721f066380b3f99c92e39b3286b9851c4d59119208f420b9998e7f70cbe70ec6

Analysis

user interaction
yes
max time kernel
117s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 01:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Portmaster_2.2.1_x64-setup.exe
Size 96.8MB
Sample260825-bval8a1xez
SHA256 721f066380b3f99c92e39b3286b9851c4d59119208f420b9998e7f70cbe70ec6
MD5 e02558ef20c81a5458ab6a1aab4ade42
SHA1 9718d566336141ce99f1034451c9ea882bfaf258
SHA512 e838adf9a3509a88d0003336e1cf86ad8f0aa52880a52250fdb22f785c6c3c5a81c1572096d0d353458b032ea862ff8e7981c29c73c5b8dc83d2e1eebdcc4946
SSDEEP 1572864:7id1zV/kXljlvgA6D8thDxMWUxkhK2yHUs5M4XxDaGUcNhSS+ChPj7m40bODU:7cPCl2AY83DSRkwQMMKUfoSSZ5/mPF
TLSH
T1312833AA9898D745C764C1364C82D57E42ADFDA01BC3D81B39E37C07F63A10A8466DFB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5004 created 1296	5004	Portmaster_2.2.1_x64-setup.exe	81

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Portmaster = "\"C:\\Program Files\\Portmaster\\portmaster.exe\" --with-prompts --with-notifications --background"	Portmaster_2.2.1_x64-setup.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\Portmaster\uninstall.exe	Portmaster_2.2.1_x64-setup.exe
File created	C:\Program Files\Portmaster\portmaster-core.exe	Portmaster_2.2.1_x64-setup.exe
File created	C:\Program Files\Portmaster\portmaster-kext.sys	Portmaster_2.2.1_x64-setup.exe
File created	C:\Program Files\Portmaster\portmaster-core.dll	Portmaster_2.2.1_x64-setup.exe
File created	C:\Program Files\Portmaster\WebView2Loader.dll	Portmaster_2.2.1_x64-setup.exe
File created	C:\Program Files\Portmaster\portmaster.zip	Portmaster_2.2.1_x64-setup.exe
File created	C:\Program Files\Portmaster\assets.zip	Portmaster_2.2.1_x64-setup.exe
File created	C:\Program Files\Portmaster\portmaster.exe	Portmaster_2.2.1_x64-setup.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_tjk1q5io.mm5.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_irjg0bsj.plm.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_te1h1f41.aef.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_xds4i3er.ugp.ps1	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
1712	portmaster.exe
2972	portmaster-core.exe
3428	portmaster-kext.sys
5596	portmaster.exe
5064	portmaster-core.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5780	sc.exe
4516	sc.exe

Loads dropped DLL 16 IoCs

pid	Process
5004	Portmaster_2.2.1_x64-setup.exe
5004	Portmaster_2.2.1_x64-setup.exe
5004	Portmaster_2.2.1_x64-setup.exe
5004	Portmaster_2.2.1_x64-setup.exe
5004	Portmaster_2.2.1_x64-setup.exe
5004	Portmaster_2.2.1_x64-setup.exe
5004	Portmaster_2.2.1_x64-setup.exe
5004	Portmaster_2.2.1_x64-setup.exe
5004	Portmaster_2.2.1_x64-setup.exe
5004	Portmaster_2.2.1_x64-setup.exe
5004	Portmaster_2.2.1_x64-setup.exe
1712	portmaster.exe
2972	portmaster-core.exe
5004	Portmaster_2.2.1_x64-setup.exe
5596	portmaster.exe
5064	portmaster-core.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	portmaster.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5604	powershell.exe
5184	powershell.exe
4572	powershell.exe
3296	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Portmaster_2.2.1_x64-setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
5004	Portmaster_2.2.1_x64-setup.exe
5004	Portmaster_2.2.1_x64-setup.exe
2972	portmaster-core.exe
2972	portmaster-core.exe
2972	portmaster-core.exe
2972	portmaster-core.exe
2972	portmaster-core.exe
2972	portmaster-core.exe
5604	powershell.exe
5604	powershell.exe
5604	powershell.exe
2972	portmaster-core.exe
2972	portmaster-core.exe
2972	portmaster-core.exe
2972	portmaster-core.exe
2972	portmaster-core.exe
2972	portmaster-core.exe
2972	portmaster-core.exe
2972	portmaster-core.exe
2972	portmaster-core.exe
2972	portmaster-core.exe
2972	portmaster-core.exe
2972	portmaster-core.exe
2972	portmaster-core.exe
2972	portmaster-core.exe
5184	powershell.exe
5184	powershell.exe
5184	powershell.exe
5064	portmaster-core.exe
5064	portmaster-core.exe
5064	portmaster-core.exe
5064	portmaster-core.exe
5064	portmaster-core.exe
5064	portmaster-core.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
5064	portmaster-core.exe
5064	portmaster-core.exe
5064	portmaster-core.exe
5064	portmaster-core.exe
5064	portmaster-core.exe
5064	portmaster-core.exe
5064	portmaster-core.exe
5064	portmaster-core.exe
5064	portmaster-core.exe
5064	portmaster-core.exe
5064	portmaster-core.exe
5064	portmaster-core.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
828	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5372	msedgewebview2.exe
5372	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2972	portmaster-core.exe
Token: SeDebugPrivilege	5604	powershell.exe
Token: SeIncreaseQuotaPrivilege	5604	powershell.exe
Token: SeSecurityPrivilege	5604	powershell.exe
Token: SeTakeOwnershipPrivilege	5604	powershell.exe
Token: SeLoadDriverPrivilege	5604	powershell.exe
Token: SeSystemProfilePrivilege	5604	powershell.exe
Token: SeSystemtimePrivilege	5604	powershell.exe
Token: SeProfSingleProcessPrivilege	5604	powershell.exe
Token: SeIncBasePriorityPrivilege	5604	powershell.exe
Token: SeCreatePagefilePrivilege	5604	powershell.exe
Token: SeBackupPrivilege	5604	powershell.exe
Token: SeRestorePrivilege	5604	powershell.exe
Token: SeShutdownPrivilege	5604	powershell.exe
Token: SeDebugPrivilege	5604	powershell.exe
Token: SeSystemEnvironmentPrivilege	5604	powershell.exe
Token: SeRemoteShutdownPrivilege	5604	powershell.exe
Token: SeUndockPrivilege	5604	powershell.exe
Token: SeManageVolumePrivilege	5604	powershell.exe
Token: 33	5604	powershell.exe
Token: 34	5604	powershell.exe
Token: 35	5604	powershell.exe
Token: 36	5604	powershell.exe
Token: SeIncreaseQuotaPrivilege	5604	powershell.exe
Token: SeSecurityPrivilege	5604	powershell.exe
Token: SeTakeOwnershipPrivilege	5604	powershell.exe
Token: SeLoadDriverPrivilege	5604	powershell.exe
Token: SeSystemProfilePrivilege	5604	powershell.exe
Token: SeSystemtimePrivilege	5604	powershell.exe
Token: SeProfSingleProcessPrivilege	5604	powershell.exe
Token: SeIncBasePriorityPrivilege	5604	powershell.exe
Token: SeCreatePagefilePrivilege	5604	powershell.exe
Token: SeBackupPrivilege	5604	powershell.exe
Token: SeRestorePrivilege	5604	powershell.exe
Token: SeShutdownPrivilege	5604	powershell.exe
Token: SeDebugPrivilege	5604	powershell.exe
Token: SeSystemEnvironmentPrivilege	5604	powershell.exe
Token: SeRemoteShutdownPrivilege	5604	powershell.exe
Token: SeUndockPrivilege	5604	powershell.exe
Token: SeManageVolumePrivilege	5604	powershell.exe
Token: 33	5604	powershell.exe
Token: 34	5604	powershell.exe
Token: 35	5604	powershell.exe
Token: 36	5604	powershell.exe
Token: SeIncreaseQuotaPrivilege	5604	powershell.exe
Token: SeSecurityPrivilege	5604	powershell.exe
Token: SeTakeOwnershipPrivilege	5604	powershell.exe
Token: SeLoadDriverPrivilege	5604	powershell.exe
Token: SeSystemProfilePrivilege	5604	powershell.exe
Token: SeSystemtimePrivilege	5604	powershell.exe
Token: SeProfSingleProcessPrivilege	5604	powershell.exe
Token: SeIncBasePriorityPrivilege	5604	powershell.exe
Token: SeCreatePagefilePrivilege	5604	powershell.exe
Token: SeBackupPrivilege	5604	powershell.exe
Token: SeRestorePrivilege	5604	powershell.exe
Token: SeShutdownPrivilege	5604	powershell.exe
Token: SeDebugPrivilege	5604	powershell.exe
Token: SeSystemEnvironmentPrivilege	5604	powershell.exe
Token: SeRemoteShutdownPrivilege	5604	powershell.exe
Token: SeUndockPrivilege	5604	powershell.exe
Token: SeManageVolumePrivilege	5604	powershell.exe
Token: 33	5604	powershell.exe
Token: 34	5604	powershell.exe
Token: 35	5604	powershell.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
1712	portmaster.exe
1712	portmaster.exe
1712	portmaster.exe
1712	portmaster.exe
1712	portmaster.exe
1712	portmaster.exe
1712	portmaster.exe
1712	portmaster.exe
1712	portmaster.exe
1712	portmaster.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
1712	portmaster.exe
1712	portmaster.exe
1712	portmaster.exe
1712	portmaster.exe
1712	portmaster.exe
1712	portmaster.exe
1712	portmaster.exe
1712	portmaster.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 5604	2972	portmaster-core.exe	94
PID 1712 wrote to memory of 5372	1712	portmaster.exe	95
PID 5372 wrote to memory of 2620	5372	msedgewebview2.exe	96
PID 5372 wrote to memory of 3240	5372	msedgewebview2.exe	98
PID 5372 wrote to memory of 3240	5372	msedgewebview2.exe	98
PID 5372 wrote to memory of 3240	5372	msedgewebview2.exe	98
PID 5372 wrote to memory of 3240	5372	msedgewebview2.exe	98
PID 5372 wrote to memory of 6076	5372	msedgewebview2.exe	99
PID 5372 wrote to memory of 3184	5372	msedgewebview2.exe	100
PID 5372 wrote to memory of 3184	5372	msedgewebview2.exe	100
PID 5372 wrote to memory of 3184	5372	msedgewebview2.exe	100
PID 5372 wrote to memory of 5984	5372	msedgewebview2.exe	101
PID 5372 wrote to memory of 5984	5372	msedgewebview2.exe	101
PID 5372 wrote to memory of 5984	5372	msedgewebview2.exe	101
PID 5372 wrote to memory of 5984	5372	msedgewebview2.exe	101
PID 5372 wrote to memory of 5984	5372	msedgewebview2.exe	101
PID 2972 wrote to memory of 5184	2972	portmaster-core.exe	105
PID 5004 wrote to memory of 5596	5004	Portmaster_2.2.1_x64-setup.exe	108
PID 5372 wrote to memory of 3084	5372	msedgewebview2.exe	110
PID 5372 wrote to memory of 3084	5372	msedgewebview2.exe	110
PID 5372 wrote to memory of 3084	5372	msedgewebview2.exe	110
PID 5372 wrote to memory of 3084	5372	msedgewebview2.exe	110
PID 5372 wrote to memory of 3084	5372	msedgewebview2.exe	110
PID 1712 wrote to memory of 5780	1712	portmaster.exe	113
PID 5064 wrote to memory of 4572	5064	portmaster-core.exe	116

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:1296
- C:\Users\Admin\AppData\Local\Temp\Portmaster_2.2.1_x64-setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Portmaster_2.2.1_x64-setup.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5004
- C:\Program Files\Portmaster\portmaster.exe
  "C:\Program Files\Portmaster\portmaster.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5596

C:\Program Files\Portmaster\portmaster.exe
"C:\Program Files\Portmaster\portmaster.exe" --with-prompts --with-notifications --background
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=portmaster.exe --webview-exe-version=2.2.1 --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz,RemoveRedirectionBitmap --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1712.1480.2286844609579821601 /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5372
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView /prefetch:4 /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffc3e725fd8,0x7ffc3e725fe4,0x7ffc3e725ff0
    3⤵
    PID:2620
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1724 --field-trial-handle=1728,i,4416619530040821708,11325527035761527888,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c
    3⤵
    PID:3240
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2168 --field-trial-handle=1728,i,4416619530040821708,11325527035761527888,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c
    3⤵
    PID:6076
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2376 --field-trial-handle=1728,i,4416619530040821708,11325527035761527888,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c
    3⤵
    PID:3184
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3508 --field-trial-handle=1728,i,4416619530040821708,11325527035761527888,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c /prefetch:1
    3⤵
    PID:5984
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4504 --field-trial-handle=1728,i,4416619530040821708,11325527035761527888,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c /prefetch:1
    3⤵
    PID:3084
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4600 --field-trial-handle=1728,i,4416619530040821708,11325527035761527888,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c
    3⤵
    PID:5048
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" start PortmasterCore
  2⤵
  - Launches sc.exe
  PID:5780
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" start PortmasterCore
  2⤵
  - Launches sc.exe
  PID:4516

C:\Program Files\Portmaster\portmaster-core.exe
"C:\Program Files\Portmaster\portmaster-core.exe" --log-dir=C:\ProgramData\Portmaster\logs
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive "[System.Console]::OutputEncoding = [System.Text.Encoding]::UTF8 Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1 | Get-NetIPConfiguration | Format-List"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive "[System.Console]::OutputEncoding = [System.Text.Encoding]::UTF8 Get-DnsClient -InterfaceIndex 3 | ConvertTo-Json -Depth 1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5184

C:\Program Files\Portmaster\portmaster-kext.sys
"C:\Program Files\Portmaster\portmaster-kext.sys"
1⤵
- Executes dropped EXE
PID:3428

C:\Program Files\Portmaster\portmaster-core.exe
"C:\Program Files\Portmaster\portmaster-core.exe" --log-dir=C:\ProgramData\Portmaster\logs
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive "[System.Console]::OutputEncoding = [System.Text.Encoding]::UTF8 Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1 | Get-NetIPConfiguration | Format-List"
  2⤵
  - Drops file in Windows directory
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive "[System.Console]::OutputEncoding = [System.Text.Encoding]::UTF8 Get-DnsClient -InterfaceIndex 3 | ConvertTo-Json -Depth 1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WebView2Loader.dll

Path C:\Program Files\Portmaster\WebView2Loader.dll
Size 162KB
SHA256 609c974a8cdd6a76a745b3d81b62f321d79f2dc8f4929e1eea8469d9d78baf79
MD5 6842f2ebf863ab8ee1be470794d1f703
SHA1 26242ced6ddf005e0ea1073409a058121636fc9b
SHA512 339be4521b27e29e457e6d662a7ac98320729ad75df976ccdc9c83596c8b1bc7888ad465e7d38276fb5c0cfb597e7e6e9ba377c6f42db850c317f89e218ba5b9
SSDEEP 3072:DrQJpSFTlTRTzWGbThTNTFSkD0bHYVNqGM2h9P58LZZ5Aalq/Ty+EtJfy2aQQtq:nMMTlTRTzWiThTNTFSzjiBM2h9P5oZaQ
TLSH
T18DF35B5772E4407BE16A8274C5A34A11E77778510B60ABEF03A4477A1F23BD4EE3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

assets.zip

Path C:\Program Files\Portmaster\assets.zip
Size 2.5MB
SHA256 fb61a09b7223ad9dfcfafab71a25afca42fb5bb36250e5518effc7bc1fd31550
MD5 e20f29e0eaf8a5a831965d97a9f8167a
SHA1 9c76e79199b64de386783f5c5e8af3013f8d4fb4
SHA512 4ec787e4e8d17f548966a4bf8cb7d271a550b5d52a9bfcce243a7bfd27751c1543dc293e8bac61d0c7c94435fb134c2b284f42a541ce76b357fac12815392ab7
SSDEEP 49152:/fTenm2X8kKQr9mwR4mSKHFK9nsmuN48JTKqXbRS7Eg7OBqCuGOM7OAFXE:Im2uQr9nSKlKVsmo9h9S7Eg7OJuGOuFU
TLSH
T185C523F2F3175CB4E7DA8136B198F402FDB884A08787A1151953E066FBB0DD98B26E71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

portmaster-core.dll

Path C:\Program Files\Portmaster\portmaster-core.dll
Size 23KB
SHA256 a0f7d615bdd58230e20fe66df6804fffc20a38bdae8b540780236f6b15dac580
MD5 0f94aa3c904db33e99fc076223491719
SHA1 5d24da70bd68610db4ba000aa22176aaa86a9872
SHA512 8d8fdba2f1237072269ed1c2365ec2e5733010618a893b62a958ce38b31affc2aeb207be8afbc3fc189b5204a45ad518b6cdd98788235567b7651603b8a85124
SSDEEP 384:+FBUmttyqVLSXCOrZrz61GaprQ2ADrrsMy8RbmL4nNyMuhqM:+FIqVLSRVMGy82ADrr5ALVhqM
TLSH
T1C6B29E83999448D1DC16ADB4E8F65E26F9FAB5102BD292CF037081A50FA33C13B7E49D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

portmaster-core.exe

Path C:\Program Files\Portmaster\portmaster-core.exe
Size 41.7MB
SHA256 0b5aa3d7a4ab8b03126a3dc8346c39872164782d8b067f804a142290e3e6237c
MD5 bfda9c227eee51367528ce88996fee7e
SHA1 00c3b4fe397b652de7798c6acdd21afe71c91e57
SHA512 739ace6abb57ba4ae0283cecdf5e958c17cfb0f86c17b2512fe7ba90f2911b96f1024dd3515b9486d37bf0dbc5044dfc45e857b647b86adabb252a2925a5b0bd
SSDEEP 393216:0Mr6+/FGrPzPKyMAfZFCatIhXRGdH0X02D9jj1c73+ZBI:0Mr6+NclZRIFRpkU9jpc73Cq
TLSH
T1CDA78E87E92141E5C9A9D635C5A292177B713C489B3163DB3BA1F2243F73BD0A7BA340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

portmaster-kext.sys

Path C:\Program Files\Portmaster\portmaster-kext.sys
Size 283KB
SHA256 e07d172667bddc606c6a76079ed3e79281fa23ebbe68a9740ee71ea681b55d4d
MD5 3a21e73e36382cce7d092205f0b8f3c8
SHA1 343f090bd2ac1230ff04bcc8f2cdc8fc469445e7
SHA512 f0861bbc31e499eb30a9bb5cd45dd9e28a5d7168c020ba092ee81054b31e075df3586eb8838e66574712880a3ec642ec9fe9402cd1fb2ad238792a3570fcade7
SSDEEP 3072:0eZxH/Aep2Cx9YkUCTGUTRghRj6jyCGfvjrFw3h3j5Da2W+XBbdXxxKD:0eDfAepnx9KgTg2jDGfvjCDDXBBaD
TLSH
T1DD544105A908E1ECC485C1FCF1BA5AA2B5B7377D3B2573F68170B21036985B85A3C9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

portmaster.exe

Path C:\Program Files\Portmaster\portmaster.exe
Size 32.9MB
SHA256 e27cddea106b682dea030fc07211c1fcdb68b38a97510efd109b89d585463dae
MD5 5231980e77e35ed261a0b61c66afc4a3
SHA1 8bd210584c0aafbfbf6788b8e8a1eeb6eb4d065f
SHA512 b7ee5bc27403064e53b2a92ed39ffa63961b25e0f13fe7252318c8bea66e25d0e8a46e8cbef65c18358c753a87425fcd2cf9bde51c6ef7c92de0e6057d3b2f0a
SSDEEP 196608:H/Hh1+tfNzmI177SRbRAB3p5ByOOpo9ELk5wCqcHgG3o:fcjMVo9l5tqp
TLSH
T140777E03F5641A7CD9AFD67486AEA336FB747C894131FBAB06A0BA312E32751971C704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

portmaster.zip

Path C:\Program Files\Portmaster\portmaster.zip
Size 1.9MB
SHA256 563a732e411f9e22b60fa8142fdc1657414bfef1838923051d3f7b2250643cd8
MD5 8c351f9c0759036bc2e0526c8812492c
SHA1 cc81f779cb8b03cba72c16081350e996a8543805
SHA512 8da9254ba3251d6dadc271d7eb4969e0ee836a36461a13f0f84491e1ec2472fa93cd2a756042ae80a5e1036d2e510bc0cf3751adae9534e64f16bee76bf6db1a
SSDEEP 24576:OUsax4iASwACVGJw8n+p+yzOoPK+FYglOtY7UgFZADGET/CIIH21QthnV2RO9Fx6:FsXfx5GJwum+m8DgI27UgLETXMcinVz6
TLSH
T1EA95D1F4C71A5A70CB2FFCB59907978A9E898386574E3D5F5E40E2007E7B1C1ABB0A05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.exe

Path C:\Program Files\Portmaster\uninstall.exe
Size 770KB
SHA256 7398046b21cf0cf9cee0fc3088dd9ae9e4b2f5173e84af0e9d741e6bf34277f2
MD5 7e8cc2e733f318b513e46fc118a570cb
SHA1 a9a4255f7383b34a5484b625da6d2a2dafb36c1c
SHA512 f107847ab0edae0595367142169480f1c90fae67cae45441a05ce1a783d33f7bc946ffb8684dd65b51b161afe3b7f534b480abe0de964cd48302368c6e774e58
SSDEEP 12288:mY3QZb1kSY/XQ3PqKvDQN9AUavQhSMnM6dh:mY3QgSW0qKvDQN9Y7Mnt
TLSH
T13DF4126667588463CA210BB04877E7FB2AB37D462470971B63D5BF6F3A333838A09517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db.sqlite

Path C:\ProgramData\Portmaster\databases\cache\sqlite\db.sqlite
Size 184KB
SHA256 4cb8c2183fec175b246d8dd5aa1d6a1eb4bfc0b4b9442d6d7d93ddcd1264696b
MD5 8ecbf0d504b704619a2f768546265d3a
SHA1 c50ef41331c89bacaecb0eeb3a4d8ce911260c1f
SHA512 0d612061c241936dcab7da6c0c937e62bbfa05d72f6a3e60f6aba8207e454089877252866792f84fce11b5848dd8f79563174eb22b927cb817ce2cbd8740fc77
SSDEEP 1536:ky70Bsaz0ibjTqZnpiC506KwuVUITd3tuzU9tgYLLTJ:O53dszK
TLSH
T12C041169E2F929B1C7DCA4FBF880B7B604C1FDBAE486449431FB68D8D78546C903A41D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db.sqlite

Path C:\ProgramData\Portmaster\databases\core\sqlite\db.sqlite
Size 56KB
SHA256 813a0e9d3e0582aeaa52f7d2346a1a52dbb89e45c7c9f578c5db49da6889c228
MD5 eeac2dc6ab605290eb5e0b126cd10924
SHA1 ef313d7710d6d704101d2cb768e65ce0d58868c5
SHA512 70e421766357085cb0c82bfa9ee830494a562a029471ce37135e6fcd8e4407d345a7226ec4e209edeb594841ff139313134399707b61b106b74cd70c5492cba6
SSDEEP 384:sjmS32lLJVOkP5xsJUwG9/UfsUxaUTSIWtWhLJVOkn5xgJUwGG/UPsUx6P6mSTd:sS8aPPm6hNUn5WtWhPnC6wtU0Zo
TLSH
T10943DB8082D12DFECF844FF8A0CD2891EBFE124651978D8D5A9B4E01D6AD47A837B53D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

history.db

Path C:\ProgramData\Portmaster\databases\history.db
Size 24KB
SHA256 02dcc55b6f59aaaafbf448537f1b434bc168f6716587522671b05338f4182313
MD5 e2ef66e867a1d78cdcc2d1af00050bfe
SHA1 60372a021f9f2fdca4253b1463ec4d6792a2f8a4
SHA512 4940a5745e9a55ffdff950f4590dc945edd629d581a8eee301095809b82b6371fbe189032e1762e866c90e8799f269b454c3116be1ac105086b7bb74c0b7dd48
SSDEEP 48:TzrfrpgYq38glId2f78F4Eh5fzxT2kp5z:vrfrpgYq38gid2D+TfzxT2k
TLSH
T182B2034D5F1033A0CAF741B6E8D309C36F7E901C136622911AB510F6D8B21B2B5AB6DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.dsdl

Path C:\ProgramData\Portmaster\intel\base.dsdl
Size 14.7MB
SHA256 6c770483743f20c49ec7c57bdaae78b0cc30c9496c8a10a4f8675c5baeaa4498
MD5 65d460591a2875752cee844c29c897fc
SHA1 ce1bfe9dc428cc6300e0db4d79a441b33f8f9a27
SHA512 4a3c19ee9c1b9b76651e25346da861e7ad384481647588a3ff3c91f704a582969277e86efe92c2ae5f0f08ff120e61a1f6dabfe6a8e3fab0a07ef8ee3d684b15
SSDEEP 196608:7Z7aaVRpx8AS4wz23CLsBBbxvcJai95qfRWk+3/umMqaI0ju8YlvrrnExcgJnRXn:7ZGaV6cRhifqfokGMRu8YlXECgvXZN
TLSH
T1D0F633A313631A50684216BC3B7D37B3D82E86485FFA75D2884F4D26D68B08BD706FE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.dsd

Path C:\ProgramData\Portmaster\intel\index.dsd
Size 4KB
SHA256 026325cc7af459251fb08dce0a6166aeece4c9b5a4b7d26e15f4f7d94e0e6e0e
MD5 b5faa7d7a5aeddbaa0745cd62b18a4b1
SHA1 3d94a5f99e7fdd3e8159bc03e42567b06cc70d2f
SHA512 0e01cac618d62440d8cd3236b94bc108984ae023a1e8fab5d8e99d19f38e6964b6eb3c359faca13d6d9defd59f4fd5e3c93f84914dc7b2d2c29b2a15d70a05a0
SSDEEP 96:JAAlALAc6zrU0x42TFqXB8uFu9pDAIkCBjW8ts1qGkFXhi:HUIrpxFTFCTiDE1qGms
TLSH
T18B915D3CB1CCEA4BD27F6858E27EDF02975B3930FC55142741ED76929AE68129360C24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.json

Path C:\ProgramData\Portmaster\intel\index.json
Size 2KB
SHA256 4d9e21ccd810b34903f86ae1f3daf07619c34f5665fea46be17ad3e077979499
MD5 12d9b34bb53eb6b385cf8c9543496dcc
SHA1 1ebea8c35987950db07bb245dc722739bee1a413
SHA512 fba65ca23323742eb33a8d5da54974824adfa058ea3911bbb8ab6cf470970d43bcb2a6b86bc88aa4f29c0544778540308fee56fe37751554df2ad114c5f12cc0
TLSH
T17C51BC86C2756D6321CC33B185AD3095D62248DB6CEAAC09334D644C0FAD0BF2B3F28D
MD5 SHA1 SHA512 TLSH

Submit Download

intermediate.dsdl

Path C:\ProgramData\Portmaster\intel\intermediate.dsdl
Size 17.2MB
SHA256 8be0df9689d4f1ee809fc633179485d5673e1126fe1fb9e0bfe296f2fb9f672c
MD5 8c68219d0283fe3f340c21188063343c
SHA1 c5101ab1f6ccc3d26d10e2352feddcbdbe4baa65
SHA512 623bc95c5388b205b61ee014e97ec2b73d73c97179cf13932d93a49e249461253abaca2000fb94ce7e79668a5bbe5fb6772a85b18cbbadacb6087228e083079f
SSDEEP 393216:IodqbI4Ey8LkbUqoOk1LJayaO1HGdsYIj3Z7Zxw:IsqbI4EpLkQFOvkMds5zO
TLSH
T1DC073313EE772602874299CF678C72D576394854E289355330DAF1ABBBB0F3E6890673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main-intel.yaml

Path C:\ProgramData\Portmaster\intel\main-intel.yaml
Size 14KB
SHA256 c73be8f0600af4500f5d3e6f8e354f5d96dba2ce37d59aa976306a8ea9e5bc6d
MD5 f6a3e1979bf4189a242208c20119c4fd
SHA1 f15becdb33ae10c8898930eba7720e2e4bda5ac6
SHA512 881ef1b5c23c2874592bd3c3e0c7ee3dd5cdaae8b9625c353ae3b7071ebafdbdb743bc93c49eeab3fa30ff4541248842004803fadf98be5175a7f4b8611a8d3c
SSDEEP 192:HixmSUHIiRigYk4R9bG9/KmAcc83qSob4JE/RM5o9qLXVteDlP:+K31Yk4e9nUVJkJEZMK9j
TLSH
T139625456C72D1878F068D261E77BB6F1B32A8E039161141477AF93B91F4B34772E80CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

news.yaml

Path C:\ProgramData\Portmaster\intel\news.yaml
Size 972B
SHA256 fa64e8d0f2adc61093df516d4be68ad536c4de29fd9f7c2473311dbdaaa1f9c6
MD5 f88861e9dba633b7ed2b8db750e9b586
SHA1 fd6355f3d0c0ae83713d42d4c6650fe7b276ffea
SHA512 e5b671bfece741ed5baa57514c366d7a9623b1e914e8fd10af19fd0f7454959357a91b284fac4a91a581e6d9013bbb6854ad5eb1b05bc84b261f60d8cb456fc4
TLSH
T17211E1671A146B0E4A5557DEA2DF215DD305E6EEAAE0E0B878CF8101130E86454BE05D
MD5 SHA1 SHA512 TLSH

Submit Download

notifications.yaml

Path C:\ProgramData\Portmaster\intel\notifications.yaml
Size 6KB
SHA256 8168f64860717712a9d0a00da876e84f03c34834b3a8e0e1dfa783a9c29f7235
MD5 9f328dac539016f79a513f5b71517c29
SHA1 b6b5d1a04eb8b6d0d88819e818d448b159a03381
SHA512 0b3697a9b34ec142a9427e66c3f2e9f07aba92381c5bafc1111cc055f6e330f1a96ce08d13f4f9c5b8ca3dd3f3d7b1a37b9cb535ceec56e972a988d2f610b7d5
SSDEEP 96:cUwvh6VR0ymBfRpXVNrnr/dqOZhXM4xKDqrFnn0ZEtn3FNT6RA+niFjRAEniFWct:cUI6H0ymbJrRqwrKDKAovK2vct
TLSH
T1C5D185D7B348A67ECD8A109BA4C251A18625F9EF937098BC70DD511C2F0B77081AFBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urgent.dsdl

Path C:\ProgramData\Portmaster\intel\urgent.dsdl
Size 2.7MB
SHA256 10d70c5ae83c6554a169f97380314ae0bc5c1bd51110a4cefa5ccd548a714c4b
MD5 451b0fd359fabb80ba3a2b0d483e755b
SHA1 968b5159f2110ec885e3de8aa11467923d00750f
SHA512 51b2c9deb7c61380b08d17d1307f902d64f078f98d563c7bb53f43032b26eff08ddad2e149978529f18d858bb8f1bbb0290a9943e38d61b56b90eae9db39d20a
SSDEEP 49152:9OjRIwzVlQC4cBchk8IYfY42oBemlunvdbElgLUSJtQ+ilf61SsYUwveja9Nlh:oiklaGlYfzQz2lggL+ilESleja/
TLSH
T1D5D53310BC590240AF0233B18B835E769E3594B98FA0938A565FC9CDFED0CDB679B54B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-25_01-31-25.log

Path C:\ProgramData\Portmaster\logs\2026-08-25_01-31-25.log
Size 7KB
SHA256 bb8ad2a67c4dc7e86d52ffaf6971b24b949905b6cc8fdbc5fa708328c5829fd9
MD5 f66ab7ba288542c45da813010aa5ff75
SHA1 65a8696dd5efeb56072fd6398d44f3f638c23045
SHA512 71bce99c4c560226b40c1a4018e49dca6271f2923880e007f61ca31d5bad7eadad1bd55622f13f13466028e2ac3c1460919addc12caf0d1a5c404dcead42c078
SSDEEP 192:15110mHKE3jRr39Apcg8mIK9no8WQJ/8GMxuNK2GT1lGT:153k6jRq
TLSH
T1A1F1338652F400E83DEF10C6DF945794FE27760FA3A48652B59DE96C03EE14EB6F2284
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6788aac3ec9b0417331dda7afb51907dae032ac57befba4997860b90ff8357d5
MD5 60c973acc3ddaa3929052671f6fec1a6
SHA1 685bac8dcf4d964c35a9020a2c1aef3bbf03aee4
SHA512 b200e735e6d6d874dcb8cd80cb22e9d787e51ee29def9a7aca22fdadff3795cb966269fd1e4947effb467300b692c788f445531ae8651b68d893a7cf1294ba9b
TLSH
T178318633B3DC8325C899403A10CDAC2036BAC7CB40DECF9B7B80E255A42F6A9DF50160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ws12uwli.prc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ws12uwli.prc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

SimpleSC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm53B6.tmp\SimpleSC.dll
Size 1.1MB
SHA256 1620cdf739f459d1d83411f93648f29dcf947a910cc761e85ac79a69639d127d
MD5 7b89329c6d8693fb2f6a4330100490a0
SHA1 851b605cdc1c390c4244db56659b6b9aa8abd22c
SHA512 ac07972987ee610a677ea049a8ec521a720f7352d8b93411a95fd4b35ec29bfd1d6ccf55b48f32cc84c3dceef05855f723a88708eb4cf23caec77e7f6596786a
SSDEEP 12288:fRdJsAp4dXFcLBz75cwoCmJKHwe6VuoH9v0D/LF5mM6:fBsmyVS151oCmJKE1dv0DX
TLSH
T12F354B2BF645693EC5AF063E4673E714993BBB726912CC1F56F0084CCE2A5406B3EA47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm53B6.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsm53B6.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm53B6.tmp\nsDialogs.dll
Size 9KB
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm53B6.tmp\nsis_tauri_utils.dll
Size 30KB
SHA256 7317e5508923f425bced2698bb89f79b00fcddcd1028f44b598732b2e3711464
MD5 fc4691e51cdfac476b2fc63bbe951e82
SHA1 6532da4545864c6ec95f62f27f2199bfd668560b
SHA512 5b544832f1b1b8f2e1c6f8d61a839bea22c2c3d7e2a03671a12bab936e46a6f3fa3dd8aa53ec91157c1de08f0b349d6d2c1aec29385ad38cc0b2ab4c033c58ed
SSDEEP 768:IMSeZbzz284uMJSmuGrAFKpnp0jdhK7R+qV0Z:IjKfAuXiMtXIV
TLSH
T16FD23918FCC56FB6E2DF1575240C596E429FC8180B14CE9BD7A25E22E9E63722EE500F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d1e178eb8c4fe5dc496dd567c47546707fcc7d1c6f4a87eb4c74fe40e68befa2
MD5 022f7136bc3c5ba1a3c8e567cd5d525f
SHA1 348d1b154fbe9ad95e1973bb20358636a61dd0f6
SHA512 b9291f8e41b3b6320e29e9e033bc09d39101b4f3476ae7128781e30979488e3389953a106b45fc2ab7869de91b42592ba2f7d837efad587f08dbb02479d78e6e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a81bedf75b9e2a3ad5a0cdac69d849c41ad01568dc3a1af1f39f6c487fadce9e
MD5 6039ed4afcafe34e47d2f7dc089556c9
SHA1 4996d16811713f591a8224c0cb2da6e6f7b84fa0
SHA512 1e4556c0153777ad88da59dd41ce9c6aa813672ec47538b33b7daa5947a9b5952bb9f0e0dadc4f3062d7a903196d55d51970a69fb220621f78e0e899a8c9067e
TLSH
T16FD0122676321134C41021330003A10D34C2C10B85054C005828D59D5B0805C0917842
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2590ec5932be732637566b779a711e8d68f82a0b9143ea59e7fec612421c92c1
MD5 219e14adfff01bd49aa877ce69f2f71b
SHA1 374d50d0db208ce849b9e46bc05dc6e5d73ee516
SHA512 d15b29ccd7c59474e09c3d275262e900beb3321f6b89af5f703a5af8e822945b70e38a92526ca19443c6ef9d77161eee48e265254f698c53e2bc5edb1e32f901
TLSH
T1E4D02B7622361530C61032378083E15C3082C11F45064C001E35F99C4B440E90C86C42
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

29e28597-e24d-41fa-8792-c32fe70a5951.tmp

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\29e28597-e24d-41fa-8792-c32fe70a5951.tmp
Size 6KB
SHA256 a70b069760b3a8f5d16f1b0e4f25016a523df88896845bf847ab9eaf8210cdf5
MD5 55feee2a66db95d4c4795d9d8abe302a
SHA1 1c23a06f6d84b0de447f1041ebd47cb1947dd24c
SHA512 5ae034b7beeb8ded3143f8b9249b048967a55b1b5ad4631204d4928aa12a300029ec8c80daccc11ac0d6e05537b5071e2ba29b65a364988d62d417c169c90f56
SSDEEP 96:stX/dGc1Cb9WkEo5h16ZdXs7/x+6Mhmuec4g+1eje+K+gk28XM1C7K:stvwKvoKXsV+Fcg+QjGuG6K
TLSH
T12AD1B7015E24797B8CC6E249FA39BA03E3F9943260D41E58EBF8562C19DA6DC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Cache\Cache_Data\f_00000f
Size 525KB
SHA256 c8598aca2a616f5fcdda15a95c5ee2d7c2be4ecc30edf67943c79e5ae97ee6e5
MD5 eb8486588dbf89a9a3803cb047309a25
SHA1 6b7343a9a2aaa28afad39809f52ff093d9c6203e
SHA512 11b72e41429b7d2ccc40378e30ed13955a42680b0a7138cdb5464d46e6488d4ef6a042b2b44aa0c5534e08c40c952e830717dab10ae46aa855ed7f471143b914
SSDEEP 3072:gGLJA6L0kscOVziqI6c5ihj5mL41I8FVyfUxxBhyfOLwpmrflCoN0jMJ3XAKXasP:qF1hwi
TLSH
T11DB4555981810E9FFBAC4BC8D9E77DAE5825003298C8EC4CB4DDACDC815CB9DB056A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 6817b884b45a47b94f814d5b3032ec0f699639f84cd493db67eed6381dd68eec
MD5 b7c5fa8b4c97c52c639e0b4687ef8269
SHA1 07240f3bf223a784f0143af8064509cbf6152283
SHA512 98efd4b251952d4069e101da0a9357385d9defe8959d52ff9c457d130b91847b6864d44a79ad93a922b22a5e6ef7599941deb2f8b8dcded7214e9c21b9ede635
TLSH
T132C08C1104AC8433FB030DF13EC121C270FD88681003DEB2431EA077E810B1F4026006
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 603fbda0461127b3e7c04e05272ae8f819d549fca5cad32b8dca52c9c0eb84ad
MD5 ea5fcb903cd3e8e99bdb0101c1727995
SHA1 ab07e6ab40976f57b14a9c896d16a3cfcd6b1e73
SHA512 dc36a7956cfa8af291287c9a92413d73748d20ed18ef46b659f3ce0b8125466c1ac95cd57b26908466b0dc7faa779185c4f305fe7619085976e360683c003c5e
TLSH
T11DD012A1366E8402EB0B9DB22BC262E0B2FB08A888C3CC8E87916176412474ECD64908
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a4f2b.TMP

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a4f2b.TMP
Size 48B
SHA256 ef764e91eecd4908950b0e7227917ea28b21e4133997d9d8e3473aa6cf965052
MD5 e3cd2d8517123992bd1cf58e0c5c850f
SHA1 58c76502b37acef64711df12de1553e0f57e5f63
SHA512 1ed52d53811f57d04253a68d33c54fc72a77f1a9ffdbcd88be7612b17a98d20984e927880ab37edfd673af6407301f139fda5e815fe821ae3b2f1f71f279de0f
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5b2315.TMP

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Network\Network Persistent State~RFe5b2315.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Preferences
Size 6KB
SHA256 daa9cecdf59f6a8e1f4298d212bf262ac2dc3c53799d6dfb11f2b939adfcd446
MD5 b6844ee9ddf1bd02c529dae2095287e0
SHA1 2a7b8182602d057f14313c05b6ea53d7a364b413
SHA512 a2ebd2ffa27ce5cbade511365403ab721c56821155c5574d39d34c16422f98c297d720c6c1e87ec0b51c7172bf29e2b32ee2fa5d7c4f54a8e90541114c0bff11
SSDEEP 96:stX/ddc1Cb9WkEo5h16ZdAEs7/x+6Mhmuec4g+15XU1eje+K+gzb28XM1C7K:stvzKvoKAEsV+Fcg+jXUQjGJG6K
TLSH
T14BD195015E24797B8CC6E14AFA3ABA17E3F9547265D41E44EBF84A2C18DB6DC2307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Preferences
Size 6KB
SHA256 eb63b430b46d4d53dfccd55ceecc6bc8841f84888a6dce10f32a212a889237a8
MD5 a7dbbb44b5aa7c6183d096a4b4ad378d
SHA1 3c2d16a1f8daaafbb04013f72bdec5cf08ea34fe
SHA512 1de8386981f40f103e61c7358986fe82563ffb386928dca6f2d65b2d1d6b144485f7259b4b89d3fcdded72a4441ff00f6338a2d87443246b5515baa08cdfb96e
SSDEEP 96:stX/dGc1Cb9Wk+Ko5h16ZdPEs7/x+6Mhmuec4qPSMkvQISj0je+K+gmP28XM1C7K:stvwK+oKPEsV+Fcq6DQH4jGMG6K
TLSH
T18EE193015E24B97B8CC7E55AFA35BB13E3F9547261901E48EBF8492C18DB6DC620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Local State
Size 2KB
SHA256 0c95c0672d94036a6d7678404345b9656aa44735a23613717a0bc9ebf9dbb061
MD5 fb2108399f242b015cbcb4b6810ea99c
SHA1 fddc2145d1bf6c4a63662535f1520e8f0bfd427e
SHA512 6d3c0e6a21b35a9cf8e6a9b3fcdf4e9dac27f47c4db55436f8af8b878d81a76e12bebb3bbe1800355038a37d1d8e974ca5228655d6e13215a0149d5e4430a70d
TLSH
T10D5150737820BB3389E24745B99B3E13DB799062EA621F5096EC1F0D01D755D1386C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Local State
Size 3KB
SHA256 ac7693dc4b9659079c45ce577f4ec5fdf8ccec7aca43cea30eb48155dcf11461
MD5 788b490d31b7ae335390b2bfbd1cf8e4
SHA1 637c7a4681551c038a2011e5cd6013556b9969c3
SHA512 436b723cfb48d10aa5ad12a98006c38fef7afee4dbcb0f4cb156ba5c757b40572c3c691a7019b47e3f150ac51ddcb0f138ece1e250a6fc0ea6a9491cd8e82dd1
TLSH
T1BB6164726970BA378DE29B45B9863F07E7A59027E5913F94C6FC0F0D01D72981392C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Local State
Size 15KB
SHA256 57eba06296be0d66a464c46f9072e29ee7172c67ef0b89c373bede415308834d
MD5 ab3594dbcbb768a0d7f78a80edb32f80
SHA1 77cd74c0331407344586e94ad80e2ff484ebff5c
SHA512 0fa85e4496b942d8df05c9735ee66c9e598be78419c4d3b3d5ca8f5e8197b0c3ec17043e42e71fa1e8a85e69a86e07d46f46656f23fd5a263f46e44d742c2aa1
SSDEEP 384:s+aQikB+z/xvxjg/qhERNBSOwdujK3gd4q07nZ9zK:L/UxvxjgC+9yI4q07ZFK
TLSH
T1F872AE2B92797E2395F7E605795D1B4FCBB898B391822D7849FD6F0D06C32980346C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Local State
Size 16KB
SHA256 f45ed7416835045757d6367acb895e9967ba51fa888cb3d25ac6649927a03d7c
MD5 b4953fa0dcec5ced8cb94898a5e88c2d
SHA1 034eabde86109bae8493ad23b8524c569441879c
SHA512 b26719f8409e77beb3a51adddde1dc79c552a1699eee8180d428b5ba1547134f5d7045635e63b8269eac4db27b772d56a3ca74a93e54e8405bcbba4133402e8f
SSDEEP 384:p+aQikB+z/xvxjg/qhE0NBSOwdmk0K9agd4q07nZ9zK:U/UxvxjgC+LcI4q07ZFK
TLSH
T1E0729E36D5A9BF2798F79685790A6B8FDBB484A251C15DE449EC2F0D06C33DD0306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Local State
Size 16KB
SHA256 6d29d8ddc8021c5108f6b418f27b9f805e9226e7a8c68ddb26c19beffa1eb4c8
MD5 b4ed98b0dfab84d30f9bfda07a1fd1dc
SHA1 ab0760a193a07e9d4620c4d86f7aeee0aec57b70
SHA512 4dca6ca61af53268d463b673a523a906c223787cb467b692ee159a1f2d258fea6e0d70b9bf90121788a0751d9d51e660cd295bc29818ebfd8512fd75cbe874c8
SSDEEP 384:1+aQikB+z/xvxjg/qhECNBSOwdmV0K9agd4q07nZ9zK:A/UxvxjgC+AcI4q07ZFK
TLSH
T113729E3AD5A9BF2398F796857A0A6B8FDBB485A351C15DE849EC2F0C06C32DD0306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59fbcb.TMP

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Local State~RFe59fbcb.TMP
Size 1KB
SHA256 dd3ba9f8b031938bd82426b8b9672800af46c5f49fc6ec133e20dedfaadb6ff1
MD5 fde74c9ac9fdd4de83ede9e2ae67be12
SHA1 2dea82eb76104e9b1ee6ef9c4b262002c46cfa03
SHA512 ae3da1bfcc3eb71948bcf42875dd3bc1201d7bf8f889261a4c85e25991902138adeb19436683f3265845fcafd89cae7d4453c592091d9bf747a532fac998faec
TLSH
T1422172B2A4606B32ECC1534661577E0BAE201037C2218E4061FD0E0A06E705D46AAC32
MD5 SHA1 SHA512 TLSH

Submit Download

2a2e0412b8ad04a2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2a2e0412b8ad04a2.customDestinations-ms
Size 4KB
SHA256 c7ac4cd1fed59212ad4c50e3b59581e00000934026d373511de1079b950f6a39
MD5 9afc696f466f3866d5896d56d621e500
SHA1 5968e893233082a2298af480ddfd22060d1c2111
SHA512 206f5cee50e8ec67e654c87dfbf9d6be0d335b6f29f4f14871a07a4c8614e6b41444920a459a8d817c2d159a43ef4ef37756e59b8f71e5370b1947f4bc5f48e5
SSDEEP 96:6B09R6zeJ+7zHu8zKOpLB09RKzeJqJzHu8zKO7:GIRxQ3mOHIRBEJmO7
TLSH
T180A1E1091BE60B26F1F7AB7245737641A677B986AB144B9D00CA43050872E84B9FCF66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a2e0412b8ad04a2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2a2e0412b8ad04a2.customDestinations-ms
Size 4KB
SHA256 8d0974812a139c5e9d799aeff07a696a8bf83b4722f2185ede769c1e835ed58e
MD5 b36d381479119777336269839aab11de
SHA1 a0ec734e9deba4820f9021e2d23de448c92c91a4
SHA512 aa48701c77543d7f4b5104f33e6afb4d2e3fd40c0656aa0a09e0a6a98c2ca0c71cf8325991732e0fcdb33010e6f01e437dc0d3376ae54ac562a4ca2b99734e09
SSDEEP 96:6B09RKzeJ+7zHu8zKOpLB09RKzeJqJzHu8zKO7:GIRBQ3mOHIRBEJmO7
TLSH
T1DDA1F2051BE60B26F1F7AF7245737641A677B986AB144BDD00CA43050872E84B9FCF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 eb05f96a356f62ccf0b51128b9eb624d0771d7a67d529a942536c17bc62ae54c
MD5 c1aeda79c58ddc76a8f25d03201b6709
SHA1 183277f5bb1e1817403092be0d1b5a43b5bd57b4
SHA512 0ebf78fbdfbe545b8bd2b115834a1cd0eade25f9f9458bf0a09f01b0f5a1cdfa171dcb92410d13712d46efac9e678f3dd3479428332fd4d2e0f5e93975ec7bd2
TLSH
T1B0318633B3DC8325C899403A10CDAC2036BAC7CB40DECF9B7B80E255A42F6A8DE50160
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1712-289-0x00007FF6EFEB0000-0x00007FF6F15AB000-memory.dmp

Download

memory/1712-359-0x00007FF6EFEB0000-0x00007FF6F15AB000-memory.dmp

Download

memory/1712-345-0x00007FF6EFEB0000-0x00007FF6F15AB000-memory.dmp

Download

memory/1712-347-0x00007FF6EFEB0000-0x00007FF6F15AB000-memory.dmp

Download

memory/1712-459-0x00007FF6EFEB0000-0x00007FF6F15AB000-memory.dmp

Download

memory/1712-357-0x00007FF6EFEB0000-0x00007FF6F15AB000-memory.dmp

Download

memory/1712-90-0x00007FF6EFEB0000-0x00007FF6F15AB000-memory.dmp

Download

memory/1712-395-0x00007FF6EFEB0000-0x00007FF6F15AB000-memory.dmp

Download

memory/1712-332-0x00007FF6EFEB0000-0x00007FF6F15AB000-memory.dmp

Download

memory/1712-494-0x00007FF6EFEB0000-0x00007FF6F15AB000-memory.dmp

Download

memory/3240-358-0x0000026480BE0000-0x0000026480DA3000-memory.dmp

Download

memory/3240-327-0x0000026480BE0000-0x0000026480DA3000-memory.dmp

Download

memory/3240-394-0x0000026480BE0000-0x0000026480DA3000-memory.dmp

Download

memory/3240-131-0x00007FFC67840000-0x00007FFC67841000-memory.dmp

Download

memory/3240-450-0x0000026480BE0000-0x0000026480DA3000-memory.dmp

Download

memory/4572-438-0x000001E261F90000-0x000001E262042000-memory.dmp

Download

memory/5004-17-0x0000000006140000-0x000000000625C000-memory.dmp

Download

memory/5004-53-0x0000000006570000-0x000000000668C000-memory.dmp

Download

memory/5048-507-0x00007FFC67A10000-0x00007FFC67A11000-memory.dmp

Download

memory/5048-508-0x00007FFC66A10000-0x00007FFC66A11000-memory.dmp

Download

memory/5184-302-0x000002A3D8300000-0x000002A3D84C2000-memory.dmp

Download

memory/5184-303-0x000002A3D8A00000-0x000002A3D8F28000-memory.dmp

Download

memory/5596-380-0x00007FF6EFEB0000-0x00007FF6F15AB000-memory.dmp

Download

memory/5604-255-0x000001F4C5D50000-0x000001F4C5D7A000-memory.dmp

Download

memory/5604-104-0x000001F4C5B40000-0x000001F4C5BF2000-memory.dmp

Download

memory/5604-103-0x000001F4C58C0000-0x000001F4C58DE000-memory.dmp

Download

memory/5604-100-0x000001F4C5830000-0x000001F4C5852000-memory.dmp

Download

memory/5604-105-0x000001F4C58E0000-0x000001F4C58EA000-memory.dmp

Download

memory/5604-106-0x000001F4C5910000-0x000001F4C592E000-memory.dmp

Download

memory/5604-256-0x000001F4C5D50000-0x000001F4C5D74000-memory.dmp

Download

memory/5604-287-0x000001F4C58D0000-0x000001F4C58E0000-memory.dmp

Download

memory/5604-288-0x000001F4C5910000-0x000001F4C592A000-memory.dmp

Download

memory/5984-219-0x00007FFC67840000-0x00007FFC67841000-memory.dmp

Download