File name:

f43a3e6eef805925d8c3d5bdbe6aa1848bb5b4d8fca55c1e7e291e20c6a10c92portmaster-installer.exe

Full analysis: https://app.any.run/tasks/b211dbb0-799c-44e1-893e-347e748671d5
Verdict: Malicious activity
Analysis date: June 21, 2025, 07:42:34
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-startup
golang
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

6A1673929B17A59E4B26C1BD00B92E6D

SHA1:

93E6D222C35FC77A0F013DB152BBBD71F8065D2D

SHA256:

F43A3E6EEF805925D8C3D5BDBE6AA1848BB5B4D8FCA55C1E7E291E20C6A10C92

SSDEEP:

196608:08I09Mb8d/Mi3W3J6sIsgeEwOQo8pgjLs:5Iy/MmW38ZsgeEwNWjLs

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • f43a3e6eef805925d8c3d5bdbe6aa1848bb5b4d8fca55c1e7e291e20c6a10c92portmaster-installer.exe (PID: 3640)
      • f43a3e6eef805925d8c3d5bdbe6aa1848bb5b4d8fca55c1e7e291e20c6a10c92portmaster-installer.exe (PID: 6688)
      • portmaster-start.exe (PID: 4544)
      • portmaster-start.exe (PID: 2760)

    • Create files in the Startup directory

      • f43a3e6eef805925d8c3d5bdbe6aa1848bb5b4d8fca55c1e7e291e20c6a10c92portmaster-installer.exe (PID: 6688)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • f43a3e6eef805925d8c3d5bdbe6aa1848bb5b4d8fca55c1e7e291e20c6a10c92portmaster-installer.exe (PID: 6688)

    • There is functionality for taking screenshot (YARA)

      • f43a3e6eef805925d8c3d5bdbe6aa1848bb5b4d8fca55c1e7e291e20c6a10c92portmaster-installer.exe (PID: 6688)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • f43a3e6eef805925d8c3d5bdbe6aa1848bb5b4d8fca55c1e7e291e20c6a10c92portmaster-installer.exe (PID: 6688)

    • The process creates files with name similar to system file names

      • f43a3e6eef805925d8c3d5bdbe6aa1848bb5b4d8fca55c1e7e291e20c6a10c92portmaster-installer.exe (PID: 6688)

  • INFO

    • Creates files in the program directory

      • portmaster-start.exe (PID: 2760)
      • f43a3e6eef805925d8c3d5bdbe6aa1848bb5b4d8fca55c1e7e291e20c6a10c92portmaster-installer.exe (PID: 6688)
      • portmaster-start.exe (PID: 4544)

    • Reads product name

      • portmaster-start.exe (PID: 2760)
      • portmaster-start.exe (PID: 4544)

    • Reads Environment values

      • portmaster-start.exe (PID: 2760)
      • portmaster-start.exe (PID: 4544)

    • Reads the software policy settings

      • portmaster-start.exe (PID: 2760)
      • slui.exe (PID: 2468)
      • portmaster-start.exe (PID: 4544)

    • Reads the computer name

      • f43a3e6eef805925d8c3d5bdbe6aa1848bb5b4d8fca55c1e7e291e20c6a10c92portmaster-installer.exe (PID: 6688)
      • portmaster-start.exe (PID: 4544)
      • portmaster-start.exe (PID: 2760)

    • Create files in a temporary directory

      • f43a3e6eef805925d8c3d5bdbe6aa1848bb5b4d8fca55c1e7e291e20c6a10c92portmaster-installer.exe (PID: 6688)

    • The sample compiled with english language support

      • f43a3e6eef805925d8c3d5bdbe6aa1848bb5b4d8fca55c1e7e291e20c6a10c92portmaster-installer.exe (PID: 6688)

    • Checks supported languages

      • f43a3e6eef805925d8c3d5bdbe6aa1848bb5b4d8fca55c1e7e291e20c6a10c92portmaster-installer.exe (PID: 6688)
      • portmaster-start.exe (PID: 4544)
      • portmaster-start.exe (PID: 2760)

    • Reads the machine GUID from the registry

      • portmaster-start.exe (PID: 2760)
      • portmaster-start.exe (PID: 4544)

    • Application based on Golang

      • portmaster-start.exe (PID: 4544)

    • Detects GO elliptic curve encryption (YARA)

      • portmaster-start.exe (PID: 4544)

    • Checks proxy server information

      • slui.exe (PID: 2468)

    • Launching a file from the Startup directory

      • f43a3e6eef805925d8c3d5bdbe6aa1848bb5b4d8fca55c1e7e291e20c6a10c92portmaster-installer.exe (PID: 6688)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:12:16 00:50:53+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26112
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x350d
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.13.0
ProductVersionNumber: 1.0.13.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Safing ICS Technologies GmbH
FileDescription: Portmaster Application Firewall
FileVersion: 1.0.13.0
LegalCopyright: Safing ICS Technologies GmbH
ProductName: Portmaster
ProductVersion: 1.0.13.0
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
5
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start f43a3e6eef805925d8c3d5bdbe6aa1848bb5b4d8fca55c1e7e291e20c6a10c92portmaster-installer.exe portmaster-start.exe portmaster-start.exe slui.exe f43a3e6eef805925d8c3d5bdbe6aa1848bb5b4d8fca55c1e7e291e20c6a10c92portmaster-installer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2468C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2760C:\ProgramData\Safing\Portmaster\portmaster-start.exe clean-structure --data=C:\ProgramData\Safing\PortmasterC:\ProgramData\Safing\Portmaster\portmaster-start.exe
f43a3e6eef805925d8c3d5bdbe6aa1848bb5b4d8fca55c1e7e291e20c6a10c92portmaster-installer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\programdata\safing\portmaster\portmaster-start.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3640"C:\Users\admin\Desktop\f43a3e6eef805925d8c3d5bdbe6aa1848bb5b4d8fca55c1e7e291e20c6a10c92portmaster-installer.exe" C:\Users\admin\Desktop\f43a3e6eef805925d8c3d5bdbe6aa1848bb5b4d8fca55c1e7e291e20c6a10c92portmaster-installer.exe—explorer.exe
User:
admin
Company:
Safing ICS Technologies GmbH
Integrity Level:
MEDIUM
Description:
Portmaster Application Firewall
Exit code:
3221226540
Version:
1.0.13.0
Modules
Images
c:\users\admin\desktop\f43a3e6eef805925d8c3d5bdbe6aa1848bb5b4d8fca55c1e7e291e20c6a10c92portmaster-installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4544C:\ProgramData\Safing\Portmaster\portmaster-start.exe update --data=C:\ProgramData\Safing\PortmasterC:\ProgramData\Safing\Portmaster\portmaster-start.exe
f43a3e6eef805925d8c3d5bdbe6aa1848bb5b4d8fca55c1e7e291e20c6a10c92portmaster-installer.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\programdata\safing\portmaster\portmaster-start.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6688"C:\Users\admin\Desktop\f43a3e6eef805925d8c3d5bdbe6aa1848bb5b4d8fca55c1e7e291e20c6a10c92portmaster-installer.exe" C:\Users\admin\Desktop\f43a3e6eef805925d8c3d5bdbe6aa1848bb5b4d8fca55c1e7e291e20c6a10c92portmaster-installer.exe
explorer.exe
User:
admin
Company:
Safing ICS Technologies GmbH
Integrity Level:
HIGH
Description:
Portmaster Application Firewall
Version:
1.0.13.0
Modules
Images
c:\users\admin\desktop\f43a3e6eef805925d8c3d5bdbe6aa1848bb5b4d8fca55c1e7e291e20c6a10c92portmaster-installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
10 291
Read events
10 291
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
6
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
6688f43a3e6eef805925d8c3d5bdbe6aa1848bb5b4d8fca55c1e7e291e20c6a10c92portmaster-installer.exeC:\Users\admin\AppData\Local\Temp\nss6EAA.tmp\nsDialogs.dllexecutable
MD5:EC9640B70E07141FEBBE2CD4CC42510F
SHA256:C5BA017732597A82F695B084D1AA7FE3B356168CC66105B9392A9C5B06BE5188
6688f43a3e6eef805925d8c3d5bdbe6aa1848bb5b4d8fca55c1e7e291e20c6a10c92portmaster-installer.exeC:\ProgramData\Safing\Portmaster\portmaster-uninstaller.exeexecutable
MD5:93E8320C7D1369B328AFBD5A7657C00B
SHA256:D1DB2001EC0BFDBB97BAA7D30FACFF5EE74C878A0F092AC128DBB81804D48F81
6688f43a3e6eef805925d8c3d5bdbe6aa1848bb5b4d8fca55c1e7e291e20c6a10c92portmaster-installer.exeC:\ProgramData\Safing\Portmaster\portmaster.icoimage
MD5:B637BBF15CF3F22995146E55DD85E55E
SHA256:21F8B6B32A10D40EEFFEF74924C04E4BF01E5407111926AB0460D7099194D82E
6688f43a3e6eef805925d8c3d5bdbe6aa1848bb5b4d8fca55c1e7e291e20c6a10c92portmaster-installer.exeC:\Users\admin\AppData\Local\Temp\nss6EAA.tmp\modern-wizard.bmpimage
MD5:CBE40FD2B1EC96DAEDC65DA172D90022
SHA256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
6688f43a3e6eef805925d8c3d5bdbe6aa1848bb5b4d8fca55c1e7e291e20c6a10c92portmaster-installer.exeC:\Program Files\Safing\Portmaster.lnkbinary
MD5:6F3F5AD2D153CC6E071BF2317AFC422F
SHA256:26041BDB915EDE55D9F8FDB69268B228B21BCF326152C3C322CE5749BE39DA87
6688f43a3e6eef805925d8c3d5bdbe6aa1848bb5b4d8fca55c1e7e291e20c6a10c92portmaster-installer.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Portmaster\Portmaster.lnkbinary
MD5:FDCAFB333689BC62A9E16B0AD9F23559
SHA256:72C66B0E257BD98E186BB1FE6958DD09466B69DA0FF8FA4C62027F411A0B2332
6688f43a3e6eef805925d8c3d5bdbe6aa1848bb5b4d8fca55c1e7e291e20c6a10c92portmaster-installer.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Portmaster\Portmaster Notifier.lnkbinary
MD5:A7CC28A33C285045EA11DBAB00D588C0
SHA256:AE0A9BA981F7F82098E7B2226C203742CC1963169D59BE964B4DB20BE8789B2E
6688f43a3e6eef805925d8c3d5bdbe6aa1848bb5b4d8fca55c1e7e291e20c6a10c92portmaster-installer.exeC:\Users\admin\AppData\Local\Temp\nss6EAA.tmp\modern-header.bmpimage
MD5:940C56737BF9BB69CE7A31C623D4E87A
SHA256:766A893FE962AEFD27C574CB05F25CF895D3FC70A00DB5A6FA73D573F571AEFC
6688f43a3e6eef805925d8c3d5bdbe6aa1848bb5b4d8fca55c1e7e291e20c6a10c92portmaster-installer.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Portmaster Notifier.lnkbinary
MD5:A7CC28A33C285045EA11DBAB00D588C0
SHA256:AE0A9BA981F7F82098E7B2226C203742CC1963169D59BE964B4DB20BE8789B2E
6688f43a3e6eef805925d8c3d5bdbe6aa1848bb5b4d8fca55c1e7e291e20c6a10c92portmaster-installer.exeC:\Users\admin\AppData\Local\Temp\nss6EAA.tmp\nsExec.dllexecutable
MD5:F27689C513E7D12C7C974D5F8EF710D6
SHA256:1F18F4126124B0551F3DBCD0FEC7F34026F930CA509F04435657CEDC32AE8C47
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
38
TCP/UDP connections
47
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
184.24.77.38:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5008
RUXIMICS.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
200
20.190.159.23:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
16.7 Kb
whitelisted
—
—
GET
200
167.235.104.51:443
https://updates.safing.io/stable.v2.json
unknown
binary
2.70 Kb
—
—
—
GET
200
167.235.104.51:443
https://updates.safing.io/all/intel/intel.json
unknown
binary
368 b
—
—
—
GET
200
167.235.104.51:443
https://updates.safing.io/stable.v2.json.sig
unknown
text
457 b
—
—
—
GET
200
167.235.104.51:443
https://updates.safing.io/all/intel/intel.json
unknown
binary
368 b
—
—
—
GET
200
167.235.104.51:443
https://updates.safing.io/stable.v2.json.sig
unknown
text
457 b
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5944
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5008
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
184.24.77.38:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5944
MoUsoCoreWorker.exe
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2336
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
5008
RUXIMICS.exe
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.142
whitelisted
crl.microsoft.com
  • 184.24.77.38
  • 184.24.77.37
  • 184.24.77.12
  • 184.24.77.35
  • 184.24.77.11
  • 184.24.77.23
  • 184.24.77.6
  • 184.24.77.42
whitelisted
www.microsoft.com
  • 2.23.181.156
whitelisted
client.wns.windows.com
  • 172.211.123.249
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.32.136
  • 40.126.32.138
  • 20.190.160.22
  • 20.190.160.65
  • 20.190.160.20
  • 20.190.160.4
  • 20.190.160.2
  • 40.126.32.134
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
  • 51.124.78.146
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.11
whitelisted
updates.safing.io
  • 167.235.104.51
unknown
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
f43a3e6eef805925d8c3d5bdbe6aa1848bb5b4d8fca55c1e7e291e20c6a10c92portmaster-installer.exe