortFlow_update.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4568 --field-trial-handle=1732,i,4578086794198194810,6477742654118300111,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:ec1b66b092008dba3de57216d0b6cde6fcc355f5
    3⤵
    PID:844
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView" --webview-exe-name=PortFlow_update.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4700 --field-trial-handle=1732,i,4578086794198194810,6477742654118300111,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:ec1b66b092008dba3de57216d0b6cde6fcc355f5
    3⤵
    PID:5444
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView" --webview-exe-name=PortFlow_update.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4580 --field-trial-handle=1732,i,4578086794198194810,6477742654118300111,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:ec1b66b092008dba3de57216d0b6cde6fcc355f5
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4752
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView" --webview-exe-name=PortFlow_update.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=1112 --field-trial-handle=1732,i,4578086794198194810,6477742654118300111,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:ec1b66b092008dba3de57216d0b6cde6fcc355f5
    3⤵
    PID:4812
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall show rule "name=PortFlow Launcher"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c9fe11c4fddb7a5fadf3c4d074d5b6d92a20300701a63aabc602d6831c141318
MD5 883848f30c753a8a8a2f4259eec38a2f
SHA1 8e58e344a81196cd3a8c348c489c16dc0a7aada6
SHA512 6a2b21e1829ff1d5f5dc2165297178343c559e34a0bd50a9fa5e1a50637e473bea59edcffa34184c71ef6b813d0bd9834e4f0837a0a7ca4cb1509136c81fe0ed
TLSH
T19DD0121772020278C0103573164772484882C20B8105404174288D7E6A844941903452
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 23911a9dbd16f4af55ede22d0ef1296d56dd6fa7b5f7cd79355b7fb96a9896b7
MD5 317f06c26dac66efaea329faac9c823e
SHA1 ef6d7a0e4b007f5657a7460fb3747bb34967e105
SHA512 38d5e2f8c2c5bb74c9ab2efbf541a213ce0869cbf1972072dd7183d41b6196afb6b6a49c41706b00e708e63e9c91bd1b39d5258c7247dfe2f0f8ca3e0b6ce116
TLSH
T11AD00415D1011174C0003571175D7350C5C3C5005511114131100C7554C04441043011
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 e1fdc9d7ec65ad53f5bb80aa67ae56814d9969b1d936e89a78e549b1b7c56f86
MD5 6defd1db92fa51a97a22c00e11ca596b
SHA1 8419fc8e6b6b93b4e894785993cb3b9b4ebab564
SHA512 cb099693bfba761254c361e2c64428067fcdf2925cf305d15e7e9f309b992fc8582d557f82840307c0adc62f6dc13993296334d1dc4d3252baa4f605cfc5a9aa
TLSH
T176B022A88A0FC0C3CA0803BB20C22202B3308C8002B30F3280C080B2EE38380C303220
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596680.TMP

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe596680.TMP
Size 48B
SHA256 46489f28b9b86fb54a7308ae4632b6f4bd193224be168d2cc77e3db696238ee4
MD5 307511d506645b8eb50158dbf2054ded
SHA1 6cfbc93080ebd2b2d43b900563ebe85a238563a3
SHA512 621a518d74ae14d9da38fd4ac6c2762d5393087414cefc0168b5a04a60c3690873375f85e39823865a9b8e3d4d34c0032ab03637670a3a8002cbba0ec0544328
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

79a4646d-c09b-4758-9632-9af5db9858fc.tmp

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Default\Network\79a4646d-c09b-4758-9632-9af5db9858fc.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 3b79624eddbc4ad4871d04c511547c9677b5e9b0fb9984d521618daa0572efed
MD5 b5eeb723edc610fd0e5c0a5ff4e20904
SHA1 b4bdefcc380d238b51e57cb7f5a4a1fb2c612644
SHA512 a0f769927493c8e39d33c1c0d126fa075be615119c468abd82f0ccf5f1a59e2bb353fda2c23b26bcb58de7b985c7e64b6389d2fbda72d08bc5ae9f4b95869b3c
TLSH
T1A0316FB7C2E4C63D885562E427247867CD2E051953283D2BCDDAEBEA6BE1471E71090E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a2982.TMP

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Default\Network\Network Persistent State~RFe5a2982.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Default\Network\TransportSecurity
Size 523B
SHA256 290cd657e6f2f97d540a5565eba965bbb1516492201b52c80b63a24b8a3a4c3c
MD5 dd1b39f3f1fa970f19abd21c5c05f0fe
SHA1 ecab383f5a4a9889e67ac0f9a70ce18db3a598af
SHA512 208a98e82ba24647bdfd9a3d143e1b14d9c04d0ea6da2a2f6fba453a7b8abd2ea1098631161a95dea23aeea4c5b5e2223fa92c00ba579e64b27fa48ed7e322f2
TLSH
T1CDF050DBA0FFF4A710B91A6E0C58BC016E377131514178E5DB93467CB0852A31A02432
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Default\Network\TransportSecurity
Size 523B
SHA256 65d638d0e9a5a495c00734a22712a8b2e0fc23dddbd038213efee96a56195f87
MD5 9ec6341dd963d496c1fcc4b2fe9defda
SHA1 154a339cf3827f6a7c25d58fb34808389bc5d6d2
SHA512 13ac73a12e71513e188d69558f2b643a49c7edc89117b1e5bded8d44569b8df92b7f4231512a7f0a881905b88df4a5d00e9ef2f476578719789521cdd5a9d996
TLSH
T133F050DBA0FFF4A710B91A6E0858FC016E377031614178E5DB93467CB0D11A31A02432
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Default\Network\TransportSecurity
Size 523B
SHA256 6fe3534e1ebeb1c641e346f8af8a425af5aa7004ca38f74ae11d0986ee710ecf
MD5 92850bf2eb63e1cdfc743cd74c468b65
SHA1 ec2c6eaefdb801ff8510b54182c54c85151a8668
SHA512 b5e2e1678903e61a7aefed0dbc827f05500504d6e78b88f56a5bd6980ecde8f8b3cb371f7b989b08527b3fe3772f61f641a465f0aa19684615b5389cb72493a9
TLSH
T1F5F02BDB90FAE4A710A91A6E08587801AE3B7035618278E5DA82466CB0842A31602433
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Default\Network\TransportSecurity
Size 523B
SHA256 c1108dd692352f217b58e825832eca23e56909fdbab08df40ee7a4e00b65cf1d
MD5 e441e87e3587eb5d4b8743a0cb9064e2
SHA1 58f300bfd9091bb32055cb35d87ff9b8909b0649
SHA512 c8c9ad88651e836641409686efa81735a302a43b654550d06d04c3861da1402a4aa8fa56d99c8acc9db258a752226e01dab7205dcb6426da76171d49036846ce
TLSH
T1C9F050DBA0FFF4A710B92B6E0848BC016E367131528274E5DF93466CB0841A35603832
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Default\Network\TransportSecurity
Size 523B
SHA256 43925dc397133bd337e8981fcdff370164e16dac8966aa1ac99e025e2d24d3b3
MD5 e41148301957d828fb1d75944d88a6ad
SHA1 4cb44d36a7f28c5f596911fb2c7312d0ee190ab5
SHA512 4dab9f6e3a641eb2fe0f5eea36a452d5b85c50be64ed5d0e1b8104dcfc6f3a11dfd02a874d67d3e720a0201b819af1329470bebc0c304fb29f298774dd313d2a
TLSH
T1D5F050DBA0FFF4A720A91A6F1C58BC15AE3A7031614274E5EBD74A6CF0811A32A02432
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Default\Network\TransportSecurity
Size 523B
SHA256 2ce34829e8fd53b7b904b5f8af7e9d59e369b36a665d34fcb2e032c793de03fc
MD5 d93eab237aa92737673f8304ee7c29fb
SHA1 09617a93992e7fab4ff0cad5db7088f3f5c79a00
SHA512 e9b0ba99462a839e2a3aacc5771127709f4fc924dcfea03033881f3ed89f4583602fafb94a951679d633fdc0494f265373cf062ae6aaa333bf5896902e5ae53e
TLSH
T1DBF050DB90FFF4A710B91A6E1D587C11AE367035718178E5DFD74A6CF0806A75602436
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe599188.TMP

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Default\Network\TransportSecurity~RFe599188.TMP
Size 523B
SHA256 508a85e28307446d816f7cc78778dcfb338638fd125c9b8440e0d1b001641729
MD5 2f7191aef40252b325416a46ddb2331c
SHA1 c0f9be72bf30d46c703f8ce8e18cb508adce1c47
SHA512 eb2d54dbea413bed990f55d1f02b453f030e61a9b2040bbf6a752833dac50d94a1cb1c361c993acefd4414e05b1769c4c78ab4e2c868a916edd9bb8b3fb276b7
TLSH
T18CF0509BA0FEF06710AD1B6B0858BC016E37713051C278E9DAC2467CB0850E71A06876
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 f5138987c469b1a05d3d7cf3db5db69778f50549734e44663b7cd70867fd6dc2
MD5 ea80fbe269ad45ca46213372f4a780e2
SHA1 9872ead49e4e01435de98045aefc416a696f9094
SHA512 422fb32e20434fddd82b0a49aaa3e4a267464876a36bf62e8de912dcc42275986646fa9c5f3d43139ad5b2a953241835dc27bd8bf2c6abcf75a7290a2e248a9c
SSDEEP 96:stE/dcdFGAb9snskio5h16Z5ls7/x+6MhmuecS5G1ejeIK+gynfEv28XM1C7K:stIuAsDoKlsV+F25GQjolvG6K
TLSH
T1E7D197025E68697B4CC6E119BA69BA13E2F5647271D11E98EBFC4A2C04DB9CC6307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e37a8af1-afbe-4097-aa5f-e9e21e6bfb42.tmp

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Default\e37a8af1-afbe-4097-aa5f-e9e21e6bfb42.tmp
Size 6KB
SHA256 a975780c161bfa6ea4b1f9c676b9726c5363d538f77f26cac67d81e7b0c17f4a
MD5 fd7df7e5913a8e10c9c9f908574b32c5
SHA1 8d93ce2aac423b467791472a633ac10f685558a4
SHA512 25a5c8f77c2dadb23e632428d4d489bbf520718363d05df8dd09c514d9e0f62a893a0a5c9b6089085c024b50391cc8a0de853273690a937d726569c3bc552009
SSDEEP 96:stE/dcdeAb9snskio5h16Z5ls7/x+6MhmuecS5G1ejeIK+g3Ee28XM1C7K:stIuSsDoKlsV+F25GQjoaeG6K
TLSH
T106D1B8025E2C697B4CC6E119BA79BA17E2F5647271D11E98EBFC4A2C04DB5CC6307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Local State
Size 2KB
SHA256 73337c4e9642fd8879001fed22f74dad6b3b2acc5a1d08fa8efc656132b5b4b8
MD5 712297b6ef2449e8bd6da27523ad3bae
SHA1 21e7a77ea983d5a4f5f5145f63960d635ed23fee
SHA512 7ed0d3ce94c4f9e613cf513754bae9e2b7ee6d1d598affd980b2f8ac7772f80b54c17e2984b465e675f4d4445f56c9da2f7dd3572ab3e7b44c1ca897a95ccfc8
TLSH
T17F51B5336D585B7789F29605798B7F53EE7860A5BE422F44A9DC0B0C01CB98C2317C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Local State
Size 15KB
SHA256 9a65e31d74e0e76147ffb2c9461846ebe274e944d89e30d02f10fd42ae07b120
MD5 23c6bd2c7da2e51e31e749c53f60df61
SHA1 2950e903ccaebec4766db6b682b54e9162f881f7
SHA512 c7a234b39336f502f39539e5719ed964f829284523c092fbd0b8c5c3e97af767d913d6fd8edd78e8dc16fd5b576b742fe49ef6588f7fee89c710d043e26434ff
SSDEEP 384:ZOjae3af7pOMe4tyUOh8iqLyWpMmGrNBSXnWTSisdlYsT:kjaeqD4MlshiLdMmFWSisX1
TLSH
T103729E6B5DB82DB78C339806BA866B576B7040EAA6827E9DECD81B0D01D71CE1307C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Local State
Size 3KB
SHA256 dbeaadff32c613b64cf0354fc0b121b3c5c723915e7e7293a0719cfc2c3b9597
MD5 6c9b3ddeea1e90c609bcd8c482f92260
SHA1 01fef6b882bebaf776db2f23c8235fd3483bd336
SHA512 5e2414f28b72a590338493a20946073d4a9dbc0ce1bb6ba0a205844a2682dfa5a045c0f4f246d9bff53c1d79c9885ea086b4174f0ae01da1000a6bdc0bbbe825
TLSH
T10571743769A8997B4DF29A05B9C66F07BBA55026B9853F98D9EC0F0C01C76C82353C26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5914f5.TMP

Path C:\Users\Admin\AppData\Roaming\PortFlow_update.exe\EBWebView\Local State~RFe5914f5.TMP
Size 1KB
SHA256 02e1b85dba353ab3ae81ca7e05c4fc4004c5dc1b28a1cbf41246fd8c19380f5e
MD5 2fac0194ec6a24e8b32ebad22cced2a1
SHA1 dc72602b7389ccbfe85701fffec3b77e6a7e6779
SHA512 314be9f68585fcb09310835ab75884f4d154ba1c725689ea9e1ed77d579f54a9b1ecb20fd889b713ed2f1d39f294e736685e11c19252dc35c6395632268fe9b5
TLSH
T1EA31767399981B72ACA261073183FEC7AE60207AB6415E4875DD4B1C52DB4CCA63FC32
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2636_1466783515\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/844-273-0x00007FFE9BAF0000-0x00007FFE9BAF1000-memory.dmp

Download

memory/844-274-0x00007FFE99D40000-0x00007FFE99D41000-memory.dmp

Download

memory/884-186-0x000001E8C1FE0000-0x000001E8C2179000-memory.dmp

Download

memory/884-24-0x00007FFE9A8D0000-0x00007FFE9A8D1000-memory.dmp

Download

memory/3656-102-0x00007FFE9A8D0000-0x00007FFE9A8D1000-memory.dmp

Download

memory/4752-533-0x000001EF40CB0000-0x000001EF40CB1000-memory.dmp

Download

memory/4752-537-0x000001EF40CB0000-0x000001EF40CB1000-memory.dmp

Download

memory/4752-536-0x000001EF40CB0000-0x000001EF40CB1000-memory.dmp

Download

memory/4752-535-0x000001EF40CB0000-0x000001EF40CB1000-memory.dmp

Download

memory/4752-534-0x000001EF40CB0000-0x000001EF40CB1000-memory.dmp

Download

memory/4752-532-0x000001EF40CB0000-0x000001EF40CB1000-memory.dmp

Download

memory/4752-528-0x000001EF40CB0000-0x000001EF40CB1000-memory.dmp

Download

memory/4752-526-0x000001EF40CB0000-0x000001EF40CB1000-memory.dmp

Download