721f066380b3f99c92e39b3286b9851c4d59119208f420b9998e7f70cbe70ec6

Analysis

user interaction
yes
max time kernel
279s
max time network
293s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
15/08/2026, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Portmaster_2.2.1_x64-setup.exe
Size 96.8MB
Sample260815-scea5adl21
SHA256 721f066380b3f99c92e39b3286b9851c4d59119208f420b9998e7f70cbe70ec6
MD5 e02558ef20c81a5458ab6a1aab4ade42
SHA1 9718d566336141ce99f1034451c9ea882bfaf258
SHA512 e838adf9a3509a88d0003336e1cf86ad8f0aa52880a52250fdb22f785c6c3c5a81c1572096d0d353458b032ea862ff8e7981c29c73c5b8dc83d2e1eebdcc4946
SSDEEP 1572864:7id1zV/kXljlvgA6D8thDxMWUxkhK2yHUs5M4XxDaGUcNhSS+ChPj7m40bODU:7cPCl2AY83DSRkwQMMKUfoSSZ5/mPF
TLSH
T1312833AA9898D745C764C1364C82D57E42ADFDA01BC3D81B39E37C07F63A10A8466DFB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence spyware trojan

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3976 created 3420	3976	Portmaster_2.2.1_x64-setup.exe	57

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Portmaster = "\"C:\\Program Files\\Portmaster\\portmaster.exe\" --with-prompts --with-notifications --background"	Portmaster_2.2.1_x64-setup.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000\Control Panel\International\Geo\Nation	portmaster.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\Portmaster\WebView2Loader.dll	Portmaster_2.2.1_x64-setup.exe
File created	C:\Program Files\Portmaster\portmaster.zip	Portmaster_2.2.1_x64-setup.exe
File created	C:\Program Files\Portmaster\assets.zip	Portmaster_2.2.1_x64-setup.exe
File created	C:\Program Files\Portmaster\portmaster.exe	Portmaster_2.2.1_x64-setup.exe
File created	C:\Program Files\Portmaster\uninstall.exe	Portmaster_2.2.1_x64-setup.exe
File created	C:\Program Files\Portmaster\portmaster-core.exe	Portmaster_2.2.1_x64-setup.exe
File created	C:\Program Files\Portmaster\portmaster-kext.sys	Portmaster_2.2.1_x64-setup.exe
File created	C:\Program Files\Portmaster\portmaster-core.dll	Portmaster_2.2.1_x64-setup.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_1289468869\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_1692846825\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_1692846825\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_1289468869\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_730252948\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_1289468869\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_1692846825\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_1692846825\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_1289468869\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_730252948\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_1582564203\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_1289468869\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_1692846825\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_1692846825\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_1289468869\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_1582564203\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_1692846825\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_1692846825\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_2019775882\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3132_1582564203\protocols.json	msedgewebview2.exe

Executes dropped EXE 9 IoCs

pid	Process
1644	portmaster.exe
4404	portmaster-core.exe
4952	portmaster-kext.sys
4960	portmaster.exe
544	portmaster-core.exe
2480	portmaster-core.exe
2508	portmaster-core.exe
5472	portmaster-core.exe
1628	portmaster-core.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3452	sc.exe
3324	sc.exe
5424	sc.exe
4312	sc.exe
3744	sc.exe

Loads dropped DLL 20 IoCs

pid	Process
3976	Portmaster_2.2.1_x64-setup.exe
3976	Portmaster_2.2.1_x64-setup.exe
3976	Portmaster_2.2.1_x64-setup.exe
3976	Portmaster_2.2.1_x64-setup.exe
3976	Portmaster_2.2.1_x64-setup.exe
3976	Portmaster_2.2.1_x64-setup.exe
3976	Portmaster_2.2.1_x64-setup.exe
3976	Portmaster_2.2.1_x64-setup.exe
3976	Portmaster_2.2.1_x64-setup.exe
3976	Portmaster_2.2.1_x64-setup.exe
3976	Portmaster_2.2.1_x64-setup.exe
1644	portmaster.exe
4404	portmaster-core.exe
3976	Portmaster_2.2.1_x64-setup.exe
4960	portmaster.exe
544	portmaster-core.exe
2480	portmaster-core.exe
2508	portmaster-core.exe
5472	portmaster-core.exe
1628	portmaster-core.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	portmaster.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5640	powershell.exe
2088	powershell.exe
372	powershell.exe
764	powershell.exe
5616	powershell.exe
5248	powershell.exe
4960	powershell.exe
2716	powershell.exe
5500	powershell.exe
4380	powershell.exe
4316	powershell.exe
3608	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Portmaster_2.2.1_x64-setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	portmaster-core.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	portmaster-core.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	portmaster-core.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	portmaster-core.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	portmaster-core.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	portmaster-core.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	portmaster-core.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	portmaster-core.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	portmaster-core.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	portmaster-core.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	portmaster-core.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	portmaster-core.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	portmaster-core.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	portmaster-core.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	portmaster-core.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	portmaster-core.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	portmaster-core.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A	portmaster-core.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 0400000001000000100000002edae4397f9c8f37d1709f2617513a8e0f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd80b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000450043004300000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6514000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a4030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a19000000010000001000000011a2b3490cb6c379a89e76c3569452d72000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	portmaster-core.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 5c00000001000000040000008001000019000000010000001000000011a2b3490cb6c379a89e76c3569452d7030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a414000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd6200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6509000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200045004300430000000f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd80400000001000000100000002edae4397f9c8f37d1709f2617513a8e2000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	portmaster-core.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3976	Portmaster_2.2.1_x64-setup.exe
3976	Portmaster_2.2.1_x64-setup.exe
4404	portmaster-core.exe
4404	portmaster-core.exe
4404	portmaster-core.exe
4404	portmaster-core.exe
4404	portmaster-core.exe
4404	portmaster-core.exe
4380	powershell.exe
4380	powershell.exe
4404	portmaster-core.exe
4404	portmaster-core.exe
4404	portmaster-core.exe
4404	portmaster-core.exe
4404	portmaster-core.exe
4404	portmaster-core.exe
4404	portmaster-core.exe
4404	portmaster-core.exe
4404	portmaster-core.exe
4404	portmaster-core.exe
4404	portmaster-core.exe
4404	portmaster-core.exe
4404	portmaster-core.exe
4404	portmaster-core.exe
4404	portmaster-core.exe
4404	portmaster-core.exe
4404	portmaster-core.exe
4404	portmaster-core.exe
2088	powershell.exe
2088	powershell.exe
2088	powershell.exe
4404	portmaster-core.exe
4404	portmaster-core.exe
544	portmaster-core.exe
544	portmaster-core.exe
544	portmaster-core.exe
544	portmaster-core.exe
544	portmaster-core.exe
544	portmaster-core.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
544	portmaster-core.exe
544	portmaster-core.exe
544	portmaster-core.exe
544	portmaster-core.exe
544	portmaster-core.exe
544	portmaster-core.exe
544	portmaster-core.exe
544	portmaster-core.exe
544	portmaster-core.exe
544	portmaster-core.exe
544	portmaster-core.exe
544	portmaster-core.exe
544	portmaster-core.exe
544	portmaster-core.exe
372	powershell.exe
372	powershell.exe
372	powershell.exe
2480	portmaster-core.exe
2480	portmaster-core.exe
2480	portmaster-core.exe
2480	portmaster-core.exe
2480	portmaster-core.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3132	msedgewebview2.exe
3132	msedgewebview2.exe
3132	msedgewebview2.exe
3132	msedgewebview2.exe
3132	msedgewebview2.exe
3132	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4404	portmaster-core.exe
Token: SeDebugPrivilege	4380	powershell.exe
Token: SeIncreaseQuotaPrivilege	4380	powershell.exe
Token: SeSecurityPrivilege	4380	powershell.exe
Token: SeTakeOwnershipPrivilege	4380	powershell.exe
Token: SeLoadDriverPrivilege	4380	powershell.exe
Token: SeSystemProfilePrivilege	4380	powershell.exe
Token: SeSystemtimePrivilege	4380	powershell.exe
Token: SeProfSingleProcessPrivilege	4380	powershell.exe
Token: SeIncBasePriorityPrivilege	4380	powershell.exe
Token: SeCreatePagefilePrivilege	4380	powershell.exe
Token: SeBackupPrivilege	4380	powershell.exe
Token: SeRestorePrivilege	4380	powershell.exe
Token: SeShutdownPrivilege	4380	powershell.exe
Token: SeDebugPrivilege	4380	powershell.exe
Token: SeSystemEnvironmentPrivilege	4380	powershell.exe
Token: SeRemoteShutdownPrivilege	4380	powershell.exe
Token: SeUndockPrivilege	4380	powershell.exe
Token: SeManageVolumePrivilege	4380	powershell.exe
Token: 33	4380	powershell.exe
Token: 34	4380	powershell.exe
Token: 35	4380	powershell.exe
Token: 36	4380	powershell.exe
Token: SeIncreaseQuotaPrivilege	4380	powershell.exe
Token: SeSecurityPrivilege	4380	powershell.exe
Token: SeTakeOwnershipPrivilege	4380	powershell.exe
Token: SeLoadDriverPrivilege	4380	powershell.exe
Token: SeSystemProfilePrivilege	4380	powershell.exe
Token: SeSystemtimePrivilege	4380	powershell.exe
Token: SeProfSingleProcessPrivilege	4380	powershell.exe
Token: SeIncBasePriorityPrivilege	4380	powershell.exe
Token: SeCreatePagefilePrivilege	4380	powershell.exe
Token: SeBackupPrivilege	4380	powershell.exe
Token: SeRestorePrivilege	4380	powershell.exe
Token: SeShutdownPrivilege	4380	powershell.exe
Token: SeDebugPrivilege	4380	powershell.exe
Token: SeSystemEnvironmentPrivilege	4380	powershell.exe
Token: SeRemoteShutdownPrivilege	4380	powershell.exe
Token: SeUndockPrivilege	4380	powershell.exe
Token: SeManageVolumePrivilege	4380	powershell.exe
Token: 33	4380	powershell.exe
Token: 34	4380	powershell.exe
Token: 35	4380	powershell.exe
Token: 36	4380	powershell.exe
Token: SeIncreaseQuotaPrivilege	4380	powershell.exe
Token: SeSecurityPrivilege	4380	powershell.exe
Token: SeTakeOwnershipPrivilege	4380	powershell.exe
Token: SeLoadDriverPrivilege	4380	powershell.exe
Token: SeSystemProfilePrivilege	4380	powershell.exe
Token: SeSystemtimePrivilege	4380	powershell.exe
Token: SeProfSingleProcessPrivilege	4380	powershell.exe
Token: SeIncBasePriorityPrivilege	4380	powershell.exe
Token: SeCreatePagefilePrivilege	4380	powershell.exe
Token: SeBackupPrivilege	4380	powershell.exe
Token: SeRestorePrivilege	4380	powershell.exe
Token: SeShutdownPrivilege	4380	powershell.exe
Token: SeDebugPrivilege	4380	powershell.exe
Token: SeSystemEnvironmentPrivilege	4380	powershell.exe
Token: SeRemoteShutdownPrivilege	4380	powershell.exe
Token: SeUndockPrivilege	4380	powershell.exe
Token: SeManageVolumePrivilege	4380	powershell.exe
Token: 33	4380	powershell.exe
Token: 34	4380	powershell.exe
Token: 35	4380	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe
1644	portmaster.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 4380	4404	portmaster-core.exe	92
PID 1644 wrote to memory of 3132	1644	portmaster.exe	93
PID 3132 wrote to memory of 1220	3132	msedgewebview2.exe	94
PID 3132 wrote to memory of 4568	3132	msedgewebview2.exe	95
PID 3132 wrote to memory of 4568	3132	msedgewebview2.exe	95
PID 3132 wrote to memory of 4568	3132	msedgewebview2.exe	95
PID 3132 wrote to memory of 792	3132	msedgewebview2.exe	96
PID 3132 wrote to memory of 4600	3132	msedgewebview2.exe	97
PID 3132 wrote to memory of 4600	3132	msedgewebview2.exe	97
PID 3132 wrote to memory of 4292	3132	msedgewebview2.exe	98
PID 3132 wrote to memory of 4292	3132	msedgewebview2.exe	98
PID 3132 wrote to memory of 4292	3132	msedgewebview2.exe	98
PID 4404 wrote to memory of 2088	4404	portmaster-core.exe	103
PID 3976 wrote to memory of 4960	3976	Portmaster_2.2.1_x64-setup.exe	108
PID 3132 wrote to memory of 3672	3132	msedgewebview2.exe	109
PID 3132 wrote to memory of 3672	3132	msedgewebview2.exe	109
PID 3132 wrote to memory of 3672	3132	msedgewebview2.exe	109
PID 1644 wrote to memory of 3744	1644	portmaster.exe	111
PID 544 wrote to memory of 4316	544	portmaster-core.exe	114
PID 544 wrote to memory of 372	544	portmaster-core.exe	116
PID 3132 wrote to memory of 4260	3132	msedgewebview2.exe	122
PID 3132 wrote to memory of 4260	3132	msedgewebview2.exe	122
PID 3132 wrote to memory of 4260	3132	msedgewebview2.exe	122
PID 1644 wrote to memory of 3452	1644	portmaster.exe	123
PID 2480 wrote to memory of 764	2480	portmaster-core.exe	128
PID 2480 wrote to memory of 5616	2480	portmaster-core.exe	130
PID 3132 wrote to memory of 6028	3132	msedgewebview2.exe	134
PID 3132 wrote to memory of 6028	3132	msedgewebview2.exe	134
PID 3132 wrote to memory of 6028	3132	msedgewebview2.exe	134
PID 1644 wrote to memory of 3324	1644	portmaster.exe	135
PID 2508 wrote to memory of 5248	2508	portmaster-core.exe	138
PID 2508 wrote to memory of 3608	2508	portmaster-core.exe	140
PID 3132 wrote to memory of 4732	3132	msedgewebview2.exe	142
PID 3132 wrote to memory of 4732	3132	msedgewebview2.exe	142
PID 3132 wrote to memory of 4468	3132	msedgewebview2.exe	143
PID 3132 wrote to memory of 4468	3132	msedgewebview2.exe	143
PID 3132 wrote to memory of 5568	3132	msedgewebview2.exe	144
PID 3132 wrote to memory of 2708	3132	msedgewebview2.exe	145
PID 3132 wrote to memory of 2708	3132	msedgewebview2.exe	145
PID 3132 wrote to memory of 2320	3132	msedgewebview2.exe	146
PID 3132 wrote to memory of 2320	3132	msedgewebview2.exe	146
PID 3132 wrote to memory of 812	3132	msedgewebview2.exe	147
PID 3132 wrote to memory of 812	3132	msedgewebview2.exe	147
PID 3132 wrote to memory of 812	3132	msedgewebview2.exe	147
PID 1644 wrote to memory of 5424	1644	portmaster.exe	148
PID 5472 wrote to memory of 4960	5472	portmaster-core.exe	151
PID 5472 wrote to memory of 5640	5472	portmaster-core.exe	157
PID 3132 wrote to memory of 5848	3132	msedgewebview2.exe	159
PID 3132 wrote to memory of 5848	3132	msedgewebview2.exe	159
PID 3132 wrote to memory of 5848	3132	msedgewebview2.exe	159
PID 1644 wrote to memory of 4312	1644	portmaster.exe	160
PID 1628 wrote to memory of 2716	1628	portmaster-core.exe	163
PID 3132 wrote to memory of 1028	3132	msedgewebview2.exe	165
PID 3132 wrote to memory of 1028	3132	msedgewebview2.exe	165

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3420
- C:\Users\Admin\AppData\Local\Temp\Portmaster_2.2.1_x64-setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Portmaster_2.2.1_x64-setup.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3976
- C:\Program Files\Portmaster\portmaster.exe
  "C:\Program Files\Portmaster\portmaster.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4960

C:\Program Files\Portmaster\portmaster.exe
"C:\Program Files\Portmaster\portmaster.exe" --with-prompts --with-notifications --background
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=portmaster.exe --webview-exe-version=2.2.1 --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=RemoveRedirectionBitmap --lang=en-US --mojo-named-platform-channel-pipe=1644.2240.9778623086031587770
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3132
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffbe605b078,0x7ffbe605b084,0x7ffbe605b090
    3⤵
    PID:1220
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1876,i,12066762815891865957,17688143294826962515,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1860 /prefetch:2
    3⤵
    PID:4568
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2060,i,12066762815891865957,17688143294826962515,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:3
    3⤵
    PID:792
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2312,i,12066762815891865957,17688143294826962515,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:8
    3⤵
    PID:4600
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3496,i,12066762815891865957,17688143294826962515,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:4292
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4468,i,12066762815891865957,17688143294826962515,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:1
    3⤵
    PID:3672
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4504,i,12066762815891865957,17688143294826962515,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:1
    3⤵
    PID:4260
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4956,i,12066762815891865957,17688143294826962515,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:1
    3⤵
    PID:6028
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5112,i,12066762815891865957,17688143294826962515,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:8
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3744,i,12066762815891865957,17688143294826962515,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=780 /prefetch:8
    3⤵
    PID:4468
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4572,i,12066762815891865957,17688143294826962515,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
    3⤵
    PID:5568
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4304,i,12066762815891865957,17688143294826962515,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:8
    3⤵
    PID:2708
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4480,i,12066762815891865957,17688143294826962515,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:8
    3⤵
    PID:2320
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4644,i,12066762815891865957,17688143294826962515,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:1
    3⤵
    PID:812
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=2128,i,12066762815891865957,17688143294826962515,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:1
    3⤵
    PID:5848
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4588,i,12066762815891865957,17688143294826962515,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:8
    3⤵
    PID:1028
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" start PortmasterCore
  2⤵
  - Launches sc.exe
  PID:3744
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" start PortmasterCore
  2⤵
  - Launches sc.exe
  PID:3452
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" start PortmasterCore
  2⤵
  - Launches sc.exe
  PID:3324
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" start PortmasterCore
  2⤵
  - Launches sc.exe
  PID:5424
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" start PortmasterCore
  2⤵
  - Launches sc.exe
  PID:4312

C:\Program Files\Portmaster\portmaster-core.exe
"C:\Program Files\Portmaster\portmaster-core.exe" --log-dir=C:\ProgramData\Portmaster\logs
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive "[System.Console]::OutputEncoding = [System.Text.Encoding]::UTF8 Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1 | Get-NetIPConfiguration | Format-List"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive "[System.Console]::OutputEncoding = [System.Text.Encoding]::UTF8 Get-DnsClient -InterfaceIndex 5 | ConvertTo-Json -Depth 1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2088

C:\Program Files\Portmaster\portmaster-kext.sys
"C:\Program Files\Portmaster\portmaster-kext.sys"
1⤵
- Executes dropped EXE
PID:4952

C:\Program Files\Portmaster\portmaster-core.exe
"C:\Program Files\Portmaster\portmaster-core.exe" --log-dir=C:\ProgramData\Portmaster\logs
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive "[System.Console]::OutputEncoding = [System.Text.Encoding]::UTF8 Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1 | Get-NetIPConfiguration | Format-List"
  2⤵
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive "[System.Console]::OutputEncoding = [System.Text.Encoding]::UTF8 Get-DnsClient -InterfaceIndex 5 | ConvertTo-Json -Depth 1"
  2⤵
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:372

C:\Program Files\Portmaster\portmaster-core.exe
"C:\Program Files\Portmaster\portmaster-core.exe" --log-dir=C:\ProgramData\Portmaster\logs
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive "[System.Console]::OutputEncoding = [System.Text.Encoding]::UTF8 Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1 | Get-NetIPConfiguration | Format-List"
  2⤵
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive "[System.Console]::OutputEncoding = [System.Text.Encoding]::UTF8 Get-DnsClient -InterfaceIndex 5 | ConvertTo-Json -Depth 1"
  2⤵
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:5616

C:\Program Files\Portmaster\portmaster-core.exe
"C:\Program Files\Portmaster\portmaster-core.exe" --log-dir=C:\ProgramData\Portmaster\logs
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive "[System.Console]::OutputEncoding = [System.Text.Encoding]::UTF8 Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1 | Get-NetIPConfiguration | Format-List"
  2⤵
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:5248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive "[System.Console]::OutputEncoding = [System.Text.Encoding]::UTF8 Get-DnsClient -InterfaceIndex 5 | ConvertTo-Json -Depth 1"
  2⤵
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:3608

C:\Program Files\Portmaster\portmaster-core.exe
"C:\Program Files\Portmaster\portmaster-core.exe" --log-dir=C:\ProgramData\Portmaster\logs
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:5472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive "[System.Console]::OutputEncoding = [System.Text.Encoding]::UTF8 Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1 | Get-NetIPConfiguration | Format-List"
  2⤵
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:4960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive "[System.Console]::OutputEncoding = [System.Text.Encoding]::UTF8 Get-DnsClient -InterfaceIndex 5 | ConvertTo-Json -Depth 1"
  2⤵
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:5640

C:\Program Files\Portmaster\portmaster-core.exe
"C:\Program Files\Portmaster\portmaster-core.exe" --log-dir=C:\ProgramData\Portmaster\logs
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive "[System.Console]::OutputEncoding = [System.Text.Encoding]::UTF8 Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1 | Get-NetIPConfiguration | Format-List"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:2716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive "[System.Console]::OutputEncoding = [System.Text.Encoding]::UTF8 Get-DnsClient -InterfaceIndex 5 | ConvertTo-Json -Depth 1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WebView2Loader.dll

Path C:\Program Files\Portmaster\WebView2Loader.dll
Size 162KB
SHA256 609c974a8cdd6a76a745b3d81b62f321d79f2dc8f4929e1eea8469d9d78baf79
MD5 6842f2ebf863ab8ee1be470794d1f703
SHA1 26242ced6ddf005e0ea1073409a058121636fc9b
SHA512 339be4521b27e29e457e6d662a7ac98320729ad75df976ccdc9c83596c8b1bc7888ad465e7d38276fb5c0cfb597e7e6e9ba377c6f42db850c317f89e218ba5b9
SSDEEP 3072:DrQJpSFTlTRTzWGbThTNTFSkD0bHYVNqGM2h9P58LZZ5Aalq/Ty+EtJfy2aQQtq:nMMTlTRTzWiThTNTFSzjiBM2h9P5oZaQ
TLSH
T18DF35B5772E4407BE16A8274C5A34A11E77778510B60ABEF03A4477A1F23BD4EE3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

assets.zip

Path C:\Program Files\Portmaster\assets.zip
Size 2.5MB
SHA256 fb61a09b7223ad9dfcfafab71a25afca42fb5bb36250e5518effc7bc1fd31550
MD5 e20f29e0eaf8a5a831965d97a9f8167a
SHA1 9c76e79199b64de386783f5c5e8af3013f8d4fb4
SHA512 4ec787e4e8d17f548966a4bf8cb7d271a550b5d52a9bfcce243a7bfd27751c1543dc293e8bac61d0c7c94435fb134c2b284f42a541ce76b357fac12815392ab7
SSDEEP 49152:/fTenm2X8kKQr9mwR4mSKHFK9nsmuN48JTKqXbRS7Eg7OBqCuGOM7OAFXE:Im2uQr9nSKlKVsmo9h9S7Eg7OJuGOuFU
TLSH
T185C523F2F3175CB4E7DA8136B198F402FDB884A08787A1151953E066FBB0DD98B26E71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

portmaster-core.dll

Path C:\Program Files\Portmaster\portmaster-core.dll
Size 23KB
SHA256 a0f7d615bdd58230e20fe66df6804fffc20a38bdae8b540780236f6b15dac580
MD5 0f94aa3c904db33e99fc076223491719
SHA1 5d24da70bd68610db4ba000aa22176aaa86a9872
SHA512 8d8fdba2f1237072269ed1c2365ec2e5733010618a893b62a958ce38b31affc2aeb207be8afbc3fc189b5204a45ad518b6cdd98788235567b7651603b8a85124
SSDEEP 384:+FBUmttyqVLSXCOrZrz61GaprQ2ADrrsMy8RbmL4nNyMuhqM:+FIqVLSRVMGy82ADrr5ALVhqM
TLSH
T1C6B29E83999448D1DC16ADB4E8F65E26F9FAB5102BD292CF037081A50FA33C13B7E49D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

portmaster-core.exe

Path C:\Program Files\Portmaster\portmaster-core.exe
Size 41.7MB
SHA256 0b5aa3d7a4ab8b03126a3dc8346c39872164782d8b067f804a142290e3e6237c
MD5 bfda9c227eee51367528ce88996fee7e
SHA1 00c3b4fe397b652de7798c6acdd21afe71c91e57
SHA512 739ace6abb57ba4ae0283cecdf5e958c17cfb0f86c17b2512fe7ba90f2911b96f1024dd3515b9486d37bf0dbc5044dfc45e857b647b86adabb252a2925a5b0bd
SSDEEP 393216:0Mr6+/FGrPzPKyMAfZFCatIhXRGdH0X02D9jj1c73+ZBI:0Mr6+NclZRIFRpkU9jpc73Cq
TLSH
T1CDA78E87E92141E5C9A9D635C5A292177B713C489B3163DB3BA1F2243F73BD0A7BA340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

portmaster-kext.sys

Path C:\Program Files\Portmaster\portmaster-kext.sys
Size 283KB
SHA256 e07d172667bddc606c6a76079ed3e79281fa23ebbe68a9740ee71ea681b55d4d
MD5 3a21e73e36382cce7d092205f0b8f3c8
SHA1 343f090bd2ac1230ff04bcc8f2cdc8fc469445e7
SHA512 f0861bbc31e499eb30a9bb5cd45dd9e28a5d7168c020ba092ee81054b31e075df3586eb8838e66574712880a3ec642ec9fe9402cd1fb2ad238792a3570fcade7
SSDEEP 3072:0eZxH/Aep2Cx9YkUCTGUTRghRj6jyCGfvjrFw3h3j5Da2W+XBbdXxxKD:0eDfAepnx9KgTg2jDGfvjCDDXBBaD
TLSH
T1DD544105A908E1ECC485C1FCF1BA5AA2B5B7377D3B2573F68170B21036985B85A3C9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

portmaster.exe

Path C:\Program Files\Portmaster\portmaster.exe
Size 32.9MB
SHA256 e27cddea106b682dea030fc07211c1fcdb68b38a97510efd109b89d585463dae
MD5 5231980e77e35ed261a0b61c66afc4a3
SHA1 8bd210584c0aafbfbf6788b8e8a1eeb6eb4d065f
SHA512 b7ee5bc27403064e53b2a92ed39ffa63961b25e0f13fe7252318c8bea66e25d0e8a46e8cbef65c18358c753a87425fcd2cf9bde51c6ef7c92de0e6057d3b2f0a
SSDEEP 196608:H/Hh1+tfNzmI177SRbRAB3p5ByOOpo9ELk5wCqcHgG3o:fcjMVo9l5tqp
TLSH
T140777E03F5641A7CD9AFD67486AEA336FB747C894131FBAB06A0BA312E32751971C704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

portmaster.zip

Path C:\Program Files\Portmaster\portmaster.zip
Size 1.9MB
SHA256 563a732e411f9e22b60fa8142fdc1657414bfef1838923051d3f7b2250643cd8
MD5 8c351f9c0759036bc2e0526c8812492c
SHA1 cc81f779cb8b03cba72c16081350e996a8543805
SHA512 8da9254ba3251d6dadc271d7eb4969e0ee836a36461a13f0f84491e1ec2472fa93cd2a756042ae80a5e1036d2e510bc0cf3751adae9534e64f16bee76bf6db1a
SSDEEP 24576:OUsax4iASwACVGJw8n+p+yzOoPK+FYglOtY7UgFZADGET/CIIH21QthnV2RO9Fx6:FsXfx5GJwum+m8DgI27UgLETXMcinVz6
TLSH
T1EA95D1F4C71A5A70CB2FFCB59907978A9E898386574E3D5F5E40E2007E7B1C1ABB0A05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.exe

Path C:\Program Files\Portmaster\uninstall.exe
Size 770KB
SHA256 7398046b21cf0cf9cee0fc3088dd9ae9e4b2f5173e84af0e9d741e6bf34277f2
MD5 7e8cc2e733f318b513e46fc118a570cb
SHA1 a9a4255f7383b34a5484b625da6d2a2dafb36c1c
SHA512 f107847ab0edae0595367142169480f1c90fae67cae45441a05ce1a783d33f7bc946ffb8684dd65b51b161afe3b7f534b480abe0de964cd48302368c6e774e58
SSDEEP 12288:mY3QZb1kSY/XQ3PqKvDQN9AUavQhSMnM6dh:mY3QgSW0qKvDQN9Y7Mnt
TLSH
T13DF4126667588463CA210BB04877E7FB2AB37D462470971B63D5BF6F3A333838A09517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db.sqlite

Path C:\ProgramData\Portmaster\databases\cache\sqlite\db.sqlite
Size 248KB
SHA256 9a2d1817d268d8e0829fee7b299f86d20560ccd6a928bcbd8590338b336fd3a4
MD5 87c2de517e4aa9af09949ae2975810ff
SHA1 aee19b38b6f65d56dec64e08c11f6713085fd658
SHA512 4bcbaaf676f9272360367e747bda6b4f5cefa162a1edb8afbd23a9b5a84f835528d647315e6b218e2b4fff70b6f28bb031f85ad99cae6edda851968d8536d6f3
SSDEEP 1536:ttcBsaz0qjWJvMiC8z6RXW5gOVaeuzUveg06fLv62HJ0tzkm9lrhc:X1V6zD6+2HWtgm9Nu
TLSH
T1D0443AA9E2B968F1CBDCA4FBFC81B76505D1FDBAF08044D1313A68D8C79582C907A91D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db.sqlite

Path C:\ProgramData\Portmaster\databases\cache\sqlite\db.sqlite
Size 248KB
SHA256 d76c756d86cbdca153cde4bae0d00d28ea529530bf7012ab25a521c37d830ca3
MD5 1876994f849bd8fe09106a791aa7e616
SHA1 eb858c5fc7add0a2c98595362d4646491a4d7116
SHA512 0b975b351ad6dde642c658718868b64b49913ede505591b0a689153deccdf72005961b8bc39630ea343ce3cfbd7b61893667b3a79abec67a72ad85f377df700f
SSDEEP 1536:ttcBsaz0qqlkPGkiCfz6CXW5gOVaeuzUveg06fLv62HJ0tzkm9lrhc:PZV6zD6+2HWtgm9Nu
TLSH
T1EA443A69E2B9A8F1CBDCA4FBF881B7A505C1FDB9F18044D0313A68D8C795C6C907A91D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db.sqlite

Path C:\ProgramData\Portmaster\databases\cache\sqlite\db.sqlite
Size 248KB
SHA256 dfb1e74b40dfb7926307e83dee3d6274a6bec555e0bdbbdcee1e5adeac0d9523
MD5 3c37c20ed5b6380b36882a2eaf73313a
SHA1 9d8e3a78b6b9f714dedbc07e6387c9a8800f5f1d
SHA512 0fc20f38191843d09fc088e1a5878bb51631577e502486306c49198cb84bdbdecf6c6eba0fb6de6b656c31bf73e858807a1bca033b807195dfa58e0454861506
SSDEEP 1536:ttcBsaz0qHMxlL+iCuz6FXW5gOVaeuzUveg06fLv62HJ0tzkm9lrhc:dXV6zD6+2HWtgm9Nu
TLSH
T144444768E2B968F1DBDCA5FBF881B7B605C1FDB9F0844590313A68D8C795C2C907A91C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db.sqlite

Path C:\ProgramData\Portmaster\databases\core\sqlite\db.sqlite
Size 56KB
SHA256 05744ff14f2b03e1b103068ec7b8e515705229a4b7c33fb7f142e98aab66db2b
MD5 28623b6a44603847de5ed2d78f7de679
SHA1 51e7ebe9b80150c634c93315928b9ac8b4e108dc
SHA512 78ee658af7420c92f8dafdaf7434d0c13df0d9bfb57f1387885d82c67d7f87c94a2b47296c7c8c47d250db111866359f7dcff7d5e8eedd0e625cc77fbd1fe86e
SSDEEP 384:/jM2Sj2lLJVOkP5xsJUwG9/UfsUxaUTSIWtWxLJVOkn5xgJUwGG/UPsUx6f6AS0Z:/PcaPPm6hNUn5WtWxPnC6wtUUbt
TLSH
T1C143DB8082D12DFECF844FF8A0CD2C91E7FA128651978D8D5A9B4E01D6AD47A837B53D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db.sqlite

Path C:\ProgramData\Portmaster\databases\core\sqlite\db.sqlite
Size 56KB
SHA256 d404a482f065145e4db0449cb5dcca7c8fd802d5343b2d4ddfb6e84d1a7da83e
MD5 1212b1b893a5dbb7264a85d872ff0dec
SHA1 ff0c1fc92ab09dc1338785fbbf33f51cb404ec4e
SHA512 b68f0dd6db3c5648019a476d054f922012b586abe86faf33ae8dc6367e304a1c9619e5e97675ef7518af0729f03649b3a71087508c38f80b60b86d521b6dc429
SSDEEP 384:/jM2S32lLJVOkP5xsJUwG9/UfsUxaUTSIWtWpLJVOkn5xgJUwGG/UPsUx6X6M2Sy:/P8aPPm6hNUn5WtWpPnC6wtUEIn
TLSH
T13F43DB8082D12DFECF844FF8A0CD2891EBFE124651978D8D5A9B4E01D6AD47A837B53D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db.sqlite

Path C:\ProgramData\Portmaster\databases\core\sqlite\db.sqlite
Size 56KB
SHA256 e5732e4ed603baa5cfd35846f27da5ed6cce0f4ca24320349ca1d01179cbdd7d
MD5 4a657b281d85369538a1b4f3a5573c21
SHA1 ccbdfbc3ff697af0b12bca6d91186c5b08801b26
SHA512 c1a7e710b4bcc0432c2000c5d263d61e134f7794bcd6fe093a54d14380ba153a2a595e74454fb105c54af938a09e81da00c50e483097ad38d91937db83dd655b
SSDEEP 384:/jM2S32lLJVOkP5xsJUwG9/UfsUxaUTSIWtW1LJVOkn5xgJUwGG/UPsUx6z6jSGt:/P8aPPm6hNUn5WtW1PnC6wtU4Ir
TLSH
T1B243DB8082D12DFECF844FF8A0CD2891EBFE124651978D8D5A9B4E01D6AD47A837B53D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

history.db

Path C:\ProgramData\Portmaster\databases\history.db
Size 24KB
SHA256 02dcc55b6f59aaaafbf448537f1b434bc168f6716587522671b05338f4182313
MD5 e2ef66e867a1d78cdcc2d1af00050bfe
SHA1 60372a021f9f2fdca4253b1463ec4d6792a2f8a4
SHA512 4940a5745e9a55ffdff950f4590dc945edd629d581a8eee301095809b82b6371fbe189032e1762e866c90e8799f269b454c3116be1ac105086b7bb74c0b7dd48
SSDEEP 48:TzrfrpgYq38glId2f78F4Eh5fzxT2kp5z:vrfrpgYq38gid2D+TfzxT2k
TLSH
T182B2034D5F1033A0CAF741B6E8D309C36F7E901C136622911AB510F6D8B21B2B5AB6DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

history.db

Path C:\ProgramData\Portmaster\databases\history.db
Size 24KB
SHA256 ff1b1713df4b2f123bdffd653704d80a547ad20ef165880cc4fcb93b4d43602f
MD5 a01599ba98096e470e506a69d24d3617
SHA1 e9e466435f6612826f2127b445a099415c2ea8a0
SHA512 10b74c08258ee3c0f56e73f990a2a256fd8cb295126328f7ab7cfebe8b92dd2d469591be5aa6fb0b5a2c8efbdfb91705bf381109bf33d241794bdebb8b83b769
SSDEEP 48:TMNrfrpgYq38glId2f78F4Eh5fzxT2kp5z:4NrfrpgYq38gid2D+TfzxT2k
TLSH
T1A0B2054D5F1033A0C6F741B6E4D309C36F7E901C536622911AB510F6D8721B2B5AB6DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.dsdl

Path C:\ProgramData\Portmaster\intel\base.dsdl
Size 14.7MB
SHA256 6c770483743f20c49ec7c57bdaae78b0cc30c9496c8a10a4f8675c5baeaa4498
MD5 65d460591a2875752cee844c29c897fc
SHA1 ce1bfe9dc428cc6300e0db4d79a441b33f8f9a27
SHA512 4a3c19ee9c1b9b76651e25346da861e7ad384481647588a3ff3c91f704a582969277e86efe92c2ae5f0f08ff120e61a1f6dabfe6a8e3fab0a07ef8ee3d684b15
SSDEEP 196608:7Z7aaVRpx8AS4wz23CLsBBbxvcJai95qfRWk+3/umMqaI0ju8YlvrrnExcgJnRXn:7ZGaV6cRhifqfokGMRu8YlXECgvXZN
TLSH
T1D0F633A313631A50684216BC3B7D37B3D82E86485FFA75D2884F4D26D68B08BD706FE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.dsd

Path C:\ProgramData\Portmaster\intel\index.dsd
Size 4KB
SHA256 026325cc7af459251fb08dce0a6166aeece4c9b5a4b7d26e15f4f7d94e0e6e0e
MD5 b5faa7d7a5aeddbaa0745cd62b18a4b1
SHA1 3d94a5f99e7fdd3e8159bc03e42567b06cc70d2f
SHA512 0e01cac618d62440d8cd3236b94bc108984ae023a1e8fab5d8e99d19f38e6964b6eb3c359faca13d6d9defd59f4fd5e3c93f84914dc7b2d2c29b2a15d70a05a0
SSDEEP 96:JAAlALAc6zrU0x42TFqXB8uFu9pDAIkCBjW8ts1qGkFXhi:HUIrpxFTFCTiDE1qGms
TLSH
T18B915D3CB1CCEA4BD27F6858E27EDF02975B3930FC55142741ED76929AE68129360C24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.json

Path C:\ProgramData\Portmaster\intel\index.json
Size 2KB
SHA256 4d9e21ccd810b34903f86ae1f3daf07619c34f5665fea46be17ad3e077979499
MD5 12d9b34bb53eb6b385cf8c9543496dcc
SHA1 1ebea8c35987950db07bb245dc722739bee1a413
SHA512 fba65ca23323742eb33a8d5da54974824adfa058ea3911bbb8ab6cf470970d43bcb2a6b86bc88aa4f29c0544778540308fee56fe37751554df2ad114c5f12cc0
TLSH
T17C51BC86C2756D6321CC33B185AD3095D62248DB6CEAAC09334D644C0FAD0BF2B3F28D
MD5 SHA1 SHA512 TLSH

Submit Download

intermediate.dsdl

Path C:\ProgramData\Portmaster\intel\intermediate.dsdl
Size 17.2MB
SHA256 8be0df9689d4f1ee809fc633179485d5673e1126fe1fb9e0bfe296f2fb9f672c
MD5 8c68219d0283fe3f340c21188063343c
SHA1 c5101ab1f6ccc3d26d10e2352feddcbdbe4baa65
SHA512 623bc95c5388b205b61ee014e97ec2b73d73c97179cf13932d93a49e249461253abaca2000fb94ce7e79668a5bbe5fb6772a85b18cbbadacb6087228e083079f
SSDEEP 393216:IodqbI4Ey8LkbUqoOk1LJayaO1HGdsYIj3Z7Zxw:IsqbI4EpLkQFOvkMds5zO
TLSH
T1DC073313EE772602874299CF678C72D576394854E289355330DAF1ABBBB0F3E6890673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main-intel.yaml

Path C:\ProgramData\Portmaster\intel\main-intel.yaml
Size 14KB
SHA256 c73be8f0600af4500f5d3e6f8e354f5d96dba2ce37d59aa976306a8ea9e5bc6d
MD5 f6a3e1979bf4189a242208c20119c4fd
SHA1 f15becdb33ae10c8898930eba7720e2e4bda5ac6
SHA512 881ef1b5c23c2874592bd3c3e0c7ee3dd5cdaae8b9625c353ae3b7071ebafdbdb743bc93c49eeab3fa30ff4541248842004803fadf98be5175a7f4b8611a8d3c
SSDEEP 192:HixmSUHIiRigYk4R9bG9/KmAcc83qSob4JE/RM5o9qLXVteDlP:+K31Yk4e9nUVJkJEZMK9j
TLSH
T139625456C72D1878F068D261E77BB6F1B32A8E039161141477AF93B91F4B34772E80CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

news.yaml

Path C:\ProgramData\Portmaster\intel\news.yaml
Size 972B
SHA256 fa64e8d0f2adc61093df516d4be68ad536c4de29fd9f7c2473311dbdaaa1f9c6
MD5 f88861e9dba633b7ed2b8db750e9b586
SHA1 fd6355f3d0c0ae83713d42d4c6650fe7b276ffea
SHA512 e5b671bfece741ed5baa57514c366d7a9623b1e914e8fd10af19fd0f7454959357a91b284fac4a91a581e6d9013bbb6854ad5eb1b05bc84b261f60d8cb456fc4
TLSH
T17211E1671A146B0E4A5557DEA2DF215DD305E6EEAAE0E0B878CF8101130E86454BE05D
MD5 SHA1 SHA512 TLSH

Submit Download

notifications.yaml

Path C:\ProgramData\Portmaster\intel\notifications.yaml
Size 6KB
SHA256 8168f64860717712a9d0a00da876e84f03c34834b3a8e0e1dfa783a9c29f7235
MD5 9f328dac539016f79a513f5b71517c29
SHA1 b6b5d1a04eb8b6d0d88819e818d448b159a03381
SHA512 0b3697a9b34ec142a9427e66c3f2e9f07aba92381c5bafc1111cc055f6e330f1a96ce08d13f4f9c5b8ca3dd3f3d7b1a37b9cb535ceec56e972a988d2f610b7d5
SSDEEP 96:cUwvh6VR0ymBfRpXVNrnr/dqOZhXM4xKDqrFnn0ZEtn3FNT6RA+niFjRAEniFWct:cUI6H0ymbJrRqwrKDKAovK2vct
TLSH
T1C5D185D7B348A67ECD8A109BA4C251A18625F9EF937098BC70DD511C2F0B77081AFBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urgent.dsdl

Path C:\ProgramData\Portmaster\intel\urgent.dsdl
Size 2.7MB
SHA256 10d70c5ae83c6554a169f97380314ae0bc5c1bd51110a4cefa5ccd548a714c4b
MD5 451b0fd359fabb80ba3a2b0d483e755b
SHA1 968b5159f2110ec885e3de8aa11467923d00750f
SHA512 51b2c9deb7c61380b08d17d1307f902d64f078f98d563c7bb53f43032b26eff08ddad2e149978529f18d858bb8f1bbb0290a9943e38d61b56b90eae9db39d20a
SSDEEP 49152:9OjRIwzVlQC4cBchk8IYfY42oBemlunvdbElgLUSJtQ+ilf61SsYUwveja9Nlh:oiklaGlYfzQz2lggL+ilESleja/
TLSH
T1D5D53310BC590240AF0233B18B835E769E3594B98FA0938A565FC9CDFED0CDB679B54B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-15_15-02-16.log

Path C:\ProgramData\Portmaster\logs\2026-08-15_15-02-16.log
Size 8KB
SHA256 d546a52c68c17e8bbfe25875b20a0ebe0ef17fd80ecca4dec737b4b3f4d4d3fa
MD5 c78ed3f3dcfa70ff2a721158f1c9f8f1
SHA1 45d8c0be9603c987e3356b0d245e14d74b8e725c
SHA512 a72fdf61f48484cc9d4ac473eed6b34c03d72797b2c6e4019f8c1507895ac3fb2cebb4f1af827a36986aaaf6b2ee4599a0b74d4c91b66747d05209df02aa12ce
SSDEEP 192:90S3cTT3ZMwcDG/NXdzekxNybkHnvoy8HYzQQu24ck:9eT7Zo
TLSH
T1A8029A935BA100992CDF08C79F8C57566F337A1BA3844E1275DCB59C82EF566A9F308C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-15_15-02-49.log

Path C:\ProgramData\Portmaster\logs\2026-08-15_15-02-49.log
Size 7KB
SHA256 f0399ce4c0e564d1d565a3e55f0fbd9238b4d31ab5f075e8afa66a707f4873c1
MD5 925d3ffd7691e922976076d0285ae2e7
SHA1 9182581f766d7a1f064900007a19fb70eb7b1939
SHA512 0aecfb84a76c0b57a104768fb6bceb7d9920a8a515436c4c71d0ecae917d34fa2ef2fe6d4f9884ce90a70e333b3941d65704c391b7bc88267653f26fca3eb99d
SSDEEP 192:fqFIPjC3lUD/0xS4EKLXCLlIN92fQkL07T8/IkzqoD2Pc:fqFIPjstAH
TLSH
T1C1F1CA831BA101992CCF00C6DFD87766AF77781B9398891275DDE81D83FE166A9BB048
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 728a591256de6215a74292bb4df21ffe9577fb21a192a3f803311f2c9ae4d2fe
MD5 d978cbbf215f9b3651cce065dc694da5
SHA1 7615086b7201ace394db54bd07df907896721730
SHA512 3f5246e77ca4b60f27e24a8e632c10d0c2b7939fbca7ed6f05f84ccdccd486f58069c76155dfe372b892088ff17d71a102e68110c5591a45a06e3b415dc9ce64
TLSH
T13D81DC313375B0E4C9667F07192C19C063AF8386EA98AF5CB65C521EE92751BDB122F3
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 02d726aaca814bee961a1621ab6603a7a833d7999ac8b8bc332c3c41355caf61
MD5 649dd9616636c7076a30ba96ded48596
SHA1 464471f7934de7cab45e459da9fa161bb6e21c21
SHA512 943480b11915fb863cbade4259a670a4a25ced9131f6574b0644e8ea44562a6f79fdc9f65d0ba995719b630a3e53992996434546871f9049d57fafdde307e5d2
TLSH
T124411698A7F91148B3B36E5AABF6A86D447F7D672E0AD55D10010E0E0A66E40C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3699b84a55992622b12be30644833f187617151a2a6e4b1de0e8e3025cfa3564
MD5 bac5f13c1e1e664f979a453ac2686ea4
SHA1 fb18c29dbc0e1e83460439f603affe68f72179a4
SHA512 5c6881758b0a3c2ff0620eab58db29a0412cb7affaab824b0b4c7f3c883fe88d44d54e0fa863ccd4ab1a6ced5d09cd3e8b027299eacb0aff5b01c2fe5fe5f9df
TLSH
T121218627B3EDC951DC89113B209C9DA076B2D7C7809ECF8B2F84C219A53FA98CB21190
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_na5l4fc0.5n1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_na5l4fc0.5n1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

SimpleSC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj5ADF.tmp\SimpleSC.dll
Size 1.1MB
SHA256 1620cdf739f459d1d83411f93648f29dcf947a910cc761e85ac79a69639d127d
MD5 7b89329c6d8693fb2f6a4330100490a0
SHA1 851b605cdc1c390c4244db56659b6b9aa8abd22c
SHA512 ac07972987ee610a677ea049a8ec521a720f7352d8b93411a95fd4b35ec29bfd1d6ccf55b48f32cc84c3dceef05855f723a88708eb4cf23caec77e7f6596786a
SSDEEP 12288:fRdJsAp4dXFcLBz75cwoCmJKHwe6VuoH9v0D/LF5mM6:fBsmyVS151oCmJKE1dv0DX
TLSH
T12F354B2BF645693EC5AF063E4673E714993BBB726912CC1F56F0084CCE2A5406B3EA47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj5ADF.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsj5ADF.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj5ADF.tmp\nsDialogs.dll
Size 9KB
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj5ADF.tmp\nsis_tauri_utils.dll
Size 30KB
SHA256 7317e5508923f425bced2698bb89f79b00fcddcd1028f44b598732b2e3711464
MD5 fc4691e51cdfac476b2fc63bbe951e82
SHA1 6532da4545864c6ec95f62f27f2199bfd668560b
SHA512 5b544832f1b1b8f2e1c6f8d61a839bea22c2c3d7e2a03671a12bab936e46a6f3fa3dd8aa53ec91157c1de08f0b349d6d2c1aec29385ad38cc0b2ab4c033c58ed
SSDEEP 768:IMSeZbzz284uMJSmuGrAFKpnp0jdhK7R+qV0Z:IjKfAuXiMtXIV
TLSH
T16FD23918FCC56FB6E2DF1575240C596E429FC8180B14CE9BD7A25E22E9E63722EE500F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 542fc054199a85078ce87d53c3898d6dafcba61835c3fedb6567700c78f807b8
MD5 73520ec43a88d84127e55cbb8b056a1e
SHA1 99216d6c962d041a5cb784e23c592bf921544e24
SHA512 9ff0d9781a4044313abce070cb2f427229f9e9992956b91c48e08dbb1fa65104163b3faf939d318f346bee462137f8eecc637ae242196b1ce654675f2e6fbc4c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0a1798e8c66edbf8138efb380607fedc3f900b35b86f18661437d7a28180de34
MD5 1d4f175d62760351a743d42dfb5be8f2
SHA1 135c7664ebf99bc4df55780b17d5d5beead460c6
SHA512 99675867b1435ac1d6c2093b4a9edf38ae5c4ca69972067cd63d0bd1ace5051f62e1e32c165cecf366c72a5baf3fadd4e9710eb040685d1dc8e8e439cda54d5e
TLSH
T1DBD01217B3414634C41021330913650C0401CA0F400DC040E429855E2F040501902882
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ad93e8784a0b41649a89e8c3e260badf095c553bbe70f0bab485312fa4a5d5f4
MD5 ca595d3f09ef7be520700dd4f8a5b963
SHA1 cfbff53d94c80b3d6b84482de3d90d314ab4486f
SHA512 0c1bda5a609ee367bf33f037ed3233f7e5c6f5d83204edd5017460b70dc07c2e1cc4201d0df9a2971580fd4baad62735b5ec57e9f5c2434866f2ecf251ecfd22
TLSH
T168D02B6773150A30C71472374982E54C5001CA1F000EC040AE36F95D1F410E10C81D82
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Cache\Cache_Data\f_00000f
Size 525KB
SHA256 c8598aca2a616f5fcdda15a95c5ee2d7c2be4ecc30edf67943c79e5ae97ee6e5
MD5 eb8486588dbf89a9a3803cb047309a25
SHA1 6b7343a9a2aaa28afad39809f52ff093d9c6203e
SHA512 11b72e41429b7d2ccc40378e30ed13955a42680b0a7138cdb5464d46e6488d4ef6a042b2b44aa0c5534e08c40c952e830717dab10ae46aa855ed7f471143b914
SSDEEP 3072:gGLJA6L0kscOVziqI6c5ihj5mL41I8FVyfUxxBhyfOLwpmrflCoN0jMJ3XAKXasP:qF1hwi
TLSH
T11DB4555981810E9FFBAC4BC8D9E77DAE5825003298C8EC4CB4DDACDC815CB9DB056A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Cache\Cache_Data\f_000011
Size 30KB
SHA256 a30a16cc039a323f6c5436571f41e370cba0fdbe3ccb14c434532101fffdbff0
MD5 1eecf982a23c28f23f8c43d26eab8277
SHA1 07b583aa30e890ab608f9e6df8abf2f4f25b220a
SHA512 50b9fa9cae665f1948aeb1f177cebb7ed8e137a96bbd9693a475d4ff0c8b32fd0c7497327b177d6c55c5a4ced0412dd6b4ae89053be57fe89e8c6b320b3354fc
SSDEEP 768:SZTV8WulOsLklLncVRdmE70zz6guzz8Hs3FhT6DgckjR:Ss9ssLkud370zz6RzAHQhT6Hk9
TLSH
T157E24CADA72CEDDE3D700AC2BC5264F45918B0133C4508D161EE9BB60465EF8E729AB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Cache\Cache_Data\f_000012
Size 36KB
SHA256 0e0387d8872fd63edb55bc7a2681ad34ded4f828697ca129c1f55fce2576f01f
MD5 2b85e11109f696d0fc0e296cdfecab48
SHA1 b08dd41eabf3d886b18c22d07ecd7c022fae4b9c
SHA512 3b0d21b6a80e6e6cfb8107403798faacb6cb815e01870de694aa742efdc6d712019b8c3aba099dff89322a3f6a9136322d2a481ac5fa4158e6ce6d2f52672a34
SSDEEP 384:fLtOHN9n536gD//DgVPTRv+wbHEMVbtDoija5usAoPgLOBgfypLzNR+aL82++6t6:jtuNLicaoijycmgYGy9zNu3+6taTA+xV
TLSH
T10CF2F6D9B7A1B0A59BF77170817F440BB23729A5BC4C88A4F115D1E83CB914C9527F2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000013

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Cache\Cache_Data\f_000013
Size 613KB
SHA256 3104155f400210b9e818f3d2f1f6e7d82b3d14081c6b5ae082c1af40f72cb41f
MD5 acc8713d876e7d4329be31f1bc956364
SHA1 6f5e2709175efcc3aea120b640f9afb28904fc8c
SHA512 5cf844f0a09ace6d281a0b5a0cd9a7991f4bfaba0a50ac80d9f9cee2fea74f1aa085f12b38cae8be25b998c624d0e7a738d0c743e190a4667bfa52d14e259ee9
SSDEEP 6144:mcRlTf9RfPfwf7f2fTfFMbUP8DPucYSWFuy87ugGoYgVejjJzsDNAmotiZZMU7ez:yW
TLSH
T104D4E9186B41203EE4F7C337A4E1F9596D21D602D67F8A7FF3E17A188F4968905A3E06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000014

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Cache\Cache_Data\f_000014
Size 521KB
SHA256 ea70e69834290a7d60a5a59e6ca2833cf6a5420c95412231f57f3f8365590678
MD5 a66aed9ef1ac29ac4ba3a5856818daff
SHA1 3e66039d84f8d86ebabe9dfaf871b1ee64021373
SHA512 8589def680dfb7d26b94de3d53ca95ed41cacf59450d30c47f4d404dc38039b7daa07c41fc014bb462310817d4fe7fc0a10a94a8674ed9c63ef9f2600f91906e
SSDEEP 6144:crNCU3WQNNYm4c2Jo6HPKYiiT4NaRyjBULDzdhf:crDI
TLSH
T12AB45B19585ADEDDF5DBA643928C7D0B82401BCC56A29ECC3DFBC4DB268C449344EEAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Cache\Cache_Data\f_000015
Size 2.8MB
SHA256 ad9a13c78366365c7e23504ee784c7b53dd3288d789d06c23a62f2c2b68412e5
MD5 1ec5eb680b64fd105edc5cadf8180c7b
SHA1 a952e208e0e4fe7abccfc19ba087787d1af0159b
SHA512 aa0a3aaa6ddb24d325b89271e1d8542d19031c0a2a8a4ef2206d643c15fa61538edeaa9883285fc69a0dd367d07a308ded1c1b4a3a2e3f1e294405d7f3fdc3ff
SSDEEP 49152:LU7646c8WzGOMalH/Are17ZPe+1jUnyXl+QzuY2FEo:53j
TLSH
T152D56D4CA365627D6BAA82A8CC321078B95D49D930A4C57CFB7CC8F532155CCD0EBEE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000016

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Cache\Cache_Data\f_000016
Size 829KB
SHA256 20b3b0282f8b1e8421e92b5ece751f5be50e8b6ea9c059e00ed5858f6d5cc53e
MD5 311f1edd0b93904cee5e8b421716c0c6
SHA1 ba5caf4994a144e2f27103f35be1c25e483e6b71
SHA512 2ccc1b07e66871d930537d212ade77d3925ac9bd93145c013b378859ad267df85d3892f8a6f11200b4518c1fc08119a022079262337eb6f7b72c881bd60fdaf1
SSDEEP 6144:iLsCZsSGhENW4rsLlVplF27fPRh0ZPjW2v8XM11T2PW2T0omo+8nzpW6:iLfGVLlrlFGfL0jW2v+MfT92c8Z
TLSH
T1CB053C5BA645A07C43E678E2E4231702812D5E54F61B809CB27CDCA5F7EEAC93167B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bec5ff6fabd64ab9_0

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Code Cache\js\bec5ff6fabd64ab9_0
Size 261B
SHA256 c0f610306724fb8d3dfb47a2bf206f698db543ca37bb8f5526f8526da592db34
MD5 28a66c76c531d1003c8623564306143b
SHA1 6996b9ac37e01587637512b504b34f0c6f3e37bf
SHA512 c10a15ed4ed5d4894b049416dce6c10acb62d9d04f738d0c44f040bc23689c1d4f0de45a6084e51601c0bc675cc276455524235d4c8ec167f0ca1eaaa1d52134
TLSH
T19DD0958E00331008C1D4F5F1DFFF991FC70BDCC0015C5520E001D8D341729256691309
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 6ae3b27be4b9daacb54d344abff17e4bde6c61b0c0774bb32e6043393d6b3a88
MD5 246da1f27e6e56aeb1c6006f32cf8701
SHA1 222495c4b5e1f6b68bcaf686ceafedb16577d9d1
SHA512 979054381247ad54c864970bd633d6984d95b1680c790dabf7b21677bfe118f9ce2312aa18c13b0a0a9e1e9f9157c767ed0f059f895f0e6e54287fd312a84105
TLSH
T1D9D0223C00C48008DB1633F27BC20A883F7A03A50627AE1F9BE15CF8AA19BC2A911534
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 cd6f1c1e4529437c51419a38021bba01e5c13f7fc758c47bf4170249efeb932d
MD5 51859c09bb174d358f14f85db85cf819
SHA1 2ab59e689b94dc16d07e6295bea8631122f77833
SHA512 612a6efef87307d57eb74fc573961679c13ce3b001a7602bf02cdab2dc298dfba9e5b20e2f245300174c2f4bcb70a47655718c21d51f63bb84105a72527e9c8e
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 d9e85b7043fa0ec372a593429db185ca2db966c6f9167a242ca094484a64121c
MD5 25f1faba5a0ca15eeee9de1d4c066079
SHA1 daa2142cec9b76210751c8e0ee89a53d8c856797
SHA512 d59e59412b7bc95c7aa1fd39552efa3d243c54055d6c24be46be7a89be4c346ce04d0fe1ee860086a6d4c18ab134141fadd78fc3b5b048793744ebd6aae084bf
TLSH
T1A5D022A83C804195EF5733F676D0078833BA022BA80B0C53C7A16C76DDCDBC2E400A20
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

965a432c-0754-4a68-b8de-de1b87196c18.tmp

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Network\965a432c-0754-4a68-b8de-de1b87196c18.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a3a4b.TMP

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Network\Network Persistent State~RFe5a3a4b.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Preferences
Size 7KB
SHA256 df8eefa73ab4cda4e4153999de13a2d28c8f561e89f881ce1b1520e87e4fc1dc
MD5 35f7987a45fa2122b91de27018efb9f9
SHA1 b816211084ad819fbcc9d88c8cbccd475f338786
SHA512 dca63b94d3b31170ef149a98f72771e0bf68a1ca326c8f7dd26641abf4bc7330501e80f277dc0bff90bf9d2d8257045ef2f977a2e9d3720968351f10eeb2d5fd
SSDEEP 192:stf0OnfEZ8paiwK9/S+Wiu1bhtbqdPKYMC:st8Onzh/VY3q0C
TLSH
T1D8E1A7465E6869774CCBF5197A35BB62E3F5106262D00E54EFFCCA1C06E66CD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Preferences
Size 7KB
SHA256 e3d41fb75e9a19e8dd7485ce1cbad01784de2d0461629ac4e489ea23c03b47bc
MD5 b1da67141b89344e3382b8442f18e2be
SHA1 5d0562910477c66de56dda1cdc7311e15587f2bb
SHA512 4d7b95fbe71e1c99bdcc82d626855be4e52469ce6652012f677abd1f042e627c44bddde6c28eff482a829003ba6076d5488d0f7ff08cbc17fb651c4f00ef626a
SSDEEP 192:stf0OnfLZ8paiwG81/S+Wiu6hhZuQdPlYMC:st8OnKk/VNGQlC
TLSH
T189E1A7469E646A7B4CCBF51A7A35BB26E3F5106271C01E54AFFD8B1C06E66CC220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Preferences
Size 7KB
SHA256 bb93928a4d5c5c1821c31d9e89b7a8bb31294ebb1cbbd5a612392ce5cd41368e
MD5 92aa5a38afad3b1d973281736a3f3dc6
SHA1 a03e64ae95b5132bb51a60e18cc5f7a780884a89
SHA512 18ec6c5dd0595b9e32b755ceee6c9286e586c2a2fd2617192d9a9fa1ec51ca752e0b7780eefa3da9579067e69b44cac8b1e023a1195b91512c3cd78e677c5e48
SSDEEP 192:stf0NnfEZ8paiwK9/S+WiuzJbtbqdPAYMC:st8Nnzh/VgJqWC
TLSH
T1C8E1A6466E6869774CCBF51A7A35BB62E3F5506262D00E54EFFCCA1C06E66CC230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Preferences
Size 7KB
SHA256 d5cfa9776f654d03baaea9eebb7a44be9967abe2bca45fd42c6d9de9b4a7fc27
MD5 b5c5a1e5b5674f898324ff76dafcc255
SHA1 28bbb140c61c4ac9e80b0983e5d3c0c33feb3ddd
SHA512 3a240c0975ee14a2eb39d79cc52794a576ee90f74234cd889a979f70f9a0e2ddfb28e91732f88145e1f518a881771d73fad2d71de44e1de6894471ac4708a483
SSDEEP 192:stf0OnfIZ8paiwCj/S+WiutSDjAwdPWYMC:st8OnfL/VRAw8C
TLSH
T198E1B8466E646A774CCBF51A7A35BB66E3F6106271C00E44AFFDCA1C05E66CC230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Preferences
Size 6KB
SHA256 76fcca6e0c7600e0cca9d79e59e5177a1ec868efb16ee6a0ba9da9bcfb336de1
MD5 d1cd81eed8d1c12c50b9cc1d48973c80
SHA1 6294fb980c88e7d943fd9965594eaa04450f03ed
SHA512 321d1976202ad498c391fd1187af2ac48f121a49f060d74c129cadf4f805b3b4fd46c2ab691cd58f516c44c0b590f17e811b55e66e2b42d3c2b3fa8c147dc82e
SSDEEP 192:stf0OwfIZ8paiwCj/S+WiutSDjAwdPcYM8:st8OwfL/VRAwy8
TLSH
T1CFE1A7465E68A9774CCBF51A7A35BB66D3F6102271C00E44EFFD8A1C05E66DC230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Preferences
Size 7KB
SHA256 939179023ec190d04c9b84d982cb0a0ea01dcf641560b6f14b9b8d33c86b2e36
MD5 b78766f27a3ef5f5a30802268f5aaa5e
SHA1 e8d65856707a6e7efbbd6153d92f2d3e6bc2377c
SHA512 4e7bba91ede51b691fc696d48e4176294b17604ecdcb90e527f8aec71792dba15a4850935b1b3544155c0f2a037c9f37dba61a7d0846383a796ddbc4b9ef0a76
SSDEEP 192:stf01nfEZ8paiwG9/S+Wiu6hhtbqdPOYMC:st81nz1/VN3qYC
TLSH
T1F2E1B7466E6869774CCBF51A7A35BB22E3F5106262D00E54EFFDCA1C06E66CC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Preferences
Size 7KB
SHA256 901a06c6173b3ed5f23faacc9a9f85ed7058eb910ba4ad6afff0c6057d253412
MD5 0e7b70c288545ba7a0f372ee108812cb
SHA1 d6f8de353846952dc7a157b5e73b55f8e456ec4a
SHA512 552fc0e80304977ac91880c3395bd6c6ef46f0e0af365e7c6590969d7946b73c29160b3d582eca894982fa019d57ce245e00d485c58151d8407290eba8c0f1c4
SSDEEP 192:stf0NnfZZ8paiwCONn/S+Wiuup/zlF4pxZqdPXYMC:st8NnUs/V5vEZqXC
TLSH
T11CF1B7465E686A774CCBF51A7A35BB62E3F5506261D00E48AFFCCA1C06E66CC230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Preferences
Size 7KB
SHA256 d522ed5a6712998d49b4079561aa07d3331173c2f98a2c20eac9634b3d27c80f
MD5 4eb86b75a33d56043afb16923fdde153
SHA1 db529fb7bd5124acaffeebaf11491cd1bcb48b06
SHA512 f060d87a8281cdac09e50335dbe6c80305d4aa4c99981091b3e37b5ac9fa339322542fc8ebd28e2820c606cf75d9a2b00f3363c804a447890af136531fc15935
SSDEEP 192:stf0NnfQZ8paiw/Mk/S+WiuU0pMLg0rkdPfYMC:st8Nnn0/VmirkzC
TLSH
T135F1C9465E686A774CCBF5197A35BB62E3F5506261C01E84EFFC8B1C05E66DC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe596de3.TMP

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Preferences~RFe596de3.TMP
Size 6KB
SHA256 2fc2027cfc017b0546b2944d7a62dd71e14204da3a8330a744d851678c8bf289
MD5 179c9d2dfbced53af7600f7ad2581459
SHA1 024161670b0b7cc98a92231fdf0201aeddcdff56
SHA512 d684b76eacb4779bfcc3386112923af6954b2b48635e5259841284111864fe32a45d0a6221714869db5030fc45fa7a8c459fd4701e8f861d5212a3aa0ec0e5c7
SSDEEP 96:stf05E4kUkb9OffrZ8i0vhEiGkQ/m/7qx+WVHMSm+uec48PS1idQjW+gteMEB:stf0OwfDZ8paiwe/S+Wiu86wdPTeM8
TLSH
T10CD1A7425E68B9B74CCBF2197A35BB56D2F6502172D00E98EFFC861C09E56CC230B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Local State
Size 16KB
SHA256 03b139c8bbbc753e4cc44b0533545e7da77e6a8897a9b1a433bf05e8f7be2203
MD5 a324bcf51af8ee473d1f0339edce2777
SHA1 8bd531d741623c0c223b476c03828e431d580033
SHA512 45d169f05acb81202d6e2d66e0c5fb6869418d2e8ad11c870528c98309c8fb5c6921e3289cf005a84a7c7dd77651872bf90ae6c81613fcf46a2c3cbc4dda464a
SSDEEP 384:zU+aQikB+z/xvxjg/qhEVNbyLGgCbI9zg:n/UxvxjgC+K1CkFg
TLSH
T115729D3B59697E3399F7F641B9081B5FDBB484B2A0C52EA88EED4F0906973D81303D02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Local State
Size 17KB
SHA256 cb3e283092ace37e05087861bfbbe5e51beed142977ec7864f10f392f0c05e38
MD5 5fcfb1b6d07cfe9163c95e17d6d3d26f
SHA1 eef1eddc54356b5fb36142c6ab8761860d0ab5f7
SHA512 0123c77a9bb6e157c9ddaf150deab1a3b6b4992ec567a6f3ac384e0b0b9f52166508d927aabbdce69eea3fd4b6f820cdd665ae91989f6642cb0a7b4c86a3e978
SSDEEP 384:zq+aQikB+z/xvxjg/qhEYNbgUG0CONCbI9zg:J/UxvxjgC+ICONCkFg
TLSH
T118827D369865BE2358F3F681BA096B9FDBB1446290C95EE88DED5F0D06873DC1707C06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Local State
Size 1KB
SHA256 9d7fca3c3ca46cf460bccefe306fd28c254e9b647816f76f7d5cd2b96ce3abba
MD5 611a4b49ba8079bde109f1e3afdb923f
SHA1 2d11879426dfa225d324c625ba4efd794bf98fe7
SHA512 ccabe782373679f0fbe08e39e072a1481408eac9ac17ad827028e68474451ad68186fb302dea7d59fe0a9f948093f95f980ebf3e490a802220277387401b6cfb
TLSH
T1203145B2D4807EB65C81B646E1067E6B9F21502AD1550E48A5DE4B1907E72CC953AC37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Local State
Size 2KB
SHA256 34727d7fd5e4598b8a5536555c702509c31049bf3036731d072ad3dee60123d0
MD5 b212fef9bc82d340a29f85260fc6acc6
SHA1 cf0be3a2c40202a83c34912f951e81eb932d2720
SHA512 af5b777da1b08c6f34cb8a5ec0f9614ef167e4a58a9d9ef818f2a74f0ad30fb93685f0aa378228b1b1b785753fc9b1ad77b85b3ff859a7c045446b108ac72185
TLSH
T1B351A773AC40BEB74DE3AA45B94A3F26DF315065E6552F549ADD0F0C02DB29C2316C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Local State
Size 3KB
SHA256 679bd3ed6cc63baa5883e0a5881baf4b3377cb7e6a2a0bd01baa47f37bdb21ba
MD5 9b6470988baf1024b85a8b8a79c271bf
SHA1 ea2632f8406a88ef396323a9e97303af14db5998
SHA512 44dbfbe7b11dd1af180bb81f6b28c1dd0d3c3426665a9c4f33ab038f4c427ea0c52167ae686ad044881211ac8f753687b452622d205fe97fae72cf2efa41fff8
TLSH
T136718572A854B9774DE2EA05B8863F2ABB615027E5953F98D9ED0F0C02DB3D81352C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Local State
Size 16KB
SHA256 a328c5aef3c849a39e8873391825fa57da1988f40a10cdd1c015987f565fc771
MD5 05713de7b384dff1430a1d7ff9b270df
SHA1 c33ac73ffab8e8fcae19dddbf90cb90fc0d32b27
SHA512 a522c169f5288ac833f085bbc739f828c6eea88c1e460902daf15e452a8916747aca15ad12b06b2bdc775659770bc389e8daa306d51dfcd4dc8f98d94194f2ba
SSDEEP 384:z7+aQikB+z/xvxjg/qhE6NbMHsgCbI9zg:W/UxvxjgC+LjCkFg
TLSH
T1C9729D2B59687D3359F7F601B9481B5FDBB484B2A0C12EAC4DED4F09069B3D81303D02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Local State
Size 16KB
SHA256 ce410e2a7bd6e11b9b1365f41d852268de85e6437df60bcdbdc0116056731ba1
MD5 dda0fe1a0db382ead1b2d75f7765429d
SHA1 a15a9f6a07610ea8fd9ce8a392b230ca2728862c
SHA512 2e221917258f406e3553d1c2a9b3ada833ea712dea7838fdbabc2d901c9c12020dce542bf783cc274ecaceee3d0635a35c7801fa4f84b28d506143cd4049173f
SSDEEP 384:zn+aQikB+z/xvxjg/qhELNbmRUGgCbI9zg:K/UxvxjgC+d1CkFg
TLSH
T107729E2B59697E3359F7F601B9081B5FDBB48472A0C52EAC4EED4F0906973D81303D02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59113c.TMP

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Local State~RFe59113c.TMP
Size 1KB
SHA256 b738fce3ebdfde93e90f16283da0ade8265d778c17cc7f270017ba4b23e301c2
MD5 dfb83eca6ecf430ddefd3a2279131587
SHA1 dab17411270388d05451304e25e95e4c42bbb95c
SHA512 f71040aed51ebdeff5d1e2e0c1eceaaa52a4766f3f726dad8f41672ef4c922fc5bc7ef4337534cc47a83523bb14738088004bf83217161f88a31b51b2b3e78d8
TLSH
T1872142B2C4807EF65C81A545E107BA5E5E20902AE2540E1CE5DE0B1907EB1DC8677C33
MD5 SHA1 SHA512 TLSH

Submit Download