721f066380b3f99c92e39b3286b9851c4d59119208f420b9998e7f70cbe70ec6

Analysis

max time kernel
151s
max time network
158s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 12:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Portmaster_2.2.1_x64-setup.exe
Size 96.8MB
Sample260827-p6ebfavelb
SHA256 721f066380b3f99c92e39b3286b9851c4d59119208f420b9998e7f70cbe70ec6
MD5 e02558ef20c81a5458ab6a1aab4ade42
SHA1 9718d566336141ce99f1034451c9ea882bfaf258
SHA512 e838adf9a3509a88d0003336e1cf86ad8f0aa52880a52250fdb22f785c6c3c5a81c1572096d0d353458b032ea862ff8e7981c29c73c5b8dc83d2e1eebdcc4946
SSDEEP 1572864:7id1zV/kXljlvgA6D8thDxMWUxkhK2yHUs5M4XxDaGUcNhSS+ChPj7m40bODU:7cPCl2AY83DSRkwQMMKUfoSSZ5/mPF
TLSH
T1312833AA9898D745C764C1364C82D57E42ADFDA01BC3D81B39E37C07F63A10A8466DFB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery execution persistence spyware trojan

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Portmaster = "\"C:\\Program Files\\Portmaster\\portmaster.exe\" --with-prompts --with-notifications --background"	Portmaster_2.2.1_x64-setup.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\Portmaster\portmaster-kext.sys	Portmaster_2.2.1_x64-setup.exe
File created	C:\Program Files\Portmaster\portmaster-core.dll	Portmaster_2.2.1_x64-setup.exe
File created	C:\Program Files\Portmaster\WebView2Loader.dll	Portmaster_2.2.1_x64-setup.exe
File created	C:\Program Files\Portmaster\portmaster.zip	Portmaster_2.2.1_x64-setup.exe
File created	C:\Program Files\Portmaster\assets.zip	Portmaster_2.2.1_x64-setup.exe
File created	C:\Program Files\Portmaster\portmaster.exe	Portmaster_2.2.1_x64-setup.exe
File created	C:\Program Files\Portmaster\uninstall.exe	Portmaster_2.2.1_x64-setup.exe
File created	C:\Program Files\Portmaster\portmaster-core.exe	Portmaster_2.2.1_x64-setup.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4388_1976227749\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4388_1976227749\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4388_1976227749\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4388_1976227749\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4388_1976227749\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4388_1976227749\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4388_1976227749\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4388_1976227749\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4388_1976227749\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4388_1976227749\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4388_1976227749\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4388_1976227749\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4388_1976227749\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4388_1976227749\manifest.fingerprint	msedgewebview2.exe

Executes dropped EXE 3 IoCs

pid	Process
6568	portmaster.exe
6112	portmaster-core.exe
4860	portmaster-kext.sys

Loads dropped DLL 13 IoCs

pid	Process
4440	Portmaster_2.2.1_x64-setup.exe
4440	Portmaster_2.2.1_x64-setup.exe
4440	Portmaster_2.2.1_x64-setup.exe
4440	Portmaster_2.2.1_x64-setup.exe
4440	Portmaster_2.2.1_x64-setup.exe
4440	Portmaster_2.2.1_x64-setup.exe
4440	Portmaster_2.2.1_x64-setup.exe
4440	Portmaster_2.2.1_x64-setup.exe
4440	Portmaster_2.2.1_x64-setup.exe
4440	Portmaster_2.2.1_x64-setup.exe
4440	Portmaster_2.2.1_x64-setup.exe
6568	portmaster.exe
6112	portmaster-core.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	portmaster.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2296	powershell.exe
3964	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c61900000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6314000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	portmaster-core.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c00000001000000040000000010000014000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e81900000001000000100000002fe1f70bb05d7c92335bc5e05b984da66b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	portmaster-core.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Portmaster_2.2.1_x64-setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	portmaster-core.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4440	Portmaster_2.2.1_x64-setup.exe
4440	Portmaster_2.2.1_x64-setup.exe
6112	portmaster-core.exe
6112	portmaster-core.exe
6112	portmaster-core.exe
6112	portmaster-core.exe
6112	portmaster-core.exe
6112	portmaster-core.exe
2296	powershell.exe
2296	powershell.exe
2296	powershell.exe
6112	portmaster-core.exe
6112	portmaster-core.exe
6112	portmaster-core.exe
6112	portmaster-core.exe
6112	portmaster-core.exe
6112	portmaster-core.exe
6112	portmaster-core.exe
6112	portmaster-core.exe
6112	portmaster-core.exe
6112	portmaster-core.exe
6112	portmaster-core.exe
6112	portmaster-core.exe
6112	portmaster-core.exe
6112	portmaster-core.exe
6112	portmaster-core.exe
6112	portmaster-core.exe
6112	portmaster-core.exe
6112	portmaster-core.exe
6112	portmaster-core.exe
6112	portmaster-core.exe
3964	powershell.exe
3964	powershell.exe
3964	powershell.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4388	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6112	portmaster-core.exe
Token: SeDebugPrivilege	2296	powershell.exe
Token: SeIncreaseQuotaPrivilege	2296	powershell.exe
Token: SeSecurityPrivilege	2296	powershell.exe
Token: SeTakeOwnershipPrivilege	2296	powershell.exe
Token: SeLoadDriverPrivilege	2296	powershell.exe
Token: SeSystemProfilePrivilege	2296	powershell.exe
Token: SeSystemtimePrivilege	2296	powershell.exe
Token: SeProfSingleProcessPrivilege	2296	powershell.exe
Token: SeIncBasePriorityPrivilege	2296	powershell.exe
Token: SeCreatePagefilePrivilege	2296	powershell.exe
Token: SeBackupPrivilege	2296	powershell.exe
Token: SeRestorePrivilege	2296	powershell.exe
Token: SeShutdownPrivilege	2296	powershell.exe
Token: SeDebugPrivilege	2296	powershell.exe
Token: SeSystemEnvironmentPrivilege	2296	powershell.exe
Token: SeRemoteShutdownPrivilege	2296	powershell.exe
Token: SeUndockPrivilege	2296	powershell.exe
Token: SeManageVolumePrivilege	2296	powershell.exe
Token: 33	2296	powershell.exe
Token: 34	2296	powershell.exe
Token: 35	2296	powershell.exe
Token: 36	2296	powershell.exe
Token: SeIncreaseQuotaPrivilege	2296	powershell.exe
Token: SeSecurityPrivilege	2296	powershell.exe
Token: SeTakeOwnershipPrivilege	2296	powershell.exe
Token: SeLoadDriverPrivilege	2296	powershell.exe
Token: SeSystemProfilePrivilege	2296	powershell.exe
Token: SeSystemtimePrivilege	2296	powershell.exe
Token: SeProfSingleProcessPrivilege	2296	powershell.exe
Token: SeIncBasePriorityPrivilege	2296	powershell.exe
Token: SeCreatePagefilePrivilege	2296	powershell.exe
Token: SeBackupPrivilege	2296	powershell.exe
Token: SeRestorePrivilege	2296	powershell.exe
Token: SeShutdownPrivilege	2296	powershell.exe
Token: SeDebugPrivilege	2296	powershell.exe
Token: SeSystemEnvironmentPrivilege	2296	powershell.exe
Token: SeRemoteShutdownPrivilege	2296	powershell.exe
Token: SeUndockPrivilege	2296	powershell.exe
Token: SeManageVolumePrivilege	2296	powershell.exe
Token: 33	2296	powershell.exe
Token: 34	2296	powershell.exe
Token: 35	2296	powershell.exe
Token: 36	2296	powershell.exe
Token: SeIncreaseQuotaPrivilege	2296	powershell.exe
Token: SeSecurityPrivilege	2296	powershell.exe
Token: SeTakeOwnershipPrivilege	2296	powershell.exe
Token: SeLoadDriverPrivilege	2296	powershell.exe
Token: SeSystemProfilePrivilege	2296	powershell.exe
Token: SeSystemtimePrivilege	2296	powershell.exe
Token: SeProfSingleProcessPrivilege	2296	powershell.exe
Token: SeIncBasePriorityPrivilege	2296	powershell.exe
Token: SeCreatePagefilePrivilege	2296	powershell.exe
Token: SeBackupPrivilege	2296	powershell.exe
Token: SeRestorePrivilege	2296	powershell.exe
Token: SeShutdownPrivilege	2296	powershell.exe
Token: SeDebugPrivilege	2296	powershell.exe
Token: SeSystemEnvironmentPrivilege	2296	powershell.exe
Token: SeRemoteShutdownPrivilege	2296	powershell.exe
Token: SeUndockPrivilege	2296	powershell.exe
Token: SeManageVolumePrivilege	2296	powershell.exe
Token: 33	2296	powershell.exe
Token: 34	2296	powershell.exe
Token: 35	2296	powershell.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
6568	portmaster.exe
6568	portmaster.exe
6568	portmaster.exe
6568	portmaster.exe
6568	portmaster.exe
6568	portmaster.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
6568	portmaster.exe
6568	portmaster.exe
6568	portmaster.exe
6568	portmaster.exe
6568	portmaster.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 6112 wrote to memory of 2296	6112	portmaster-core.exe	95
PID 6568 wrote to memory of 4388	6568	portmaster.exe	97
PID 4388 wrote to memory of 6252	4388	msedgewebview2.exe	98
PID 4388 wrote to memory of 6736	4388	msedgewebview2.exe	99
PID 4388 wrote to memory of 6736	4388	msedgewebview2.exe	99
PID 4388 wrote to memory of 6736	4388	msedgewebview2.exe	99
PID 4388 wrote to memory of 6736	4388	msedgewebview2.exe	99
PID 4388 wrote to memory of 6804	4388	msedgewebview2.exe	100
PID 4388 wrote to memory of 5504	4388	msedgewebview2.exe	101
PID 4388 wrote to memory of 5504	4388	msedgewebview2.exe	101
PID 4388 wrote to memory of 5504	4388	msedgewebview2.exe	101
PID 4388 wrote to memory of 2088	4388	msedgewebview2.exe	102
PID 4388 wrote to memory of 2088	4388	msedgewebview2.exe	102
PID 4388 wrote to memory of 2088	4388	msedgewebview2.exe	102
PID 4388 wrote to memory of 2088	4388	msedgewebview2.exe	102
PID 4388 wrote to memory of 2088	4388	msedgewebview2.exe	102
PID 6112 wrote to memory of 3964	6112	portmaster-core.exe	106
PID 4388 wrote to memory of 6860	4388	msedgewebview2.exe	110
PID 4388 wrote to memory of 6860	4388	msedgewebview2.exe	110
PID 4388 wrote to memory of 6860	4388	msedgewebview2.exe	110

C:\Users\Admin\AppData\Local\Temp\Portmaster_2.2.1_x64-setup.exe
"C:\Users\Admin\AppData\Local\Temp\Portmaster_2.2.1_x64-setup.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4440

C:\Program Files\Portmaster\portmaster.exe
"C:\Program Files\Portmaster\portmaster.exe" --with-prompts --with-notifications --background
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6568
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=portmaster.exe --webview-exe-version=2.2.1 --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz,RemoveRedirectionBitmap --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=6568.2900.4961142047923917094 /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView /prefetch:4 /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x198,0x7ff97a9f5fd8,0x7ff97a9f5fe4,0x7ff97a9f5ff0
    3⤵
    PID:6252
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1784 --field-trial-handle=1788,i,5121169265251707815,2606020739132694623,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c
    3⤵
    PID:6736
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2144 --field-trial-handle=1788,i,5121169265251707815,2606020739132694623,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c
    3⤵
    PID:6804
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2324 --field-trial-handle=1788,i,5121169265251707815,2606020739132694623,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c
    3⤵
    PID:5504
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3476 --field-trial-handle=1788,i,5121169265251707815,2606020739132694623,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c /prefetch:1
    3⤵
    PID:2088
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView" --webview-exe-name=portmaster.exe --webview-exe-version=2.2.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4468 --field-trial-handle=1788,i,5121169265251707815,2606020739132694623,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:f619f37de66b6ecc646d48c13322bc256f470d7c
    3⤵
    PID:6860

C:\Program Files\Portmaster\portmaster-core.exe
"C:\Program Files\Portmaster\portmaster-core.exe" --log-dir=C:\ProgramData\Portmaster\logs
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive "[System.Console]::OutputEncoding = [System.Text.Encoding]::UTF8 Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Select-Object -First 1 | Get-NetIPConfiguration | Format-List"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive "[System.Console]::OutputEncoding = [System.Text.Encoding]::UTF8 Get-DnsClient -InterfaceIndex 3 | ConvertTo-Json -Depth 1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3964

C:\Program Files\Portmaster\portmaster-kext.sys
"C:\Program Files\Portmaster\portmaster-kext.sys"
1⤵
- Executes dropped EXE
PID:4860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WebView2Loader.dll

Path C:\Program Files\Portmaster\WebView2Loader.dll
Size 162KB
SHA256 609c974a8cdd6a76a745b3d81b62f321d79f2dc8f4929e1eea8469d9d78baf79
MD5 6842f2ebf863ab8ee1be470794d1f703
SHA1 26242ced6ddf005e0ea1073409a058121636fc9b
SHA512 339be4521b27e29e457e6d662a7ac98320729ad75df976ccdc9c83596c8b1bc7888ad465e7d38276fb5c0cfb597e7e6e9ba377c6f42db850c317f89e218ba5b9
SSDEEP 3072:DrQJpSFTlTRTzWGbThTNTFSkD0bHYVNqGM2h9P58LZZ5Aalq/Ty+EtJfy2aQQtq:nMMTlTRTzWiThTNTFSzjiBM2h9P5oZaQ
TLSH
T18DF35B5772E4407BE16A8274C5A34A11E77778510B60ABEF03A4477A1F23BD4EE3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

assets.zip

Path C:\Program Files\Portmaster\assets.zip
Size 2.5MB
SHA256 fb61a09b7223ad9dfcfafab71a25afca42fb5bb36250e5518effc7bc1fd31550
MD5 e20f29e0eaf8a5a831965d97a9f8167a
SHA1 9c76e79199b64de386783f5c5e8af3013f8d4fb4
SHA512 4ec787e4e8d17f548966a4bf8cb7d271a550b5d52a9bfcce243a7bfd27751c1543dc293e8bac61d0c7c94435fb134c2b284f42a541ce76b357fac12815392ab7
SSDEEP 49152:/fTenm2X8kKQr9mwR4mSKHFK9nsmuN48JTKqXbRS7Eg7OBqCuGOM7OAFXE:Im2uQr9nSKlKVsmo9h9S7Eg7OJuGOuFU
TLSH
T185C523F2F3175CB4E7DA8136B198F402FDB884A08787A1151953E066FBB0DD98B26E71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

portmaster-core.dll

Path C:\Program Files\Portmaster\portmaster-core.dll
Size 23KB
SHA256 a0f7d615bdd58230e20fe66df6804fffc20a38bdae8b540780236f6b15dac580
MD5 0f94aa3c904db33e99fc076223491719
SHA1 5d24da70bd68610db4ba000aa22176aaa86a9872
SHA512 8d8fdba2f1237072269ed1c2365ec2e5733010618a893b62a958ce38b31affc2aeb207be8afbc3fc189b5204a45ad518b6cdd98788235567b7651603b8a85124
SSDEEP 384:+FBUmttyqVLSXCOrZrz61GaprQ2ADrrsMy8RbmL4nNyMuhqM:+FIqVLSRVMGy82ADrr5ALVhqM
TLSH
T1C6B29E83999448D1DC16ADB4E8F65E26F9FAB5102BD292CF037081A50FA33C13B7E49D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

portmaster-core.exe

Path C:\Program Files\Portmaster\portmaster-core.exe
Size 41.7MB
SHA256 0b5aa3d7a4ab8b03126a3dc8346c39872164782d8b067f804a142290e3e6237c
MD5 bfda9c227eee51367528ce88996fee7e
SHA1 00c3b4fe397b652de7798c6acdd21afe71c91e57
SHA512 739ace6abb57ba4ae0283cecdf5e958c17cfb0f86c17b2512fe7ba90f2911b96f1024dd3515b9486d37bf0dbc5044dfc45e857b647b86adabb252a2925a5b0bd
SSDEEP 393216:0Mr6+/FGrPzPKyMAfZFCatIhXRGdH0X02D9jj1c73+ZBI:0Mr6+NclZRIFRpkU9jpc73Cq
TLSH
T1CDA78E87E92141E5C9A9D635C5A292177B713C489B3163DB3BA1F2243F73BD0A7BA340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

portmaster-kext.sys

Path C:\Program Files\Portmaster\portmaster-kext.sys
Size 283KB
SHA256 e07d172667bddc606c6a76079ed3e79281fa23ebbe68a9740ee71ea681b55d4d
MD5 3a21e73e36382cce7d092205f0b8f3c8
SHA1 343f090bd2ac1230ff04bcc8f2cdc8fc469445e7
SHA512 f0861bbc31e499eb30a9bb5cd45dd9e28a5d7168c020ba092ee81054b31e075df3586eb8838e66574712880a3ec642ec9fe9402cd1fb2ad238792a3570fcade7
SSDEEP 3072:0eZxH/Aep2Cx9YkUCTGUTRghRj6jyCGfvjrFw3h3j5Da2W+XBbdXxxKD:0eDfAepnx9KgTg2jDGfvjCDDXBBaD
TLSH
T1DD544105A908E1ECC485C1FCF1BA5AA2B5B7377D3B2573F68170B21036985B85A3C9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

portmaster.exe

Path C:\Program Files\Portmaster\portmaster.exe
Size 32.9MB
SHA256 e27cddea106b682dea030fc07211c1fcdb68b38a97510efd109b89d585463dae
MD5 5231980e77e35ed261a0b61c66afc4a3
SHA1 8bd210584c0aafbfbf6788b8e8a1eeb6eb4d065f
SHA512 b7ee5bc27403064e53b2a92ed39ffa63961b25e0f13fe7252318c8bea66e25d0e8a46e8cbef65c18358c753a87425fcd2cf9bde51c6ef7c92de0e6057d3b2f0a
SSDEEP 196608:H/Hh1+tfNzmI177SRbRAB3p5ByOOpo9ELk5wCqcHgG3o:fcjMVo9l5tqp
TLSH
T140777E03F5641A7CD9AFD67486AEA336FB747C894131FBAB06A0BA312E32751971C704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

portmaster.zip

Path C:\Program Files\Portmaster\portmaster.zip
Size 1.9MB
SHA256 563a732e411f9e22b60fa8142fdc1657414bfef1838923051d3f7b2250643cd8
MD5 8c351f9c0759036bc2e0526c8812492c
SHA1 cc81f779cb8b03cba72c16081350e996a8543805
SHA512 8da9254ba3251d6dadc271d7eb4969e0ee836a36461a13f0f84491e1ec2472fa93cd2a756042ae80a5e1036d2e510bc0cf3751adae9534e64f16bee76bf6db1a
SSDEEP 24576:OUsax4iASwACVGJw8n+p+yzOoPK+FYglOtY7UgFZADGET/CIIH21QthnV2RO9Fx6:FsXfx5GJwum+m8DgI27UgLETXMcinVz6
TLSH
T1EA95D1F4C71A5A70CB2FFCB59907978A9E898386574E3D5F5E40E2007E7B1C1ABB0A05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.exe

Path C:\Program Files\Portmaster\uninstall.exe
Size 770KB
SHA256 7398046b21cf0cf9cee0fc3088dd9ae9e4b2f5173e84af0e9d741e6bf34277f2
MD5 7e8cc2e733f318b513e46fc118a570cb
SHA1 a9a4255f7383b34a5484b625da6d2a2dafb36c1c
SHA512 f107847ab0edae0595367142169480f1c90fae67cae45441a05ce1a783d33f7bc946ffb8684dd65b51b161afe3b7f534b480abe0de964cd48302368c6e774e58
SSDEEP 12288:mY3QZb1kSY/XQ3PqKvDQN9AUavQhSMnM6dh:mY3QgSW0qKvDQN9Y7Mnt
TLSH
T13DF4126667588463CA210BB04877E7FB2AB37D462470971B63D5BF6F3A333838A09517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.dsdl

Path C:\ProgramData\Portmaster\intel\base.dsdl
Size 14.7MB
SHA256 6c770483743f20c49ec7c57bdaae78b0cc30c9496c8a10a4f8675c5baeaa4498
MD5 65d460591a2875752cee844c29c897fc
SHA1 ce1bfe9dc428cc6300e0db4d79a441b33f8f9a27
SHA512 4a3c19ee9c1b9b76651e25346da861e7ad384481647588a3ff3c91f704a582969277e86efe92c2ae5f0f08ff120e61a1f6dabfe6a8e3fab0a07ef8ee3d684b15
SSDEEP 196608:7Z7aaVRpx8AS4wz23CLsBBbxvcJai95qfRWk+3/umMqaI0ju8YlvrrnExcgJnRXn:7ZGaV6cRhifqfokGMRu8YlXECgvXZN
TLSH
T1D0F633A313631A50684216BC3B7D37B3D82E86485FFA75D2884F4D26D68B08BD706FE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.dsd

Path C:\ProgramData\Portmaster\intel\index.dsd
Size 4KB
SHA256 026325cc7af459251fb08dce0a6166aeece4c9b5a4b7d26e15f4f7d94e0e6e0e
MD5 b5faa7d7a5aeddbaa0745cd62b18a4b1
SHA1 3d94a5f99e7fdd3e8159bc03e42567b06cc70d2f
SHA512 0e01cac618d62440d8cd3236b94bc108984ae023a1e8fab5d8e99d19f38e6964b6eb3c359faca13d6d9defd59f4fd5e3c93f84914dc7b2d2c29b2a15d70a05a0
SSDEEP 96:JAAlALAc6zrU0x42TFqXB8uFu9pDAIkCBjW8ts1qGkFXhi:HUIrpxFTFCTiDE1qGms
TLSH
T18B915D3CB1CCEA4BD27F6858E27EDF02975B3930FC55142741ED76929AE68129360C24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.json

Path C:\ProgramData\Portmaster\intel\index.json
Size 2KB
SHA256 4d9e21ccd810b34903f86ae1f3daf07619c34f5665fea46be17ad3e077979499
MD5 12d9b34bb53eb6b385cf8c9543496dcc
SHA1 1ebea8c35987950db07bb245dc722739bee1a413
SHA512 fba65ca23323742eb33a8d5da54974824adfa058ea3911bbb8ab6cf470970d43bcb2a6b86bc88aa4f29c0544778540308fee56fe37751554df2ad114c5f12cc0
TLSH
T17C51BC86C2756D6321CC33B185AD3095D62248DB6CEAAC09334D644C0FAD0BF2B3F28D
MD5 SHA1 SHA512 TLSH

Submit Download

intermediate.dsdl

Path C:\ProgramData\Portmaster\intel\intermediate.dsdl
Size 17.2MB
SHA256 8be0df9689d4f1ee809fc633179485d5673e1126fe1fb9e0bfe296f2fb9f672c
MD5 8c68219d0283fe3f340c21188063343c
SHA1 c5101ab1f6ccc3d26d10e2352feddcbdbe4baa65
SHA512 623bc95c5388b205b61ee014e97ec2b73d73c97179cf13932d93a49e249461253abaca2000fb94ce7e79668a5bbe5fb6772a85b18cbbadacb6087228e083079f
SSDEEP 393216:IodqbI4Ey8LkbUqoOk1LJayaO1HGdsYIj3Z7Zxw:IsqbI4EpLkQFOvkMds5zO
TLSH
T1DC073313EE772602874299CF678C72D576394854E289355330DAF1ABBBB0F3E6890673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main-intel.yaml

Path C:\ProgramData\Portmaster\intel\main-intel.yaml
Size 14KB
SHA256 c73be8f0600af4500f5d3e6f8e354f5d96dba2ce37d59aa976306a8ea9e5bc6d
MD5 f6a3e1979bf4189a242208c20119c4fd
SHA1 f15becdb33ae10c8898930eba7720e2e4bda5ac6
SHA512 881ef1b5c23c2874592bd3c3e0c7ee3dd5cdaae8b9625c353ae3b7071ebafdbdb743bc93c49eeab3fa30ff4541248842004803fadf98be5175a7f4b8611a8d3c
SSDEEP 192:HixmSUHIiRigYk4R9bG9/KmAcc83qSob4JE/RM5o9qLXVteDlP:+K31Yk4e9nUVJkJEZMK9j
TLSH
T139625456C72D1878F068D261E77BB6F1B32A8E039161141477AF93B91F4B34772E80CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

news.yaml

Path C:\ProgramData\Portmaster\intel\news.yaml
Size 972B
SHA256 fa64e8d0f2adc61093df516d4be68ad536c4de29fd9f7c2473311dbdaaa1f9c6
MD5 f88861e9dba633b7ed2b8db750e9b586
SHA1 fd6355f3d0c0ae83713d42d4c6650fe7b276ffea
SHA512 e5b671bfece741ed5baa57514c366d7a9623b1e914e8fd10af19fd0f7454959357a91b284fac4a91a581e6d9013bbb6854ad5eb1b05bc84b261f60d8cb456fc4
TLSH
T17211E1671A146B0E4A5557DEA2DF215DD305E6EEAAE0E0B878CF8101130E86454BE05D
MD5 SHA1 SHA512 TLSH

Submit Download

notifications.yaml

Path C:\ProgramData\Portmaster\intel\notifications.yaml
Size 6KB
SHA256 8168f64860717712a9d0a00da876e84f03c34834b3a8e0e1dfa783a9c29f7235
MD5 9f328dac539016f79a513f5b71517c29
SHA1 b6b5d1a04eb8b6d0d88819e818d448b159a03381
SHA512 0b3697a9b34ec142a9427e66c3f2e9f07aba92381c5bafc1111cc055f6e330f1a96ce08d13f4f9c5b8ca3dd3f3d7b1a37b9cb535ceec56e972a988d2f610b7d5
SSDEEP 96:cUwvh6VR0ymBfRpXVNrnr/dqOZhXM4xKDqrFnn0ZEtn3FNT6RA+niFjRAEniFWct:cUI6H0ymbJrRqwrKDKAovK2vct
TLSH
T1C5D185D7B348A67ECD8A109BA4C251A18625F9EF937098BC70DD511C2F0B77081AFBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urgent.dsdl

Path C:\ProgramData\Portmaster\intel\urgent.dsdl
Size 2.7MB
SHA256 10d70c5ae83c6554a169f97380314ae0bc5c1bd51110a4cefa5ccd548a714c4b
MD5 451b0fd359fabb80ba3a2b0d483e755b
SHA1 968b5159f2110ec885e3de8aa11467923d00750f
SHA512 51b2c9deb7c61380b08d17d1307f902d64f078f98d563c7bb53f43032b26eff08ddad2e149978529f18d858bb8f1bbb0290a9943e38d61b56b90eae9db39d20a
SSDEEP 49152:9OjRIwzVlQC4cBchk8IYfY42oBemlunvdbElgLUSJtQ+ilf61SsYUwveja9Nlh:oiklaGlYfzQz2lggL+ilESleja/
TLSH
T1D5D53310BC590240AF0233B18B835E769E3594B98FA0938A565FC9CDFED0CDB679B54B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 543a88049c1be08c53ea87fe8291d258912195189b4f96dd122eb3f5df28ba1d
MD5 2d4790e54e53b78a6988df271b5db307
SHA1 98f405aedea659d479287e7942ada841559aff38
SHA512 d12cca9aa6f12917a1c2bd74def88532ce9c0af8732e64bec10af9aced6bdd695f444558e51d25b59fbed9b49de1c6f096236b274fc75da075d0cf549b47d7f1
SSDEEP 1536:5KLC5pYo2hOYMlfKQSGflJnJZYFh4iUxMR40i71YigM9v2vOdBGV3CNBQkj2oa5a:5KLC5pYo2hOYMlfKQSGflJnrYFqiUMRI
TLSH
T1FA636292E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0f8f3330f737f80bee8a3e7d8599aa5e9206b87c2d48a09bb05da2362d88f18d
MD5 275439d65d8a8552a54004cecb8236ce
SHA1 ce5946207eca49e1a0692e0ec2043ab38543bdb9
SHA512 a5b49f72a1d06708af251ce35e67bc971f35974c34188d72e50381382097636d20891bc764b78e032f66a23612b0a7fc3d13e233491ef121c9b55b7f54c42dac
TLSH
T173317427B3DC8251C899413A10CDAC5436BBC7DB80DECF9B6B80D269A42F699CF61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_pbl1eqfx.hcp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pbl1eqfx.hcp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

SimpleSC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqA90A.tmp\SimpleSC.dll
Size 1.1MB
SHA256 1620cdf739f459d1d83411f93648f29dcf947a910cc761e85ac79a69639d127d
MD5 7b89329c6d8693fb2f6a4330100490a0
SHA1 851b605cdc1c390c4244db56659b6b9aa8abd22c
SHA512 ac07972987ee610a677ea049a8ec521a720f7352d8b93411a95fd4b35ec29bfd1d6ccf55b48f32cc84c3dceef05855f723a88708eb4cf23caec77e7f6596786a
SSDEEP 12288:fRdJsAp4dXFcLBz75cwoCmJKHwe6VuoH9v0D/LF5mM6:fBsmyVS151oCmJKE1dv0DX
TLSH
T12F354B2BF645693EC5AF063E4673E714993BBB726912CC1F56F0084CCE2A5406B3EA47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqA90A.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsqA90A.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqA90A.tmp\nsDialogs.dll
Size 9KB
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqA90A.tmp\nsis_tauri_utils.dll
Size 30KB
SHA256 7317e5508923f425bced2698bb89f79b00fcddcd1028f44b598732b2e3711464
MD5 fc4691e51cdfac476b2fc63bbe951e82
SHA1 6532da4545864c6ec95f62f27f2199bfd668560b
SHA512 5b544832f1b1b8f2e1c6f8d61a839bea22c2c3d7e2a03671a12bab936e46a6f3fa3dd8aa53ec91157c1de08f0b349d6d2c1aec29385ad38cc0b2ab4c033c58ed
SSDEEP 768:IMSeZbzz284uMJSmuGrAFKpnp0jdhK7R+qV0Z:IjKfAuXiMtXIV
TLSH
T16FD23918FCC56FB6E2DF1575240C596E429FC8180B14CE9BD7A25E22E9E63722EE500F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 48a65b0650e18181dd7bd3179e6090aa054d5441789adcac9cba902ee7c31ede
MD5 d3390420dd2389b517c74d0eb0c8b77d
SHA1 d9161e507a4ed9668b6d917c462d1ab3ab1026e9
SHA512 62a19da6d5f7afa766d89f2e83cd3cdde8c9d2d67b66a950c26c5da5f9f9b07f8995f68ed01d24f93077de9b3c8baef84b2b93dfa231a66b75d21162bd236fa8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f78c2b30c45777c9e1aa019c8f0ddb8e63f1592cc0cb482369792033124f56c0
MD5 2535b67af90a15ad702d54320b1ed255
SHA1 c06a8b4ad921ae4048251b61edfc1515e9fd3a4a
SHA512 81064c9808990e0807065853a98563c990f23b092d25abff413f16b1564eda3a48a07b7c7e0b3a9fbacc623ca75b7524d5689aab83d9ccf377df3fbfca1ff3b4
TLSH
T155D0241F377105FCC11030370003730C0441C11F41054040547DF75D1F140501D03443
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 b4b77667a8b02d74c21b00f0382cce055d044d894cbbbee21f325ec7f3ada5b9
MD5 705d3c8ab690647f8e9b699c75839e3f
SHA1 3d7607abb123e16b97d9ac151a6f64e0c11ec260
SHA512 4aa311ce7c9675cf1657fc3fe18333dbfee78451f6dbfe52863bc669b2e9ff962f6f0fe37c792b36a7a0ebbcb9cfff7410725458d0cceea31a55e29cab1d957e
TLSH
T186C08CB1C0ADD002F3730DF474D332C1F23D382A055B8E43933260307230B320020140
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 feb9067ba030993e9df97b7d21cd53f501b3b8582d1607e2f58c422c452276fb
MD5 f2805567b5f904cbb2225acdebac5491
SHA1 87226919707a0779e5f6fabf0b956399f5d6c7e0
SHA512 dcc804d3f6c7adc303499e271a8f390debb2b50eb7b586719c209c6f57b0176b9d0c09f7c0447145bf250784aff5e86f43d32055d6727b4f9f2172abffdd8d86
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5b6e76.TMP

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Network\Network Persistent State~RFe5b6e76.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Preferences
Size 6KB
SHA256 c314f8f5de753aec7f02e30309d01ca4452528eb11b78afd95f5febbb2d43cfd
MD5 a5618ea75280eebb4b7ed368c1d72b54
SHA1 e3998ef1b40815044abe75dbf1e1b00d8c347add
SHA512 d0d9ed34a8640e157f4c250a198465b64bf3cd01cab7ea17113398f2ea29543776a8bc1d0b54cdbd3ce882d3310165aa000c6f3d6b69ed4a5b7576f704acc49c
SSDEEP 96:str/dGXJ0b9Sk+Ko5h16Zd9s7/x+6Mhmuec4Rm1ejeFK+gctM+D28XM1C7K:stzwJeoK9sV+FcRmQj3uM+DG6K
TLSH
T11CD197016E2479BB4CCBE119FB25BA03E2F9607171D52E58EBF8451C08EB6DD621B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5a952d.TMP

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Preferences~RFe5a952d.TMP
Size 6KB
SHA256 954372f09a25c6eea10b0fbcb2adb8612e47480fb6c45ef295701c50361539b8
MD5 0494a8bc64d8b6b1e5535795bb3abb08
SHA1 010d94aac93d789479d08e9e352cdef84c1eb48c
SHA512 fe4faf7ee39d00db219dd0ce7614fe9b975a998bc3743bf19e60be301691170009210860d48bca4848be7ec735c7df550ad1756d82d581bf5e557dba0a361773
SSDEEP 96:rr/dGXJ0b9Sk+kdo5h16Zd9s7/x+6Mhmuec4Rm1ejeFK+gctM+D28XM1C7K:rzwJmoK9sV+FcRmQj3uM+DG6K
TLSH
T1EBD197016E2479BB4CCBE118FA35BA03D2F9A07171D52E58EBF8452C04EB6DD631B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Local State
Size 3KB
SHA256 7993917621b04e38a3c6630deb01d17b26ba6426d6773ad22acb4c675de17390
MD5 027b82bdc4b903eda7ea1aa5f3bbe654
SHA1 d6d75dedad264f4a608e37fbf0880a841fc2e179
SHA512 49b9ea0f006442d4d6a613f10a29228b8ea7098e6ed93ee19099d68a0ed4b2622e759bc933c0fd43b666d03944a71ba2536318300eb77d140b0dc51d25a1fe01
TLSH
T1DD81C5327934AA774DF3DA09B9463B03A7A45017E5917FA9D6EC0F1D02D728D1346C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Local State
Size 2KB
SHA256 710dd4fb6ac332f5b4b54fb6fd28a6e5507a711030b75a62b2df18c5cd7efba7
MD5 283d6e5e9d093d48e342c157266db07e
SHA1 cad492a0c60816746bd05f18db1412c22ff4f5cd
SHA512 bd209f39704b69a1ef896e158023f0187550a74d9a29f6e40d036ef29591e387b09736c53f35138260e5a1c7912c864bdea51b75bb089b9c0992ddb44c41b7e9
TLSH
T16E51B4333814AB7788F38A09BA4A3F239B345096AA623F60D6DC0B2C01D754C534AC3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Local State
Size 15KB
SHA256 821f42863ff91916cc93e2a4375ca7101977c0bd320c4fde7563b76b83d27c36
MD5 053566ea20db37f9498bca49585476b4
SHA1 9d459375c9adac85f1befcc32881f206e7097e84
SHA512 70ee2810b4085ce151d7f0a903d7828f1a955dbb0b61117a91c022c920e43e11bae4e08df06cc534aaaf67763a9b4dd4907a9341580b1a8641490d2282d8cd9a
SSDEEP 384:i+aQikB+z/xvxjg/qhEbNBSwqNWV4KpuuEX:N/UxvxjgC+skVG
TLSH
T176729E2B69797E3795F7E605B949174BCAB894A390C27EB58AFC5F0D06C73880346C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Local State
Size 3KB
SHA256 06021f55fdc948a2c2a992c9345cb401cd4bdbb2f93c8facf829b34a3b4d22d7
MD5 32428048a720dcb252ec9a5a27878dfa
SHA1 c803ca97c5dce4b56d1a94cc54d529787a114596
SHA512 e6680d2c2fafbddb76182628445d1d52566dd417d34ab4899201453823c6ebbc700785b24b9889152f97178157ad15d4b2e65f5364f3d13fc4be953cbcb074db
TLSH
T1E861A4337934AA7B4DF3DA05B9863B16A7A45027E5923FA5D6EC0F1D01D728C1342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5a4382.TMP

Path C:\Users\Admin\AppData\Local\io.safing.portmaster\EBWebView\Local State~RFe5a4382.TMP
Size 1KB
SHA256 9ca17f82142bb656a9ff51e3b51f1ba295eee29f5dd8ad3a5f5f9cd6ad43b18b
MD5 1e46a6a81db0be3293f6e97a4568edf9
SHA1 d7f3677044edf8d41a88a9eb979b2a3ed6f2d610
SHA512 84344bafde3b0c063bca4b94656c5ab1bfcfb773c50a7bd9b57c177e03d2bdcdfdffa299163113943a2aec845ce2bfad7404172947aca9c2f770f1ec7a4ce03f
TLSH
T173216573A5245F72ACA7674772427A576F30105B82219F14A2DD8F3E02D604DEA6EC37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2088-210-0x00007FF9A4490000-0x00007FF9A4491000-memory.dmp

Download

memory/2296-104-0x0000020B5BC50000-0x0000020B5BC6E000-memory.dmp

Download

memory/2296-304-0x0000020B5BC50000-0x0000020B5BC6A000-memory.dmp

Download

memory/2296-98-0x0000020B5BA70000-0x0000020B5BA92000-memory.dmp

Download

memory/2296-101-0x0000020B5BC10000-0x0000020B5BC2E000-memory.dmp

Download

memory/2296-102-0x0000020B740D0000-0x0000020B74182000-memory.dmp

Download

memory/2296-105-0x0000020B5BC40000-0x0000020B5BC6A000-memory.dmp

Download

memory/2296-303-0x0000020B5BC20000-0x0000020B5BC30000-memory.dmp

Download

memory/2296-103-0x0000020B5BC00000-0x0000020B5BC0A000-memory.dmp

Download

memory/2296-106-0x0000020B5BC40000-0x0000020B5BC64000-memory.dmp

Download

memory/3964-326-0x000001BBE2FD0000-0x000001BBE3192000-memory.dmp

Download

memory/3964-329-0x000001BBE36D0000-0x000001BBE3BF8000-memory.dmp

Download

memory/4440-53-0x00000000066B0000-0x00000000067CC000-memory.dmp

Download

memory/4440-17-0x0000000006270000-0x000000000638C000-memory.dmp

Download

memory/6568-389-0x00007FF6BC060000-0x00007FF6BD75B000-memory.dmp

Download

memory/6568-466-0x00007FF6BC060000-0x00007FF6BD75B000-memory.dmp

Download

memory/6568-378-0x00007FF6BC060000-0x00007FF6BD75B000-memory.dmp

Download

memory/6568-379-0x00007FF6BC060000-0x00007FF6BD75B000-memory.dmp

Download

memory/6568-388-0x00007FF6BC060000-0x00007FF6BD75B000-memory.dmp

Download

memory/6568-352-0x00007FF6BC060000-0x00007FF6BD75B000-memory.dmp

Download

memory/6568-390-0x00007FF6BC060000-0x00007FF6BD75B000-memory.dmp

Download

memory/6568-305-0x00007FF6BC060000-0x00007FF6BD75B000-memory.dmp

Download

memory/6568-112-0x00007FF6BC060000-0x00007FF6BD75B000-memory.dmp

Download

memory/6568-415-0x00007FF6BC060000-0x00007FF6BD75B000-memory.dmp

Download

memory/6568-476-0x00007FF6BC060000-0x00007FF6BD75B000-memory.dmp

Download

memory/6568-475-0x00007FF6BC060000-0x00007FF6BD75B000-memory.dmp

Download

memory/6736-127-0x00007FF9A4490000-0x00007FF9A4491000-memory.dmp

Download

memory/6860-418-0x00007FF9A4980000-0x00007FF9A4981000-memory.dmp

Download

memory/6860-417-0x00007FF9A33C0000-0x00007FF9A33C1000-memory.dmp

Download