Analysis
-
max time kernel
208s -
max time network
213s -
platform
windows10-1703_x64 -
resource
win10-20231023-en -
resource tags
arch:x64arch:x86image:win10-20231023-enlocale:en-usos:windows10-1703-x64system -
submitted
09-12-2023 07:15
Static task
static1
General
-
Target
ProtonVPN_v3.2.7.exe
-
Size
76.7MB
-
MD5
bbac0227b9eb01bcd8bc43f2f8b674bb
-
SHA1
b95236cf76a962f4dccde9032641ce67f9a1cfd9
-
SHA256
57bea2dd764fb122edd25842985274e249bbf7181dee7840cc791a87e202ac09
-
SHA512
3298fe796a005d6d6de26ccfcbc494c2a965e27539f3b79a1bfa5a88e0fc1463a8d5d43d988025c2f61bf0b649b452504880750f373c8670a2a4e4512552071e
-
SSDEEP
1572864:E/QGdXHAAlbO1dtI6g58c7s4ZCtmWGBBjGxr6Sk9luQDM:wQGXHvlbQgl4PkWGji6Sk94QI
Malware Config
Signatures
-
Detect PureLogs payload 1 IoCs
resource yara_rule behavioral1/memory/3312-1480-0x000001CF70A90000-0x000001CF70AD6000-memory.dmp family_purelogs -
Downloads MZ/PE file
-
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\SETA52.tmp DrvInst.exe File created C:\Windows\System32\drivers\SETA52.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\tapprotonvpn.sys DrvInst.exe -
Sets file execution options in registry 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000\Control Panel\International\Geo\Nation ProtonVPN_v3.2.7.tmp Key value queried \REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000\Control Panel\International\Geo\Nation ProtonVPN.exe -
Executes dropped EXE 26 IoCs
pid Process 4620 ProtonVPN_v3.2.7.tmp 2028 ProtonVPN_win_v2.4.3.exe 2468 go.microsoft.com 3260 MicrosoftEdgeUpdate.exe 4200 MicrosoftEdgeUpdate.exe 4116 MicrosoftEdgeUpdate.exe 3052 MicrosoftEdgeUpdateComRegisterShell64.exe 4552 MicrosoftEdgeUpdateComRegisterShell64.exe 4948 MicrosoftEdgeUpdateComRegisterShell64.exe 2736 MicrosoftEdgeUpdate.exe 4136 MicrosoftEdgeUpdate.exe 4620 MicrosoftEdgeUpdate.exe 4432 MicrosoftEdgeUpdate.exe 5100 MicrosoftEdge_X64_120.0.2210.61.exe 4108 setup.exe 5024 MicrosoftEdgeUpdate.exe 4860 ProtonVPN_win_v2.4.3.exe 2956 ProtonVPNTap_1.1.4.exe 1396 tapinstall.exe 2208 tapinstall.exe 796 tapinstall.exe 2084 ProtonVPNTun_0.13.1.exe 1248 ProtonVPN_win_v2.4.3.exe 2784 MSI9F1E.tmp 3312 ProtonVPN.exe 4552 ProtonVPNService.exe -
Loads dropped DLL 64 IoCs
pid Process 2028 ProtonVPN_win_v2.4.3.exe 2028 ProtonVPN_win_v2.4.3.exe 4208 MsiExec.exe 4208 MsiExec.exe 3260 MicrosoftEdgeUpdate.exe 3052 MicrosoftEdgeUpdateComRegisterShell64.exe 4116 MicrosoftEdgeUpdate.exe 4552 MicrosoftEdgeUpdateComRegisterShell64.exe 4116 MicrosoftEdgeUpdate.exe 4948 MicrosoftEdgeUpdateComRegisterShell64.exe 4116 MicrosoftEdgeUpdate.exe 4620 MicrosoftEdgeUpdate.exe 4136 MicrosoftEdgeUpdate.exe 4456 MsiExec.exe 4456 MsiExec.exe 4456 MsiExec.exe 4456 MsiExec.exe 4456 MsiExec.exe 4456 MsiExec.exe 4456 MsiExec.exe 4456 MsiExec.exe 4456 MsiExec.exe 4456 MsiExec.exe 4456 MsiExec.exe 4456 MsiExec.exe 4860 ProtonVPN_win_v2.4.3.exe 2028 ProtonVPN_win_v2.4.3.exe 2956 ProtonVPNTap_1.1.4.exe 2956 ProtonVPNTap_1.1.4.exe 168 MsiExec.exe 2064 MsiExec.exe 2064 MsiExec.exe 2064 MsiExec.exe 2064 MsiExec.exe 2064 MsiExec.exe 2956 ProtonVPNTap_1.1.4.exe 2064 MsiExec.exe 3372 rundll32.exe 3372 rundll32.exe 3372 rundll32.exe 3372 rundll32.exe 3372 rundll32.exe 2064 MsiExec.exe 2064 MsiExec.exe 2084 ProtonVPNTun_0.13.1.exe 2084 ProtonVPNTun_0.13.1.exe 1020 MsiExec.exe 2876 MsiExec.exe 2876 MsiExec.exe 2876 MsiExec.exe 2876 MsiExec.exe 2876 MsiExec.exe 2084 ProtonVPNTun_0.13.1.exe 2876 MsiExec.exe 2876 MsiExec.exe 4088 MsiExec.exe 4088 MsiExec.exe 4088 MsiExec.exe 4088 MsiExec.exe 4088 MsiExec.exe 4088 MsiExec.exe 4088 MsiExec.exe 4088 MsiExec.exe 2028 ProtonVPN_win_v2.4.3.exe -
Registers COM server for autorun 1 TTPs 35 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B473453-BCFD-454A-AB98-B0DE7FDF2A6E}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B473453-BCFD-454A-AB98-B0DE7FDF2A6E}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.181.5\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B473453-BCFD-454A-AB98-B0DE7FDF2A6E}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.181.5\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B473453-BCFD-454A-AB98-B0DE7FDF2A6E}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B473453-BCFD-454A-AB98-B0DE7FDF2A6E}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B473453-BCFD-454A-AB98-B0DE7FDF2A6E}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.181.5\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B473453-BCFD-454A-AB98-B0DE7FDF2A6E}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.181.5\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\CLSID\{d936918b-9c4b-555e-074a-c79314be04e1}\LocalServer32\ = "\"C:\\Program Files (x86)\\Proton Technologies\\ProtonVPN\\ProtonVPN.exe\" -ToastActivated" ProtonVPN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.181.5\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.181.5\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B473453-BCFD-454A-AB98-B0DE7FDF2A6E}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d936918b-9c4b-555e-074a-c79314be04e1}\LocalServer32\ = "\"C:\\Program Files (x86)\\Proton Technologies\\ProtonVPN\\ProtonVPN.exe\" -ToastActivated" ProtonVPN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.181.5\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\CLSID\{d936918b-9c4b-555e-074a-c79314be04e1}\LocalServer32 ProtonVPN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.181.5\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B473453-BCFD-454A-AB98-B0DE7FDF2A6E}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.181.5\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d936918b-9c4b-555e-074a-c79314be04e1}\LocalServer32 ProtonVPN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\{5D0F40C5-4278-4AA0-A06C-7BD24B088624} = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\TempState\\Downloads\\ProtonVPN_win_v2.4.3.exe\" /cmdloc \"HKCU\\Software\\Proton Technologies AG AiTemp\\{5D0F40C5-4278-4AA0-A06C-7BD24B088624}\"" ProtonVPN_win_v2.4.3.exe Set value (str) \REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000\Software\Microsoft\Windows\CurrentVersion\Run\ProtonVPN = "C:\\Program Files (x86)\\Proton Technologies\\ProtonVPN\\ProtonVPN.exe" ProtonVPN.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ProtonVPN.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: ProtonVPNTap_1.1.4.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\N: ProtonVPN_win_v2.4.3.exe File opened (read-only) \??\E: ProtonVPN_win_v2.4.3.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: ProtonVPN_win_v2.4.3.exe File opened (read-only) \??\B: ProtonVPNTap_1.1.4.exe File opened (read-only) \??\E: ProtonVPNTap_1.1.4.exe File opened (read-only) \??\H: ProtonVPNTap_1.1.4.exe File opened (read-only) \??\N: ProtonVPNTap_1.1.4.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\A: ProtonVPNTun_0.13.1.exe File opened (read-only) \??\Y: ProtonVPNTun_0.13.1.exe File opened (read-only) \??\P: ProtonVPN_win_v2.4.3.exe File opened (read-only) \??\U: ProtonVPN_win_v2.4.3.exe File opened (read-only) \??\Y: ProtonVPN_win_v2.4.3.exe File opened (read-only) \??\E: ProtonVPN_win_v2.4.3.exe File opened (read-only) \??\K: ProtonVPNTun_0.13.1.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: ProtonVPN_win_v2.4.3.exe File opened (read-only) \??\T: ProtonVPN_win_v2.4.3.exe File opened (read-only) \??\W: ProtonVPN_win_v2.4.3.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: ProtonVPN_win_v2.4.3.exe File opened (read-only) \??\V: ProtonVPN_win_v2.4.3.exe File opened (read-only) \??\L: ProtonVPNTap_1.1.4.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: ProtonVPN_win_v2.4.3.exe File opened (read-only) \??\G: ProtonVPN_win_v2.4.3.exe File opened (read-only) \??\K: ProtonVPN_win_v2.4.3.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\U: ProtonVPNTap_1.1.4.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: ProtonVPNTap_1.1.4.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: ProtonVPNTun_0.13.1.exe File opened (read-only) \??\W: ProtonVPNTun_0.13.1.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\G: ProtonVPN_win_v2.4.3.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: ProtonVPNTap_1.1.4.exe File opened (read-only) \??\T: ProtonVPN_win_v2.4.3.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: ProtonVPNTun_0.13.1.exe File opened (read-only) \??\Z: ProtonVPN_win_v2.4.3.exe File opened (read-only) \??\W: ProtonVPNTap_1.1.4.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\S: ProtonVPNTap_1.1.4.exe File opened (read-only) \??\V: ProtonVPNTap_1.1.4.exe File opened (read-only) \??\G: ProtonVPNTun_0.13.1.exe File opened (read-only) \??\M: ProtonVPNTun_0.13.1.exe File opened (read-only) \??\J: ProtonVPN_win_v2.4.3.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: ProtonVPNTap_1.1.4.exe File opened (read-only) \??\U: ProtonVPN_win_v2.4.3.exe File opened (read-only) \??\M: ProtonVPN_win_v2.4.3.exe -
Checks system information in the registry 2 TTPs 10 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe -
Drops file in System32 directory 29 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\Temp\{d4688ed5-2f22-d04f-865b-c5f91d72c6fd}\SET59F.tmp DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba4c0fa2d195a7ca\tapprotonvpn.cat DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba4c0fa2d195a7ca\oemvista.PNF DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d4688ed5-2f22-d04f-865b-c5f91d72c6fd}\SET5AF.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d4688ed5-2f22-d04f-865b-c5f91d72c6fd}\tapprotonvpn.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d4688ed5-2f22-d04f-865b-c5f91d72c6fd} DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData MicrosoftEdgeUpdate.exe File created C:\Windows\System32\DriverStore\Temp\{d4688ed5-2f22-d04f-865b-c5f91d72c6fd}\SET5B0.tmp DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d4688ed5-2f22-d04f-865b-c5f91d72c6fd}\SET5B0.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat MicrosoftEdgeUpdate.exe File created C:\Windows\System32\DriverStore\Temp\{d4688ed5-2f22-d04f-865b-c5f91d72c6fd}\SET59F.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d4688ed5-2f22-d04f-865b-c5f91d72c6fd}\tapprotonvpn.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba4c0fa2d195a7ca\oemvista.inf DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba4c0fa2d195a7ca\oemvista.PNF tapinstall.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 MicrosoftEdgeUpdate.exe File created C:\Windows\System32\DriverStore\Temp\{d4688ed5-2f22-d04f-865b-c5f91d72c6fd}\SET5AF.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba4c0fa2d195a7ca\tapprotonvpn.sys DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A MicrosoftEdgeUpdate.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d4688ed5-2f22-d04f-865b-c5f91d72c6fd}\oemvista.inf DrvInst.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\120.0.2210.61\Trust Protection Lists\Sigma\Staging setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\120.0.2210.61\Locales\nb.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\120.0.2210.61\Trust Protection Lists\Sigma\Staging setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\120.0.2210.61\vcruntime140.dll setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\120.0.2210.61\Extensions\external_extensions.json setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\120.0.2210.61\BHO\ie_to_edge_stub.exe setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\120.0.2210.61\Locales\kok.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\120.0.2210.61\identity_proxy\win11\identity_helper.Sparse.Canary.msix setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\120.0.2210.61\Locales\km.pak setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUA090.tmp\msedgeupdateres_it.dll go.microsoft.com File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\120.0.2210.61\identity_proxy\resources.pri setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUA090.tmp\MicrosoftEdgeUpdateSetup.exe go.microsoft.com File created C:\Program Files (x86)\Microsoft\EdgeCore\120.0.2210.61\MEIPreload\manifest.json setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\120.0.2210.61\Locales\sk.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\120.0.2210.61\identity_proxy\win11\identity_helper.Sparse.Dev.msix setup.exe File created C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPN.Core.dll msiexec.exe File created C:\Program Files (x86)\Microsoft\Temp\EUA090.tmp\msedgeupdateres_sr-Cyrl-RS.dll go.microsoft.com File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\120.0.2210.61\Locales\ug.pak setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUA090.tmp\msedgeupdateres_tt.dll go.microsoft.com File created C:\Program Files (x86)\Microsoft\EdgeCore\120.0.2210.61\Locales\lo.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\120.0.2210.61\pwahelper.exe setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\120.0.2210.61\Locales\tt.pak setup.exe File created C:\Program Files (x86)\Proton Technologies\ProtonVPN\Microsoft.Bcl.AsyncInterfaces.dll msiexec.exe File created C:\Program Files (x86)\Proton Technologies\ProtonVPN\cs-CZ\ProtonVPN.Translations.resources.dll msiexec.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\120.0.2210.61\Locales\ur.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\120.0.2210.61\Locales\vi.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\120.0.2210.61\Trust Protection Lists\Sigma\Content setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\120.0.2210.61\Locales\nb.pak setup.exe File created C:\Program Files (x86)\Proton Technologies\ProtonVPNTap\windows7\x64\tapprotonvpn.sys msiexec.exe File created C:\Program Files (x86)\Microsoft\Temp\EUA090.tmp\psmachine_arm64.dll go.microsoft.com File created C:\Program Files (x86)\Microsoft\EdgeCore\120.0.2210.61\Trust Protection Lists\Mu\Analytics setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\120.0.2210.61\Locales\eu.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\120.0.2210.61\Locales\ru.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\120.0.2210.61\Trust Protection Lists\Sigma\Fingerprinting setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\120.0.2210.61\Locales\pl.pak setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUA090.tmp\msedgeupdateres_ca.dll go.microsoft.com File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\120.0.2210.61\resources.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\120.0.2210.61\Locales\sl.pak setup.exe File created C:\Program Files (x86)\Proton Technologies\ProtonVPN\DynamicExpresso.Core.dll msiexec.exe File created C:\Program Files (x86)\Proton Technologies\ProtonVPN\System.Collections.Immutable.dll msiexec.exe File created C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPN.WireGuardService.exe msiexec.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\120.0.2210.61\Trust Protection Lists\manifest.json setup.exe File created C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPN.RestoreInternet.exe msiexec.exe File created C:\Program Files (x86)\Microsoft\Temp\EUA090.tmp\msedgeupdate.dll go.microsoft.com File created C:\Program Files (x86)\Microsoft\EdgeCore\120.0.2210.61\Locales\bg.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\120.0.2210.61\Locales\es-419.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\120.0.2210.61\Trust Protection Lists\Sigma\Advertising setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\120.0.2210.61\VisualElements\LogoDev.png setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\120.0.2210.61\Trust Protection Lists\Sigma\Other setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\120.0.2210.61\Locales\fa.pak setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUA090.tmp\MicrosoftEdgeUpdateBroker.exe go.microsoft.com File created C:\Program Files (x86)\Microsoft\EdgeCore\120.0.2210.61\Locales\pt-BR.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\120.0.2210.61\Locales\fr-CA.pak setup.exe File created C:\Program Files (x86)\Proton Technologies\ProtonVPN\Resources\32-bit\vcruntime140.dll msiexec.exe File created C:\Program Files (x86)\Microsoft\Temp\EUA090.tmp\msedgeupdateres_zh-CN.dll go.microsoft.com File created C:\Program Files (x86)\Microsoft\EdgeCore\120.0.2210.61\dxil.dll setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\120.0.2210.61\identity_proxy\win11\identity_helper.Sparse.Canary.msix setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\120.0.2210.61\edge_feedback\camera_mf_trace.wprp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\120.0.2210.61\Locales\ml.pak setup.exe File created C:\Program Files (x86)\Proton Technologies\ProtonVPN\Newtonsoft.Json.dll msiexec.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\120.0.2210.61\identity_proxy\win10\identity_helper.Sparse.Internal.msix setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\120.0.2210.61\Locales\fr.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\120.0.2210.61\msedge.exe setup.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIF892.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log tapinstall.exe File opened for modification C:\Windows\Installer\MSI9346.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9DC0.tmp msiexec.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Installer\MSI15F5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8A96.tmp msiexec.exe File created C:\Windows\Installer\e59f474.msi msiexec.exe File created C:\Windows\Installer\{87BDF456-9882-44E6-8FFC-F73B83E42EAD}\protonvpn.exe msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\e59f471.msi msiexec.exe File created C:\Windows\Installer\SourceHash{5D0F40C5-4278-4AA0-A06C-7BD24B088624} msiexec.exe File opened for modification C:\Windows\Installer\MSI1E2A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI89F7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9F1D.tmp msiexec.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIF7B4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFBFF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI96.tmp-\TapInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIF872.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF98D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI96.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSID68.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9716.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9366.tmp msiexec.exe File opened for modification C:\Windows\Installer\{5D0F40C5-4278-4AA0-A06C-7BD24B088624}\protonvpn.exe msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File created C:\Windows\Installer\e59f46d.msi msiexec.exe File opened for modification C:\Windows\Installer\e59f472.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI9316.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8BEF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI93B5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9F1E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9F2E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI96.tmp-\CustomAction.config rundll32.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\Installer\MSI8A17.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9075.tmp msiexec.exe File opened for modification C:\Windows\Installer\e59f468.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI96.tmp msiexec.exe File created C:\Windows\INF\oem3.PNF DrvInst.exe File opened for modification C:\Windows\Installer\MSI8C3E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1682.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1AFB.tmp msiexec.exe File created C:\Windows\Installer\e59f472.msi msiexec.exe File created C:\Windows\Installer\e59f468.msi msiexec.exe File opened for modification C:\Windows\Installer\{87BDF456-9882-44E6-8FFC-F73B83E42EAD}\protonvpn.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI16F1.tmp msiexec.exe File created C:\Windows\Installer\{5D0F40C5-4278-4AA0-A06C-7BD24B088624}\protonvpn.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI9DE0.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{87BDF456-9882-44E6-8FFC-F73B83E42EAD} msiexec.exe File opened for modification C:\Windows\Installer\e59f46d.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI17AD.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{B1EBF050-CC3E-45B0-9DE5-339C6241F3DA} msiexec.exe File created C:\Windows\Installer\{B1EBF050-CC3E-45B0-9DE5-339C6241F3DA}\protonvpn.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI9B8B.tmp msiexec.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\Installer\MSI89D7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8A38.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9453.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9483.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\ConfigFlags DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Mfg svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009 svchost.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1d msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeUpdate.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update" DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1c msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe -
Modifies registry class 64 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B473453-BCFD-454A-AB98-B0DE7FDF2A6E}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods\ = "4" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods\ = "10" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\050FBE1BE3CC0B54D95E33C926143FAD\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine.1.0\CLSID\ = "{B5977F34-9264-4AC3-9B31-1224827FF6E8}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods\ = "10" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\050FBE1BE3CC0B54D95E33C926143FAD msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32\ = "{2B473453-BCFD-454A-AB98-B0DE7FDF2A6E}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (int) \REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32\ = "{2B473453-BCFD-454A-AB98-B0DE7FDF2A6E}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods\ = "11" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32\ = "{2B473453-BCFD-454A-AB98-B0DE7FDF2A6E}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ = "IAppBundle" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine\CLSID MicrosoftEdgeUpdate.exe Set value (data) \REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ = "IPolicyStatus2" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ = "IPolicyStatusValue" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ = "IJobObserver2" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.PolicyStatusMachineFallback" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32\ = "{2B473453-BCFD-454A-AB98-B0DE7FDF2A6E}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods\ = "41" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32\ = "{2B473453-BCFD-454A-AB98-B0DE7FDF2A6E}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32\ = "{2B473453-BCFD-454A-AB98-B0DE7FDF2A6E}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods\ = "9" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ = "IPackage" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods\ = "11" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher\ = "Microsoft Edge Update Process Launcher Class" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachineFallback\CLSID MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C04F0D587240AA40AC6B72DB4806842\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\ = "Google Update Policy Status Class" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachine MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods\ = "10" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.PolicyStatusMachine" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\S-1-5-21-946614337-2046421199-3397417319-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.181.5\\msedgeupdate.dll,-3000" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B473453-BCFD-454A-AB98-B0DE7FDF2A6E} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B473453-BCFD-454A-AB98-B0DE7FDF2A6E}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback MicrosoftEdgeUpdate.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 5c0000000100000004000000001000000400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff1190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 ProtonVPN_win_v2.4.3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1 ProtonVPN_win_v2.4.3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 ProtonVPN_win_v2.4.3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 ProtonVPN_win_v2.4.3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd10400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 ProtonVPN_win_v2.4.3.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\ProtonVPN_win_v2.4.3.exe.jrkfk7m.partial:Zone.Identifier browser_broker.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 4208 MsiExec.exe 4208 MsiExec.exe 3260 MicrosoftEdgeUpdate.exe 3260 MicrosoftEdgeUpdate.exe 3260 MicrosoftEdgeUpdate.exe 3260 MicrosoftEdgeUpdate.exe 3260 MicrosoftEdgeUpdate.exe 3260 MicrosoftEdgeUpdate.exe 4456 MsiExec.exe 4456 MsiExec.exe 2076 msiexec.exe 2076 msiexec.exe 3372 rundll32.exe 3372 rundll32.exe 3372 rundll32.exe 2076 msiexec.exe 2076 msiexec.exe 4088 MsiExec.exe 4088 MsiExec.exe 2076 msiexec.exe 2076 msiexec.exe 2076 msiexec.exe 2076 msiexec.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 3928 MicrosoftEdgeCP.exe 3928 MicrosoftEdgeCP.exe 3928 MicrosoftEdgeCP.exe 3928 MicrosoftEdgeCP.exe 3928 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2420 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 2420 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 2420 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 2420 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 3324 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 3324 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 3824 MicrosoftEdge.exe Token: SeDebugPrivilege 3824 MicrosoftEdge.exe Token: SeSecurityPrivilege 2076 msiexec.exe Token: SeCreateTokenPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeAssignPrimaryTokenPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeLockMemoryPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeIncreaseQuotaPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeMachineAccountPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeTcbPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeSecurityPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeTakeOwnershipPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeLoadDriverPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeSystemProfilePrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeSystemtimePrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeProfSingleProcessPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeIncBasePriorityPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeCreatePagefilePrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeCreatePermanentPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeBackupPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeRestorePrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeShutdownPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeDebugPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeAuditPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeSystemEnvironmentPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeChangeNotifyPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeRemoteShutdownPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeUndockPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeSyncAgentPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeEnableDelegationPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeManageVolumePrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeImpersonatePrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeCreateGlobalPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeCreateTokenPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeAssignPrimaryTokenPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeLockMemoryPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeIncreaseQuotaPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeMachineAccountPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeTcbPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeSecurityPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeTakeOwnershipPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeLoadDriverPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeSystemProfilePrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeSystemtimePrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeProfSingleProcessPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeIncBasePriorityPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeCreatePagefilePrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeCreatePermanentPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeBackupPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeRestorePrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeShutdownPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeDebugPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeAuditPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeSystemEnvironmentPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeChangeNotifyPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeRemoteShutdownPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeUndockPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeSyncAgentPrivilege 2028 ProtonVPN_win_v2.4.3.exe Token: SeEnableDelegationPrivilege 2028 ProtonVPN_win_v2.4.3.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 2028 ProtonVPN_win_v2.4.3.exe 2028 ProtonVPN_win_v2.4.3.exe 2756 msiexec.exe 2756 msiexec.exe 4180 msiexec.exe 4180 msiexec.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 3824 MicrosoftEdge.exe 3928 MicrosoftEdgeCP.exe 2420 MicrosoftEdgeCP.exe 3928 MicrosoftEdgeCP.exe 2468 go.microsoft.com 3260 MicrosoftEdgeUpdate.exe 4200 MicrosoftEdgeUpdate.exe 4116 MicrosoftEdgeUpdate.exe 2736 MicrosoftEdgeUpdate.exe 4136 MicrosoftEdgeUpdate.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2872 wrote to memory of 4620 2872 ProtonVPN_v3.2.7.exe 71 PID 2872 wrote to memory of 4620 2872 ProtonVPN_v3.2.7.exe 71 PID 2872 wrote to memory of 4620 2872 ProtonVPN_v3.2.7.exe 71 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 924 3928 MicrosoftEdgeCP.exe 77 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 924 3928 MicrosoftEdgeCP.exe 77 PID 3928 wrote to memory of 924 3928 MicrosoftEdgeCP.exe 77 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 2436 wrote to memory of 2028 2436 browser_broker.exe 80 PID 2436 wrote to memory of 2028 2436 browser_broker.exe 80 PID 2436 wrote to memory of 2028 2436 browser_broker.exe 80 PID 3928 wrote to memory of 4588 3928 MicrosoftEdgeCP.exe 76 PID 2076 wrote to memory of 4208 2076 msiexec.exe 83 PID 2076 wrote to memory of 4208 2076 msiexec.exe 83 PID 2076 wrote to memory of 4208 2076 msiexec.exe 83 PID 2028 wrote to memory of 2468 2028 ProtonVPN_win_v2.4.3.exe 86 PID 2028 wrote to memory of 2468 2028 ProtonVPN_win_v2.4.3.exe 86 PID 2028 wrote to memory of 2468 2028 ProtonVPN_win_v2.4.3.exe 86 PID 2468 wrote to memory of 3260 2468 go.microsoft.com 87 PID 2468 wrote to memory of 3260 2468 go.microsoft.com 87 PID 2468 wrote to memory of 3260 2468 go.microsoft.com 87 PID 3260 wrote to memory of 4200 3260 MicrosoftEdgeUpdate.exe 88 PID 3260 wrote to memory of 4200 3260 MicrosoftEdgeUpdate.exe 88 PID 3260 wrote to memory of 4200 3260 MicrosoftEdgeUpdate.exe 88 PID 3260 wrote to memory of 4116 3260 MicrosoftEdgeUpdate.exe 89 PID 3260 wrote to memory of 4116 3260 MicrosoftEdgeUpdate.exe 89 PID 3260 wrote to memory of 4116 3260 MicrosoftEdgeUpdate.exe 89 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v3.2.7.exe"C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v3.2.7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\is-8A42Q.tmp\ProtonVPN_v3.2.7.tmp"C:\Users\Admin\AppData\Local\Temp\is-8A42Q.tmp\ProtonVPN_v3.2.7.tmp" /SL5="$60204,79482656,1089536,C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v3.2.7.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
PID:4620
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3824
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\ProtonVPN_win_v2.4.3.exe"C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\ProtonVPN_win_v2.4.3.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\Temp\Proton Technologies AG\ProtonVPN\prerequisites\WebView2 Runtime\go.microsoft.com"C:\Windows\Temp\Proton Technologies AG\ProtonVPN\prerequisites\WebView2 Runtime\go.microsoft.com" /silent /install3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Program Files (x86)\Microsoft\Temp\EUA090.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EUA090.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"4⤵
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc5⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4200
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4116 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.181.5\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.181.5\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:3052
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.181.5\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.181.5\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:4552
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.181.5\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.181.5\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:4948
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODEuNSIgc2hlbGxfdmVyc2lvbj0iMS4zLjE4MS41IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0ie0FFMDQyNTRBLUJENkItNEQ2Qy04ODE5LTMyODVBMjRGNDIzRH0iIGluc3RhbGxzb3VyY2U9Im90aGVyaW5zdGFsbGNtZCIgcmVxdWVzdGlkPSJ7RjlCQjU3QzEtMUYxMy00NTAzLTgwQjMtOTYzQjFEREE2OTA1fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xNTA2My4wIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjE4MS41IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NTAxMDMzMjQ0IiBpbnN0YWxsX3RpbWVfbXM9IjE3MDMiLz48L2FwcD48L3JlcXVlc3Q-5⤵
- Executes dropped EXE
- Checks system information in the registry
- Suspicious use of SetWindowsHookEx
PID:2736
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{AE04254A-BD6B-4D6C-8819-3285A24F423D}" /silent5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4136
-
-
-
-
C:\Windows\Temp\Proton Technologies AG\ProtonVPN\prerequisites\ProtonVPNTap_1.1.4.exe"C:\Windows\Temp\Proton Technologies AG\ProtonVPN\prerequisites\ProtonVPNTap_1.1.4.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
PID:2956 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\{87BDF456-9882-44E6-8FFC-F73B83E42EAD}\3E42EAD\ProtonVPNTap_1.1.4.msi AI_SETUPEXEPATH="C:\Windows\Temp\Proton Technologies AG\ProtonVPN\prerequisites\ProtonVPNTap_1.1.4.exe" SETUPEXEDIR="C:\Windows\Temp\Proton Technologies AG\ProtonVPN\prerequisites\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1701865551 " AI_EUIMSI=""4⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:2756
-
-
-
C:\Windows\Temp\Proton Technologies AG\ProtonVPN\prerequisites\ProtonVPNTun\ProtonVPNTun_0.13.1.exe"C:\Windows\Temp\Proton Technologies AG\ProtonVPN\prerequisites\ProtonVPNTun\ProtonVPNTun_0.13.1.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
PID:2084 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\{B1EBF050-CC3E-45B0-9DE5-339C6241F3DA}\241F3DA\ProtonVPNTun_0.13.1.msi AI_SETUPEXEPATH="C:\Windows\Temp\Proton Technologies AG\ProtonVPN\prerequisites\ProtonVPNTun\ProtonVPNTun_0.13.1.exe" SETUPEXEDIR="C:\Windows\Temp\Proton Technologies AG\ProtonVPN\prerequisites\ProtonVPNTun\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1701865551 " AI_EUIMSI=""4⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:4180
-
-
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\ProtonVPN_win_v2.4.3.exe"C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\ProtonVPN_win_v2.4.3.exe" /i C:\Users\Admin\AppData\Local\Temp\{5D0F40C5-4278-4AA0-A06C-7BD24B088624}\B088624\ProtonVPN_win_v2.4.3.msi AI_EUIMSI=1 APPDIR="C:\Program Files (x86)\Proton Technologies\ProtonVPN" SECONDSEQUENCE="1" CLIENTPROCESSID="2028" AI_MORE_CMD_LINE=13⤵
- Executes dropped EXE
- Enumerates connected drives
PID:1248
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3928
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2420
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4588
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
PID:924
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3324
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding ACFDF0C844561DDBCA29D22ABF247C96 C2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4208
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7AAA16EF4364D7706C0097D76FA0C9E4 C2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4456 -
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\ProtonVPN_win_v2.4.3.exe"C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\ProtonVPN_win_v2.4.3.exe" /groupsextract:100;101; /out:"C:\Windows\Temp\Proton Technologies AG\ProtonVPN\prerequisites" /callbackid:44563⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4860
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3193330E96C9379C959278C2DF547972 C2⤵
- Loads dropped DLL
PID:168
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 91E9594CD34F115FD5B490335EC868562⤵
- Loads dropped DLL
PID:2064 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI96.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240779421 15 TapInstaller!TapInstaller.CustomActions.InstallTapAdapter3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3372 -
C:\Program Files (x86)\Proton Technologies\ProtonVPNTap\installer\x64\tapinstall.exe"C:\Program Files (x86)\Proton Technologies\ProtonVPNTap\installer\x64\tapinstall.exe" hwids tapprotonvpn4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1396
-
-
C:\Program Files (x86)\Proton Technologies\ProtonVPNTap\installer\x64\tapinstall.exe"C:\Program Files (x86)\Proton Technologies\ProtonVPNTap\installer\x64\tapinstall.exe" install OemVista.inf tapprotonvpn4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:2208
-
-
C:\Program Files (x86)\Proton Technologies\ProtonVPNTap\installer\x64\tapinstall.exe"C:\Program Files (x86)\Proton Technologies\ProtonVPNTap\installer\x64\tapinstall.exe" status tapprotonvpn4⤵
- Executes dropped EXE
PID:796
-
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding ED738F6214EBF29CDC2D8180EFBF320A C2⤵
- Loads dropped DLL
PID:1020
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6B57295C0E757EECFA5B3C38123A48E32⤵
- Loads dropped DLL
PID:2876
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4152
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B278169BDD8F0DA23134B3CCBE026CE62⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4088
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6D7155B2A5348DAE42AD959C8827A41D E Global\MSI00002⤵PID:3600
-
-
C:\Windows\Installer\MSI9F1E.tmp"C:\Windows\Installer\MSI9F1E.tmp" /EnforcedRunAsAdmin /DontWait /dir "C:\Program Files (x86)\Proton Technologies\ProtonVPN\" "C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPN.exe" /lang "en-US"2⤵
- Executes dropped EXE
PID:2784
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:512
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
PID:4620 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODEuNSIgc2hlbGxfdmVyc2lvbj0iMS4zLjE4MS41IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0ie0FFMDQyNTRBLUJENkItNEQ2Qy04ODE5LTMyODVBMjRGNDIzRH0iIGluc3RhbGxzb3VyY2U9Im90aGVyaW5zdGFsbGNtZCIgcmVxdWVzdGlkPSJ7QUVFMzUxQ0YtNDY3QS00RjdELUI5RkMtNzZBN0FFNzQwMDg5fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xNTA2My4wIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIG5leHR2ZXJzaW9uPSIxMDYuMC41MjQ5LjExOSIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjMiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU1MDU4NzcxNjMiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Checks system information in the registry
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4432
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D9233689-ADFD-40B0-B476-1ADA0E6E1E97}\MicrosoftEdge_X64_120.0.2210.61.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D9233689-ADFD-40B0-B476-1ADA0E6E1E97}\MicrosoftEdge_X64_120.0.2210.61.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Executes dropped EXE
PID:5100 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D9233689-ADFD-40B0-B476-1ADA0E6E1E97}\EDGEMITMP_1A8B4.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D9233689-ADFD-40B0-B476-1ADA0E6E1E97}\EDGEMITMP_1A8B4.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D9233689-ADFD-40B0-B476-1ADA0E6E1E97}\MicrosoftEdge_X64_120.0.2210.61.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4108
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODEuNSIgc2hlbGxfdmVyc2lvbj0iMS4zLjE4MS41IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0ie0FFMDQyNTRBLUJENkItNEQ2Qy04ODE5LTMyODVBMjRGNDIzRH0iIGluc3RhbGxzb3VyY2U9Im90aGVyaW5zdGFsbGNtZCIgcmVxdWVzdGlkPSJ7QUQ1QkQyREYtQ0RDMC00QTlBLUI4NDAtRkU3MzMwQjc0MzFEfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xNTA2My4wIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMjAuMC4yMjEwLjYxIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NTQyNTU4ODA0IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTU0MzMzOTk1NSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU3MjQyNzc3MzAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzRmZTgwYzlmLTgyODctNDcxZS1iNTEyLWFkMWEyZTgwNzVmNj9QMT0xNzAyNzExMDU0JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PVIzMUFIUU9PT0w4Z3Y2MmhmV0p0WXpYMVhPamVTSENFZDlrNnB6andaajJaTlVha2slMmJVcGZWZUU2VyUyZnlQJTJmN0V4JTJiRW1EQ3hyajVCSXpVMGlqb3lCR3clM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzExOTk5NDQiIHRvdGFsPSIxNzExOTk5NDQiIGRvd25sb2FkX3RpbWVfbXM9IjEwMDYzIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTcyNDI3NzczMCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU3NDM0OTc3OTEiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjYxNDQ3NDY5MDciIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIyOTciIGRvd25sb2FkX3RpbWVfbXM9IjE3OTg1IiBkb3dubG9hZGVkPSIxNzExOTk5NDQiIHRvdGFsPSIxNzExOTk5NDQiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQwMDYyIi8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Executes dropped EXE
- Checks system information in the registry
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5024
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall1⤵
- Drops file in Windows directory
PID:4856 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{cee48a82-cfea-e54f-aa12-fbe62e57a474}\oemvista.inf" "9" "4334ff507" "0000000000000178" "WinSta0\Default" "000000000000017C" "208" "c:\program files (x86)\proton technologies\protonvpntap\windows10\x64"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4060
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oemvista.inf:3beb73aff103cc24:tapprotonvpn.ndi:9.24.6.601:tapprotonvpn," "4334ff507" "0000000000000178"2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:4460
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:5000
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc1⤵PID:4820
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2520
-
C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPN.exe"C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPN.exe" /lang "en-US"1⤵
- Checks computer location settings
- Executes dropped EXE
- Registers COM server for autorun
- Adds Run key to start application
- Checks whether UAC is enabled
PID:3312
-
C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPNService.exe"C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPNService.exe"1⤵
- Executes dropped EXE
PID:4552
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Defense Evasion
Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5c43ea1c63715c4ad9ffd0653d7b0a26f
SHA18ad63640ba4683eb861711762538df5224408f03
SHA25649589d00934bd114f2589a09c1bce65dee10361bb2365f575b930d2f942aa584
SHA5122301bb93190cb04f324cb63911ec85079d7adba144d97e6332ab916a50967095d53398ba798eb24ce66461d4f115f3f90021e2d4295d29ec5878701c5d493f85
-
Filesize
9KB
MD52c670fc4df468bbc48fd1e2ab34271a2
SHA19ba6a148666cd3b42de00df698c306a917a9218b
SHA2566ada8c89b943d953170bd07e9e591aaf9046c73e4fe35ec028bbef9ddfa3dcbb
SHA512431efee7e58e3cead1ede5c2ea4233706df09a65e91b2dad38a471bd9f54a6a00d3e25ddc3817e3d2c08323d4c77964f54b9e18f2eec0c4f2c976a894e2aaade
-
Filesize
3.6MB
MD55665d11c95b73a1ba1eeb659d7ec7076
SHA19df074234a4a9b2d6824a456e4d88fc0667aeb14
SHA2562b27e96d4ed3b45cedbc98fa4700d2fe12f83e63af809ad7693164ac7b02ea70
SHA512ea0a3be8786f8472c1359eab2c9b9bd3563566cf8b4c6e2ab5162c91f58771a217b42c1d73d1a9154dba4053c3ed3b723bdec22881714a514ea61daa3ba1cc4e
-
Filesize
4.4MB
MD56f24e49ad578ec811279b84fddd19863
SHA1b2e7362d1c53cb9802c94932df33e39dc6c3e960
SHA256021845f3adc3a0d5b9297ecfea071b3c70e0ebe401c030f19bb546d8cbd6d42f
SHA5126feb690b4ffe88a9164001fb9901806a6c373b2a3388c3e7a9bd9e0765586ed71345543c58029f25d5968cb18439da2d94cfbcf582dd43112cb3d51f8d692790
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\120.0.2210.61\MicrosoftEdge_X64_120.0.2210.61.exe
Filesize163.3MB
MD5e940341ad8d29028191ca451c5784df3
SHA16d58dba71d3e61b24b017c7c457ad9de2f4ce71d
SHA256b63037fc739a687509312f20cbeade2c3e4e457a75dac0fc6e83ae8c993162b4
SHA5123c6a5ebe64ed36bffce84959b15f0aac0cad23a834f8ec060c25fd59c1e0354789bbd0655cfe2bd02519ade85dbb37d5ed70ae574241a80c1cf7883c2d9bcd14
-
Filesize
201KB
MD511fe091ace9d03b9ada6d5a22d12c0d0
SHA15379ebe84500d425586904e7f9ac0393ab2a9d24
SHA25650f4ed60a507ce9dd1f3f4e7d53053d923cb71594374a25251746a9b2271e4ee
SHA5120f39af99697332c697ca62e2708e0a9200552a55f2d3057b64e9b18df2fe2828be750b14b5336ac9518b4c1282e82cd170b64587cf56b45b840ca231108b7fdf
-
Filesize
12KB
MD5369bbc37cff290adb8963dc5e518b9b8
SHA1de0ef569f7ef55032e4b18d3a03542cc2bbac191
SHA2563d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
SHA5124f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1
-
Filesize
179KB
MD59540ad83a08605ba1f52196424ce3067
SHA1a533eb61319bce1720b55d8921691323a4178c3d
SHA256b0b5d9eb6f4b176bdfbe4da0a060ad1b76c813186fae3d9a6e1b1dd9ee0d01d1
SHA512bb00ee12c353c9deeb8105399b2a956343e4a1c13dd1198d0f481c4f699099a34ede80f15bb4efa9a1f68c2c12ff75da163b48bfdf30353d5ef5d4bb7c174493
-
Filesize
201KB
MD511fe091ace9d03b9ada6d5a22d12c0d0
SHA15379ebe84500d425586904e7f9ac0393ab2a9d24
SHA25650f4ed60a507ce9dd1f3f4e7d53053d923cb71594374a25251746a9b2271e4ee
SHA5120f39af99697332c697ca62e2708e0a9200552a55f2d3057b64e9b18df2fe2828be750b14b5336ac9518b4c1282e82cd170b64587cf56b45b840ca231108b7fdf
-
Filesize
201KB
MD511fe091ace9d03b9ada6d5a22d12c0d0
SHA15379ebe84500d425586904e7f9ac0393ab2a9d24
SHA25650f4ed60a507ce9dd1f3f4e7d53053d923cb71594374a25251746a9b2271e4ee
SHA5120f39af99697332c697ca62e2708e0a9200552a55f2d3057b64e9b18df2fe2828be750b14b5336ac9518b4c1282e82cd170b64587cf56b45b840ca231108b7fdf
-
Filesize
212KB
MD57750d94e4719ba69f5f83213444c0015
SHA1f2d49b2d5c3bb372a5c74513de0744f2a5f3fe5e
SHA2561ab31694ff0b6283fbb6ec062d6eab9ffb26df9d6d1ba140cf60a8e7a4cb9fe5
SHA5124aba2ff17870e6e20fbcfe8d31036d52d9b2ae9df1013e1140cdf321bb4da0a8f5cdbbabfbee758cd2f2bbe2a3b10f25351f9e29cc5f5d91baea6dce2c83e714
-
Filesize
258KB
MD53fa9ae698a600ff3422995504cd088c4
SHA1bb0b798291c7e37c514d8fce11b8c777d13a6b2e
SHA256a8e1533f87ac5273f908fbb67edb786f231fcae44b49dd5e6ceb3c777c1f01a9
SHA5123dea12c2f30fdd5cc4125de40ad26c9f1a69abe8505c863b1469f47349d79f2b51ab037009e500291085366abf0ee2b24d16a3eb419b715894b924af656d2b04
-
Filesize
1.5MB
MD52fbe10e4233824fbea08ddf085d7df96
SHA117068c55b3c15e1213436ba232bbd79d90985b31
SHA2565b01d964ced28c1ff850b4de05a71f386addd815a30c4a9ee210ef90619df58e
SHA5124c4d256d67b6aadea45b1677ab2f0b66bef385fa09127c4681389bdde214b35351b38121d651bf47734147afd4af063e2eb2e6ebf15436ad42f1533c42278fa4
-
Filesize
4KB
MD56dd5bf0743f2366a0bdd37e302783bcd
SHA1e5ff6e044c40c02b1fc78304804fe1f993fed2e6
SHA25691d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
SHA512f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e
-
Filesize
2.1MB
MD50bec55833f356f89b8d9d63727ddc43e
SHA18dcfd2b8292ab7a585a8a4e40d61b81c96b63f5c
SHA256b360afadecb2334ba103d515c506e792cb9aeea5925a6cf85dbfd786a225ffc3
SHA5126592f21800f91474d2ade6102a0d0d36097e5552278e5aa390e52dccc838b323f9a4b89b6c879c56621d0de84a9ef054f695a6fdc267c9142a3d234bf3a2460c
-
Filesize
29KB
MD5ca3b6944f47fb398e4656d7076e3d247
SHA1592c966af88cb9fd39250d917fe4876bb213d36b
SHA256d1d58d338db2f0f885d7e945613c2e6b98ce02534a2635c392cec04e8c8b5f71
SHA5125be93716c178401e809aba922b05abfe4c6585ac8544ba6fde1ae16af87e571ef28d51f8d71946d5acde96370d39bef8d85349677de16b3e8009ba3f57802b46
-
Filesize
24KB
MD527b4625745b0d9036faeef288dcdc71f
SHA179e2e6590a0f4b6af97796058595e8df77bc4b8a
SHA25674fefc1ad1bca85ae3cdcb197396568e9ccdc3de9095cc3e787e6e28f9a04487
SHA5122f4e0c4478a244c3b1632f282c7522efbe9b2f03d6a8bb600f0d833c61fd74d7bab32683b1c0e40e58b2d30640cbf6e9b28c03b179e168a6cb7bd3512bae3f2e
-
Filesize
26KB
MD507b160c1fabcf30a0e3e907f1b12177a
SHA1c5435df1d9bc93ac87870c5d8894de8481456de9
SHA256a78619b34f4566ff3fa834111d6f02fdeb5e82ceae2167f51a85aa902f4ad2dd
SHA512cbf2df29701b0dda648f2e208596c691e1caf97d2e3314749b6a3ad899cc057f66cedbbed4d6362b987173a925e73ea266d238c9d985d03b7ffd5c32b0d0b3c8
-
Filesize
29KB
MD50e38b9e9fde2583f8dbb61f2522c1996
SHA19e6a952387380bcf54dcc9d040a2d9051a63a1f1
SHA256ea9786491db2b6548e3c935cc4f8382fb1534b3b67dde1ed6b9aa003c9a7152f
SHA512f17d95eff5b23d2d11f161a66ef67c61c34c0190ca7d11d8e30f4504f5ecfec87a02fd474a08061433e8a431d78ed92fa9cc087863f3f4caeb2b5616949bc11a
-
Filesize
29KB
MD5ea96f65e817ac6899d6732cd880f744e
SHA10fde259d82e3c300ef2461e660208fdccc339e64
SHA25606bfc34d181852321498c49fad36701a5f854ad6e5588af9e141a5cef838165f
SHA512f79099fae7d98b9208aa5be96f28d9855c5e81cd9dcc5874ed2e41c8b720f32e54fcfdedd44e075892967768f42833f9fd99657096ee10af38d3b663d48bd603
-
Filesize
29KB
MD54328bf6228c408cae033fb4acca65640
SHA1011fd7ddb7c4551abe683cb005920d85cf3eb10b
SHA25673a10a15a4be54f85e4103a994c8a628c34034d085c40627fb4f18b499379de8
SHA512a50a74fd675ed3b791bfa5a93ca9f910c5a9052e9990de0132606779a333007d305f4fae1ac9f193335cd8207a17b00e2848a87aaa09e7900df189103fa0cd92
-
Filesize
29KB
MD5c4457c581afbf9e1903fb309d8d08bf7
SHA1fc52fd6cc2de7405ac69674f74cbef43c92c5295
SHA256f409b1cce73799d3ed0fbaab72c3331cc597787680e2fc9dcd9e2803f62e006e
SHA512b8bc722dc801a9c50a972dc9ef5ebb31b43bcbc7d12cb84d0b3e64749781818963573f0bafe646160ed9edac5db5b72d7968d3e5ff908da256079e8dff4ec2d0
-
Filesize
29KB
MD54ab2b866301da9ffd1a2d9e1d2828698
SHA1bf49d684e192f14f96ab03dd0f8d9e5817a0f1b8
SHA256cfffd594b203016e13fa74c5382c1c6b46f7d3f0817eb4d649feaf3350a401f0
SHA51260874a1c999e646a11217b3d0c68af03b7b2e1210f65e8e922a2cd8741bcf1e687bf74b97ffa0082962df2f534fc4c2ca9c28c4822a7e2c50474810e42de9d24
-
Filesize
29KB
MD5139d647896af07432b0c810977139fdb
SHA127b2f2915acfb3a740c958282deb2f418df83d49
SHA2560f3d5ea311f13f94b8c0f9bd6c8fe8351ca85a9e92d96b3ac3a54e87a2167833
SHA512cda3135620409f12fc7ee77c53233af4e64ea4a7e3a7b2af3534b015b410221e500a1820cd5852236236ca8820521072eba4128efd6316e1bc7863360c07baf7
-
Filesize
30KB
MD55801a2b7df808227d967d2e0d147fa4b
SHA1dbe2844fa8bcbebc227b9817bc0ea8dcd1634b13
SHA256cc02b8e56ebe97d640eb3241d6dfdd76c36d8ad9dc6fd70c11ed6a165f87dbf0
SHA512b6f77f1284a05aa4d9e69b2f459691f8bb79466242c13d1bf011d4edd6a43e742b4541ecfdd4d7aaf7b6e72b3540d41ebfd6074086ed1a4b56ef6b852d91ba0e
-
Filesize
30KB
MD59cd4f750ad9c689151ca0a278c3774bf
SHA1cbe0a7601db4ce0aded6e18c9647750a4e03a8c5
SHA2563569e7eafe649d9b4e0fbea1db33d4a7e6c350e4031f9ac40506df4828892b0b
SHA51238e723fbcc1ae59e50d8f8ffd53cf77fd32a64686f24a0670287c25dad7fbe4852ba968f223cc5936b2a1af453e5d2d5f3cc190e07ee0a78c55f88a0c3ecb940
-
Filesize
28KB
MD514fcd6216e82727e0a757f0f6a04701a
SHA1ceb886836ad9dc04b2758271d55cab0f6c6146aa
SHA256777b0583744a3ee8e32586262d34a3d231482504f37d1b0679e1dbd1e10bb854
SHA512e963ba587017d3e579f3839a0fa0fe5be659cb749629a5b98e7b02184e811a943ac18d66c927ab45c54869650289ec6e3a9661ec40532fc2ae578a5fb15606f9
-
Filesize
28KB
MD5d082255c15ca45655f999c60c7e44653
SHA1337bb7b65c8db5305814fa8046da0d790c5cab59
SHA25631c054f8b4c974d6ac436ee21828121f600a1dde0eb5bb8c7fb41c47ffa9563e
SHA512662db73cfe28995149aa4a3d2f877fd7b9a027a4f322be9ee6ffb19b8aa4d97ce3ea1fcc13c85c28a9ab815aecca1b0baa69109f20cfa73a46cf8c1be586dfb1
-
Filesize
29KB
MD58355353da56dd6ba036eeedbb10ffa68
SHA13e20c8f35cabebd04e7162b9567fd3905174127d
SHA256678888dd82f5cb04b5727c56699c70d442b35ac65338bbe9ac45ed8d2a32acb9
SHA512000d0a8648ca4e8433568efc422f3caeed7c53e764878aca11f8b7405850863f8a7bea4a97fbb0076db961d3f09646a00bb3eaa0e4e3b81d949ac2aa033b0827
-
Filesize
31KB
MD59e0645c2970492f18a9c16d053ae47cb
SHA1c91f0ee7dc0dc0213776728b152a5c3597b8e1c0
SHA2567bef8830bdf0fbc8d84d85946a28cafe05fc47528741bc11998805982a3b421d
SHA512c4277b7e7652bd342dbda6d2d22acbaeeb9ec1321cd91ad236575d0c8f504220736218711e91f0984e3d2f06652101f52aee123163d7bf3cd173c7ec2d1325cc
-
Filesize
31KB
MD58b692911c2eef0d2e2fbc8ee84c39e03
SHA1b5f558a2cbfee2dcf1cf5f7e5dd229309f5bca1e
SHA25668ff5bb5a44f019c7c8a50cbf9ee0af264b4782e6516917b4760c0b05d247161
SHA5126a4118eb9d1bdcb4031db82682ee919f62d575dc765ca0a65028bd31c8bdc061155bc2139318916b3be3572b6a3656d194e3a925b5711241f436267a9af1109f
-
Filesize
27KB
MD58ff46334ccb442dbdce0b04e84cc6364
SHA152a7dfd39529c0669d8fe72416876bb2b241741e
SHA25647c08c6be842b50d119c4921ff860bfc1739efdb017de42c1247bf0fb5c1e254
SHA512b23b74b2c7f76abb613630c888eff8ec2fe6c28138522ebed478f6d55e21917e658f269ef0d6014e8778225b81e2839cb965a1ff243b5639766bdbcd52c28f47
-
Filesize
27KB
MD55d365ca4dcb28432aae57e60dfae29f7
SHA176150d3ae3070e10f378df87e433b1324f5f008e
SHA256990051016c4d565d20167c62be48e92ecd840231bd0ff21838d105cbea750ed3
SHA512f46fb26ef0ce04eb0655cd4ed769b5af055ccec0a15cacc25c9bdd6e3c3a4ca501164e5093eb7381d00ea28a3be59e69762ade995a421c7ce8b1944fd2446465
-
Filesize
29KB
MD522b0343d2498e2a0b9d4168d480bd6b8
SHA1d4dd3b497b262905788c7abdc791af1cdd80c6a8
SHA256094dd4e1d9cf8114145c254372b0ac20f6593f16f7b53e02953bd21bbe26a4f0
SHA512970fd6cb5fa68e2e12a6288b00250a3c400939963298bfe7610edced53036990c51edef7f5054c371b12eb992ce8e05b1eb7af4d9ba61e0af41096a9ed64957a
-
Filesize
29KB
MD517006114f71cb462041e1ec50a952047
SHA13062f6d33dfa215b18492a3e0a2d0fdf41a08429
SHA256bd195bbeb179e478cd1dc4bab518568edd65603e3d33b11b3298ccd1995b183f
SHA5125d7fe67bc1d6e22c9e7c13df5a5b9dd039eb77d94b991908a6e23ae703295d2c857b38799c30b40cdb2f3bf503f951de54e11fd65e6f482bc184ffab54ff443f
-
Filesize
28KB
MD5e4a76fbf2d73c51f37bb96ef5b76ceaa
SHA15bc9a30d11fae80286f0a73db5900e9b2a94fc30
SHA256a1c067279ba80bacdd975117ae5e6aad9923b3138340d25d08742163107d7313
SHA5120b4751d5a7914daecc8f0f620dff0228bfe1853af901c6ec277656f3c568d916bc1e1d22bc737ee3f54107fca6ded731c73e80147e34ce3b81c276f8b6d2b2e0
-
Filesize
29KB
MD5a5824f125e7c5a363618e10eb166cfa2
SHA1b9265cee687f031f52eb6cfd6ffacd728f7c9c71
SHA2563fe2d705da261a98a8cb375d59ff98b0552b61e7c57132d46126fe4646b2cdd7
SHA5124b2c4fc806097320a56c2547d2962f21e99e6e17a211cfd9aab1a7845dce78d958ab6a03481cb2a827ab233afb2cbcd059bc6e211f8951c1a2e3b7ac51825b8a
-
Filesize
28KB
MD596e70c3aced49e26c5938bf5ec7e7a7f
SHA15fe35ee220c39cf8cad8d434b49ec31fa3f729ba
SHA2565f8d8a9d207108426a3f4776786c4a7b5d70db237ded870b9a7ab191602fd83e
SHA512af6f420164c2504a6c0fb3b62c89790dc3e08ae0b847e0a888c2c793aa6198134a8c18914fa0a5f3153dcad51698cb7125d2c90ae68de221042cbb97b7f8b78a
-
Filesize
28KB
MD55ce5cf921d0e522b8a05efa79031cfde
SHA1a081d73ab637ad63831b0e05d0122e8e9036a41b
SHA2566d049ab238bffbfaa0408460f3d76bc23bfd62ccf57659beaa81346e2dd69e98
SHA5126ef468f6f6b6186fee208b3101c089a168bfc286fd7a84c220a72be085744c70b30a299cbce1bb0c25689da1f348552322a6451277be604f211017ce6d16f989
-
Filesize
29KB
MD54bfe23c9930f814f7c9d977525cf2046
SHA13a6147006bd805a33d7caa647e8088a257061781
SHA256a9a40611ddccf179b8cd342c07d947af951f85072b598b5332ca772a5ce7729a
SHA512a235eef64580b8922e5f507f9bb2080800dcb4ea6b156150d2266748ebf38c2eb1e39342b01856ebd9e63b6e89c2104b434e444277dfe03e549293c928cb89bd
-
Filesize
30KB
MD5e22edad44e45a6e1da46e0afbb318052
SHA1d35c28b112fc386c6f4c52e4faa2ed8a56a4f6eb
SHA256a7a163fbcbeffbfd4655e41d162817a56b8da8b679b139a04961e830ea5ad05a
SHA512e750271aa41b402a5682f6863e95756c91afcbd5a994453280c7dac3973da3ecaf0fa0689b962cadab492ce90d510a436bd773c995b93ff6b40007371cdd2713
-
Filesize
30KB
MD586e02140bd5ea5090460ab7ac5c5cf08
SHA13cc00afb1b108b2247cc38211b64bb360c1419b4
SHA2564edd7b2ec1438f6a5d56eb0b7fcd7a42f2110eaf57439283afe85f527f9c1574
SHA512a0e6177a3791e59aebcc960cdc2861e10b6a20e0169940f219c92cccbd4827afc47bbd94a5629d25a9f2d547e8e2094a3c96aa55a1bc3fe9b744c07436359e95
-
Filesize
29KB
MD5912713dbc1bf81366497d2c10ba3783b
SHA1cd42a85838ef70f72c2faa5a149bc6a904f81585
SHA256f4b3c90ab375d5f465e2abc2bdff37fc41e4a1ed44ebf8370cd9eba7408fb586
SHA51211b2b1b726b314a725d24fa3c8b85f9c05a1643ae768adcad4b7006870b728db8688cf708f355ed8ffe2cbc24fb874dce2dbad86231c045b454dbcddfde35225
-
Filesize
30KB
MD503cf202f9262f42dff2b35987eed7c95
SHA12ccf4e4b8f55d61032048101c18a4b6cc7b6a087
SHA2566f033953fdb5ad272ddf29299577a4bb8d9a53bda4b3d8ffffd8d56c542c2c56
SHA512c1d65b8457fa2b0998aa6500b585c14e177154ae5cbf08cbb0ff0fd7a1d82e31520f4bee4ad20badeb91784501057b1a968c7d7d8415a2f7683f1a434bbca30d
-
Filesize
29KB
MD5e2bc2cb179b0758f9deda1fde5f60ae2
SHA171367f007ab0daf92d954b7e86eae037ec2fa8f4
SHA2566a2342b270f775433bc77f9d48ab8f71b221c3cd60d84e893314bebff19c4801
SHA512ff3a3afdf1780d6351306c0e00fedb59c020de68499005726e57487e9c5045636e59baffa487ffbcecc95f9bace000f66d1c3bf3b107e309e3cb522d45dc7b7d
-
Filesize
29KB
MD534b01daded37b4003b71c63712ff2577
SHA17cf99924ab19d94dca8a51d00f95ffc29b9f8e98
SHA25611ffdf625eb3de49818a1a6288e9d7a60f4f3c8951b163eea84095ffd4ff871d
SHA5126a865be6b2c5103db06dd14777833bd4835f10c2a282c5edd43325fb0c1669fac875367f4a4f3d98c26c55449682ee406e7c882c16d9f48b41f3be533d82f161
-
Filesize
29KB
MD51b10182ad3f07c112f26fbd9f7a43848
SHA1b9b9b4bc37a9dc1f9a9cb11df44583594d72f6e1
SHA256381cbc579d5200ed6725a0dc149dd04703d157ae793d39be130d68eff7109c02
SHA5121575d4f0f756aa5bee99c0b1f60ebca946abfcba08b180b13eb9fd966b05c44cff94ee2db6b5fa7025b5f0247f06d5bcec3c790a20c1086a59933aa7e5cf7097
-
Filesize
29KB
MD5e03b903ae9e8a21ab7e24230c05ff0f4
SHA16c9b3354c0b5a96b7f062d94bf874c67ebbe4c72
SHA2569fbff63d4b7dc5e94958bf657321ff8f93de76394f78ed679863072d4ed3062a
SHA51231b7322288802c58e7b287605bae0899bd4bff0b3b1c1daa2898ed32453b5e8d0d4d5b508c79c6236e924a23d61321981d80a80929dfe875bcbe6fd0b4400b04
-
Filesize
29KB
MD5c4404953c519113d70e8fb19ce4b23dd
SHA1c01ab7651ab1e3ae24f146ec72bf53d64001e14f
SHA256e903ef5c4ba6872159e21dc6f4afa9a20113868cd99ddb8857369637053c3b05
SHA512a575ba69f83408b219a6b3b63e031fe37d691de67e9b069daa43091b6eee3089100c1f15d34c36f0a40e086d97568866386d52cf60f0160296ea2db745b8c567
-
Filesize
28KB
MD5cad5e407dc341f661f3675c821807c84
SHA18581e431be8308b4a0746719898f66a2e4efbfd4
SHA256df5d8fc7010fff00081f71f3fa2f8a384f45f077caa9afb066d45a070308581e
SHA5126fcaf91c27feef117430a185d6189bdeb4c438186e4307a6c91c43cf9584c236b93ac04fa549eeb7f63e13494e30d58fd295068d7572cbe8beb438666a4fcf4f
-
Filesize
28KB
MD5fcf71fc0b6f12c6d3ccb03418228a538
SHA190afa2cabc9eda94a7d01689f605e59601481cf3
SHA256a3b8c23468dec69532ad374b9a3475e552b941d965ffcbdc6de0f23d58baeab4
SHA512ca804da85ac67fecd46a5820328f5f209ba08e3f2ef587ce1021754928de36f14f47fe08ddffd729d1d0ff64d5c7dcb0d508818248ceedc5c83fe0a6017aa031
-
Filesize
30KB
MD58986d1d9e5fc10d99a45d00f2858ef5c
SHA149102f4cfe2dc62ef633fee73678a16f8c06c136
SHA25664576a5588c0facf99197d055c9a6a9b0db9a25c5601087b94407dd79fe44ce4
SHA51230a094bf7d0db33d54581da8708f5f19cbaabca041e7e559b849f9581e22b8d3415093461e33fe7091acf643e02847c6edbd71a107f462f0057a4e9018266f95
-
Filesize
25KB
MD5785d4681543392b616bcd95e52da7998
SHA1d538f78f7323f50d01f2765432705ff30ce47930
SHA256b05c9c1312c869cd6ec5682372bfb01b3e52a60a01ab2fe68afcd6fa20a8cef7
SHA5128031fa240100e6fd6721affa3ca37e6d88b6341b51d299f03736c31c67fcb2e3c105ecd8f27a6570e69a60616008c9868da424615f035e3d25a89cf95e63e622
-
Filesize
24KB
MD5ad20644a4ef8b16c043d4c1b68a0e771
SHA1d1bd42edd650c3141a58c6ff0aa858709b7e0258
SHA2567f2eacecbcda9339249b386ce8e23611e94d2fbec3d90121569d6f1cfdf6f9c0
SHA5128cf2e34a23f99bf8c37bd5727c8ff6b7666f7752427df8b05d8d82e5e7d97786b4ecded4031bde32d91e46627b169e8d31b2bdd2119c6b755731a787364c0e1f
-
Filesize
8.5MB
MD51f210fe15f81c021ac24b3c71eefb3a8
SHA101c2d67d65753ec06c13f452a11e01574ed37fbe
SHA25616e5b27bc049406d0b67429d220194bb3b5c669954740fb27ffa81be1740f394
SHA512ec2aecd9f9f1106a752a7e17ae6e6ee0ffc8d0f1437775feb0be0ae2df27bedffb47ed7f71bf85f4109592a261ce77b1754d84e5a4f6b3d62c8d27b4306699d1
-
Filesize
15KB
MD5bfbd1ad98f108261ab9168cfba8e7eb8
SHA1bb479691b4d0964c46bde97295f3672e80b9273a
SHA256e73d8385a2148b3eb2d2b702b78c6cad92d41af096a1b1c99888bce745045e1f
SHA512bd7db0607af07832c5518d3478d8712f401de98ac0b6475223934076b7e2a592c6eab8bfd6327280f521665dd0109c94bdb043c786fe9d3d6a081bde2f1040c5
-
Filesize
4KB
MD51bfe591a4fe3d91b03cdf26eaacd8f89
SHA1719c37c320f518ac168c86723724891950911cea
SHA2569cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8
SHA51202f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db
-
Filesize
74KB
MD5d4fc49dc14f63895d997fa4940f24378
SHA13efb1437a7c5e46034147cbbc8db017c69d02c31
SHA256853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
SHA512cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\FYIAFPFP\favicon-32x32[1].png
Filesize1KB
MD5b8684628a5f9315b401be18ecdcc2de5
SHA13714b4f80009181d5d425a3db3699c1138c04625
SHA256fa4a10f905a99db0708bde22da4cd969df05b51362673ccecaa02f6ab693dee9
SHA512c227551d4d8599de6a0b119b142047905eb4a0e706204de062d5aa94b9ef42e44d9e4d02b37bd6ff1826e9261f31bec3aba4e50f7204bf1462f9d17e9e1f6f7d
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\X389GUIA\favicon[1].ico
Filesize14KB
MD5d9acbd4d72777f5ce75584190bcc1400
SHA1190052bd389aa65e9403b40658a13f3e1f130f11
SHA2567ef39ff01af633a71160fa9d81cab8407215a2dd9b48187ae9f3dcce11629d8c
SHA512eb42935ae956402e467b66630e268b8ef7649169b72785ab03bc37b49abcc9a1cbc6d3e48a6f6ac080f4e925ee3ed4041cf33c7de34d9178a4beb2a3e748b6a5
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF59DAB84B13371816.TMP
Filesize24KB
MD5d3cdb7663712ddb6ef5056c72fe69e86
SHA1f08bf69934fb2b9ca0aba287c96abe145a69366c
SHA2563e8c2095986b262ac8fccfabda2d021fc0d3504275e83cffe1f0a333f9efbe15
SHA512c0acd65db7098a55dae0730eb1dcd8aa94e95a71f39dd40b087be0b06afc5d1bb310f555781853b5a78a8803dba0fb44df44bd2bb14baeca29c7c7410dffc812
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\ProtonVPN_win_v2.4.3.exe
Filesize29.9MB
MD591b95fbd324658ac679bd79cb9426256
SHA11cdf82e0d13ae3304864a6c01422bf4eaf96563f
SHA256a8c0275fdd40b609d34b43ef7cb1f6f814a0f758d65e7562e24899caf66964b7
SHA512242f9bcd9cb270d528db2b12e799307d6d09f7117ee921e742c99e338d8283780b0f416f29bfa7a9977843a123682e4e67a656d0f37a0157456bf76b3247d671
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\ProtonVPN_win_v2.4.3.exe
Filesize29.9MB
MD591b95fbd324658ac679bd79cb9426256
SHA11cdf82e0d13ae3304864a6c01422bf4eaf96563f
SHA256a8c0275fdd40b609d34b43ef7cb1f6f814a0f758d65e7562e24899caf66964b7
SHA512242f9bcd9cb270d528db2b12e799307d6d09f7117ee921e742c99e338d8283780b0f416f29bfa7a9977843a123682e4e67a656d0f37a0157456bf76b3247d671
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\ProtonVPN_win_v2.4.3.exe
Filesize29.9MB
MD591b95fbd324658ac679bd79cb9426256
SHA11cdf82e0d13ae3304864a6c01422bf4eaf96563f
SHA256a8c0275fdd40b609d34b43ef7cb1f6f814a0f758d65e7562e24899caf66964b7
SHA512242f9bcd9cb270d528db2b12e799307d6d09f7117ee921e742c99e338d8283780b0f416f29bfa7a9977843a123682e4e67a656d0f37a0157456bf76b3247d671
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\ProtonVPN_win_v2.4.3.exe.jrkfk7m.partial
Filesize29.9MB
MD591b95fbd324658ac679bd79cb9426256
SHA11cdf82e0d13ae3304864a6c01422bf4eaf96563f
SHA256a8c0275fdd40b609d34b43ef7cb1f6f814a0f758d65e7562e24899caf66964b7
SHA512242f9bcd9cb270d528db2b12e799307d6d09f7117ee921e742c99e338d8283780b0f416f29bfa7a9977843a123682e4e67a656d0f37a0157456bf76b3247d671
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\U1VHGVHR\ProtonVPN_win_v2.4.3[1].exe
Filesize19.7MB
MD574bc3740d5e3678297feb19536dd2c35
SHA11fb7a1f7b63bf44064faa8553e1a0decfef8eccf
SHA2567b639a39bd1e8ea33494183eb4165c5946a1764d4d598e40efe46255781d9601
SHA51246afa37b2311973ad89816edb88aa61c2fddeeac155e9d6d8e146498df42f0952381bbd82243c3fa00247ffbc1df58c4de8dad36154e33e89442f70e4bcd3aa8
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\WRN5ASHL.cookie
Filesize179B
MD51751fed7ce7b65474559673153bac644
SHA1795324ea5c54613f6e1c4dac51e7e6a7681db7ec
SHA25657f69e027c4a440ed6b01e80995dca0cc5b4c0a4c3826ddd5d704b74a1dac8e2
SHA512534a26ce986e5bdcd8d6c90a89fccadc7a6bd2a1500cb2e47bb4bad1809374e0d698c2c2015035e5aea984273d82fe7b51146f79ecc68069534bc6f50c52ed27
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Filesize717B
MD560fe01df86be2e5331b0cdbe86165686
SHA12a79f9713c3f192862ff80508062e64e8e0b29bd
SHA256c08ccbc876cd5a7cdfa9670f9637da57f6a1282198a9bc71fc7d7247a6e5b7a8
SHA512ef9f9a4dedcbfe339f4f3d07fb614645596c6f2b15608bdccdad492578b735f7cb075bdaa07178c764582ee345857ec4665f90342694e6a60786bb3d9b3a3d23
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize192B
MD585ece6f88352bb164c0a06e0ca3ee6e6
SHA19fc4b08a2ce37edf4cf6bd7237e1965ba15d1b43
SHA25636dc36b2f4612b11fcd28a206c681be72079b8c34c6715a2904bb38d44385706
SHA512db1bebe6f3f16a2e01d0998e68bf5de24d9089a344449ed7b15484137eeb648227e44767105d5107408db469d91a200985ea1b36713dffa709e31407e72d2398
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\1ztz3dyu.newcfg
Filesize1KB
MD5d11b98c5cc57a1bbf42f322d97f75a5f
SHA15d664b2e8cecc7ae0ecfa830afe1f296fcf4da0c
SHA256ac1d889ed08c34203713aa0bba96a2295cbce529833993cf943ad6c4938d3e4e
SHA512cc7a570982473859561f0941d156d6877568eb9a10b62708902bec0502cbdbfdaba1abeb5bcd318f1c8491754b2d678a53a30b3041a50d7bd5ec235d3eed22ee
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\brkpdit1.newcfg
Filesize1KB
MD5a7126466592cac46e06c7e8820f1cd84
SHA110521fc04b10b4bf9f9c76ef2f200204b80d2341
SHA2567f4307bac152274d49cc05b48da02227a418d7b1ff20fefd7b60180841a100c4
SHA5127b8a3914fa73dfcbd53f26953d6519bc7aa56d4d9af6a9a56da4308e01712843da34e0c4f68017a53b4ff94663b924a3b990f3c16792c0f5972f77039c7c921e
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\cnpdncfj.newcfg
Filesize1KB
MD5a223125fe5e7a4cdfbb3024c1fd88099
SHA1712bd69a1055765e79cf66096c9461f5d8bbee84
SHA2569bf9ece7e57435f33dab40246894be05f46eeae8e7d0ee81053da8cf4b1607de
SHA51222ccc6134c99327bf503ce7d283825a61df911bb9a60d68b51130e1e051503bf440068cf702933650077aac5059eec6c995a86a05a40311f581e904104fa4a70
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\m5bekfar.newcfg
Filesize953B
MD522572f5e6bb3c364c3d3d7e0f2e9fb22
SHA15d3b9525d73110bb2562301d134cd1cdc5e85ad7
SHA256e7599bb6f794679997ec71fb8c271408d318b68ce8f1de017883ef0448c043c7
SHA5125bb41613d5715da65cdcdf6e21aba643814c6620b6d92e7499025359f025df0cf4a17a05ade722661b83fbe696304d083ffa5909be6e026793d5e9e963f2942d
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\ospkk03s.newcfg
Filesize1KB
MD5cb00f47a0605c127f4c66ef677a0e3c4
SHA1dc1574e06248a8fb32813222338252e753eef914
SHA256f7e88e50aab6c97ec453797bb799c2537d72f61b788e2c9ae2dfb49769a17cc8
SHA51256e9b521c47b02aefab8048cf3337cc2427cef82aa0201092ac3e76dcf60f25f7c4aa5b6a48b470a73197c075b30f574364719eecc6c69e0a6453af1b18b0319
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\p3dgjud2.newcfg
Filesize1KB
MD570e125b459ae3cc68b3f6ab5fa5704b3
SHA105487a23899426fc321e2e377f89da584bae5e6a
SHA256986bd27aabc5c731f5f0559d97d2b7fedf752e8c9fbf3ccde0d07d4835394af1
SHA512f8f593e85bbf130e65dd98e4b9f001325ba7b3cbbb69df2440c09e5a1b243a4825bc8f995e0caa2eec199ff1897f06cc217a68d9f928cf59686d7685bdd799f7
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\qev1m0go.newcfg
Filesize1KB
MD56e757b57a62dcca34e3c1648bd03211c
SHA12a77c3b27f5c2fd7dda2f9cef1663c47a0262b00
SHA2561b15523a1739b72a0ad036c8d9f97fba32375441d5fe23b8b8d1ac812c6a89e9
SHA512b054bf4919c8eefb43649989822bf0a993b0f33b7d07a1b548a75679e0305dff853d299dd34ea9aa1364f86bff74e5d63e2a56bea0aa6448e2a37d13a8f1aac1
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\srmcirfl.newcfg
Filesize703B
MD5bda43e8380e72cb9af44b268d587c16f
SHA12507325643bf570cd64fcce06dc14978dbe84f52
SHA256d8a0e4f56b385f9f906459306360c7b42e2c539ae32765c9086206ff55cf1e52
SHA512347b22f75d3946c1912cbf3cf3cc2583bbce7686a31a914af4fdc4b04504a06f54576ff8db43dc02b41ff746292f092a6c9754c2054d46e9956e1c40678cfff9
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\user.config
Filesize579B
MD56113bb3102b3329abdfcb38bad06a426
SHA1878ddb329478e96e4afe8c577130583c9fa84ec9
SHA2561e05bc864c767c08e945a4699e39fd7311c6551659d2d6996c08ea66b8d08aea
SHA512c5f6ce90d0b774ec69b81b10280257c93d2db3442f7f37ad2227a0f8aaf06a3be826183e2153cb3f849a1d61e11e72dd3b734147353e36085e42e3c84935218d
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\user.config
Filesize703B
MD576003aa85d5ed10166ccd23e37bc684f
SHA10467a609a29c01848502ec4b33efcbd3a7270b9f
SHA2566d780c3f6bdd69ffb2282d2c91200caf9e7584428e46afa6d6dcfdff22c16f48
SHA512fbf3cfcb16d9f8da12bb2ca414f95a59e03c569237c3a9763c2fb199038648b48a7e14e42f5ad88877e27e13b356c0f5cffb735e0996b4e62de61099e661e0c1
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\user.config
Filesize703B
MD584a69bcedb4d791eab976602ce0b417a
SHA19bd4d38a336b37a856646e7204ef1c6f06ba7bcf
SHA25657b93a8869d528185c08bf93f5fe6ad96ccfb6098aad4bfc0ab8ec774d251ca1
SHA5125452e20eefd12e1f587170974b5ca84e6e3315d7d63c1a4c05b868f6a2447a92826487d8898c74105dbe23e6b19d89b017daf074d58780d5a9c2886b8352a7d1
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\user.config
Filesize828B
MD56b8305d9b59d21e1cf11a033b1ed26e3
SHA1a57825a8e90ec3a082533f4198facf07c4f439df
SHA2565824b09019e4666e9d1c0771222d79831f034f3f26a7acc7f80d759210fa5b2b
SHA51233192508730992c8008c9ada8ab15f13732acc7c5fb5b15b9d04383af9526a328e01ab113d04c094fbf67f5b9385381ed3835b942fbb43cc5574be34124f0844
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\user.config
Filesize829B
MD533a4b6de6c260154d61dcd121422d775
SHA1a3441b2e119d9eac777c7f3a372d45084e838cbc
SHA256b3b4629684d506be09018530e410ee4e718c685183bf1e4c981fea83a9a3aca2
SHA512faa4eb170fccad4d5eb2f72aa878bf12d9ec477c3008786b2a8c82e943777f4510ffa8d057dad2ac705e5a980a5fd0bab39101d37908bcc89c00dc5462061a0d
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\user.config
Filesize953B
MD55675c192bfe57ea2eb8763f24c1dbcf3
SHA118f4ca61327b70d2c58653e024a7fa8f213ef521
SHA25681f0555f4f7367a92797b033ebb40b10ab88fd400d0b0d5025e0442e43b4d773
SHA5127a5f115a731134a97e1856b484f5d66d32adc2084a5bfdcfb3772715f1660d6b325c079669c03118c75a38e978353f62eb4cfb235ad6e762d138be643c64235c
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\user.config
Filesize953B
MD5de01f2b5e836231258478b99977bac9c
SHA13264efba0b59a8cb47ef7023e07c72e22b544b96
SHA25662c8fe6e321f067b947904b680e6782186f114a89d1eb3c0cbe0365683a78729
SHA512578e574daeda24e4fe4dfc081012f6814edd82b721fba5d61531ee273ece3a52a6e63ef74d5b79554a6b4f729531ca3c9911da8263030485335c94b2d7ff2b5e
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\user.config
Filesize953B
MD56eb4b6be03fc07b367a378205db4580a
SHA117cdb90e2a227a1fc1a803dec40614f07f2d8626
SHA256b96326021f303f5df61526251a52ba3c145f641685816fd2838ce9a7f4640dc3
SHA5126097f92037d8e9f234adbbbc548ff5ad7be6b5e38ec967195d55e9906c1e9e0ba467aa6c43ae6ed3e93a8d696e0b4aa0a043f20bd52ed828bf68a73b6d7ed498
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\user.config
Filesize1KB
MD5e0401b4f2ac4d08f66c7fcca1d7a9b48
SHA1d01ad00cb39a9c34fc77e1e761a9d8b20806464d
SHA25680c9294d71879f19eb0022bbd32a534f212c9ed21487cab25c8e48d8f86d914f
SHA512a4d12738fb9af8431dd473210704d68ea1426e85a288b785a00f30e1311327c7faee8a0dd25b0eab4448bd26f0e84bb1a4c9c1172d9d5e9a790cd699786fa685
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\user.config
Filesize1KB
MD5cbb73437ae5c6f6bef14fdad295a8956
SHA1ad080ac2183863a23ee6e25d9cd146607e775aa0
SHA2562960c06a004308e3b63060e9e9b3d2093f9a4c313f07f69430488ab5764088af
SHA5121a0d1091c7653bbc2e75c8abd84f94fc2296c501e4968b4754824ff6fa0a107c4904f866f26c596faebcf9b727cba97037177371f1b04b5832e5a67f5e937060
-
C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN.exe_Url_5k5woeau2v3gmtlay4mjwsftlqxjnn2p\2.4.3.0\user.config
Filesize1KB
MD5463342b14b44d8f958ee5971d05a12b6
SHA162ff12628ef8585979f81194b3693390ed4d8d4e
SHA256ef803aff75dea87a502416a6d9452c5d189f29ff2b83076f8aa12b0feb29ab90
SHA512ca8b936f5f1966ec000b3b4b463c359e56cd97a6524f55f099fbbec04fb44fd07a5987aa38402948c7f2ba92fad96bfd470e94247c8cdd7e810947daf57681aa
-
Filesize
29KB
MD56ec754fca420b9e088e7b906e63d22a9
SHA1913a8c7cc9203eca2b311aa21aa6c5fe144b43e0
SHA25661899173fbfff0f8023731913390545ba8fad6dd42cdc7dc89b5c3c4f61272fd
SHA512ed20cc879dc6f51934b75948b0f543012e9cc7894eb906946ba87451b3bc4b1c8c83d4f7afcab4644fdd14151776c2b5fb9eb67f13c0e1964ad06e771634ab8b
-
Filesize
152KB
MD519e61f2dfd494cd64a9cfba3d4afe964
SHA11ba29dafa629be32ac85dd68a4c5bac261c46a88
SHA256f7c03fa72a65dd9f9fd2abce0510d75933db3355ada0733f71ecaf7caae74f97
SHA512392aeda85bbc0a5c69178cd44866408fda2bc4607348b6779124473a7099446359eaf8b2ee1e8121dfd0b7a0da6e8cf6f383729da94fb1a3ed3767dc3a6e15eb
-
Filesize
905KB
MD58d55b0041b8869f2ae1544653ea46dab
SHA1e66976d06d30bcb5402acc5ebd81cd9cf7d65dda
SHA2562d07d4a254ebebbcca6c15c68f858cdae27f5901a56d2cbd70745773c1bc0d3f
SHA51283542fd1e414fc3a8e6eb516d5edef7033b4e3313a99f075da82e08619789adebb398ba9733f641d3bafafdd6235b5cb1b545b7db0d508b02f54574230bc15eb
-
Filesize
554KB
MD53b171ce087bb799aafcbbd93bab27f71
SHA17bd69efbc7797bdff5510830ca2cc817c8b86d08
SHA256bb9a3c8972d89ad03c1dee3e91f03a13aca8d370185ac521b8c48040cc285ef4
SHA5127700d86f6f2c6798bed1be6cd651805376d545f48f0a89c08f7032066431cb4df980688a360c44275b8d7f8010769dc236fbdaa0184125d016acdf158989ee38
-
Filesize
945KB
MD5a6f0a2eac5b934fac5d1d9e445d277df
SHA1219870701fc2014f5a00b29116570b69f4f8045f
SHA256f31f648f39602e725161eafe87d3bb41355d835740e7e2c972bef8ec29122cab
SHA512b380977f18fcb677622707362c3309d37ecd7a4fd90e269157f7aa958aabcb5164318b0b455e2f7f5b5a4451aa71ae9bb0a6a07da1d79a75b7f9ab02a47b1c63
-
Filesize
226KB
MD5ef40d2d74115bad70e77b04cd097433f
SHA1cc6b0eb8e8e9e4d419353d73e1469a526aa999b8
SHA256dfd86fbae610e1b4395157724b079b901adea3cdf7ea21949cb0de5fddec8c6d
SHA512e107a1a32fdc1d59f79efa1c4916a36d698827b2584f92be39d1b9c93b26cdb1d193335922899b9a895fb2749a4b409195ec54fe245b97f1d1c1149df6cb9c2e
-
Filesize
554KB
MD53b171ce087bb799aafcbbd93bab27f71
SHA17bd69efbc7797bdff5510830ca2cc817c8b86d08
SHA256bb9a3c8972d89ad03c1dee3e91f03a13aca8d370185ac521b8c48040cc285ef4
SHA5127700d86f6f2c6798bed1be6cd651805376d545f48f0a89c08f7032066431cb4df980688a360c44275b8d7f8010769dc236fbdaa0184125d016acdf158989ee38
-
Filesize
634KB
MD56df981ff5fc51df9a7a2608ebfac9b23
SHA11928f3f21de9855b5c50c058dd2a602f323a7b01
SHA2567e8a898aa81d2a1b54832686ef545e37bdcd9e61a1157fc92a81997d9ee104ef
SHA5121176baa1ec8903b9df5f5b226f27aae7733c946624c5e4d37c8034f6a04ba31891e96d1b6da1de552ac0760fe861b5042a1576397647a494d29018f1b1905438
-
Filesize
3.3MB
MD5d428d8807df4b267b601aa1ae751f045
SHA13b84abbadeb1506af52677d04819c3e95424d5dc
SHA256a753456eb5a7bb1acc413ac7b4c1d66870566cc0617397b2b8ae2cec6b4beff7
SHA5129cd39668c14ccde44f8f919237d7f58de06733119f130a60a10ab1071074987b8d1d84d07f09acdb0fb29e91a0c0ce291870f126b1f973851c72236ba7e6f70c
-
Filesize
2.7MB
MD5ebec631150e28e8edeade557a1150fbd
SHA184da8f7380f63920351a1ac734b226e44007da66
SHA2569e217bd4c7122882fe9ddb70809a251de285d79c5367894f1dadc625012fce46
SHA51293bc6e318f5262d56c5690ab05c7e1c248a8ceae05d0e5946de6e81719243a4776cd1a9e56a5170b37e7eeb2fea3d8d4e797aada1fb44214572a54d754ee041f
-
Filesize
969KB
MD58daa0843654de0cc1d40325747ac9f3e
SHA10727d9e78a371b59499b2a0754956d4a1378b8a7
SHA256d41f00ae17e1e1dbc56826584db3332a33d9b6f25462255404eb9ec37fec45e1
SHA5128381386d9df7a619ab4d188ae45f4415587d55ad74b49d4ce7680d08a3f1702dd750b2ddbc2e03d507b29ef06541fea5d822a2c3968d857d13c2354793f2fa73
-
Filesize
3.2MB
MD5032bb369103dac02606fb919f6658f3c
SHA160b39428ab3493aab7babf3a1c5f2a951ae853bd
SHA256daa61c42d53be45c7709a0b0f66a51a0a47ca84eab787e0627f6da255c96ddff
SHA5120f1fb9bb34e699ee6d4a1dc58f99514fb1df81ad0cf37b3ffe938295a70d832a5702cec3df16d30d400c77014d09228e6d02d3e65d5d6d0f1c5e34f39d55e313
-
Filesize
350KB
MD5c771f73e9f7e107ca6778693741ba0ed
SHA1a8e92c0f97b61fafdd622744f379fb612c17c82c
SHA256cdb282858f6d0333e708ce8ad3e998215003c29950040121709f1d1bb51e3cef
SHA51220175f6a7cd7af6552fc1fac8c2faeedb2325d1eed2e79285e43fab4544ec4c79964c333a54dbb568f633da8a54c80d60c44636d1d16ced786e05bd56d1cf16b
-
C:\Users\Admin\AppData\Local\Temp\{5D0F40C5-4278-4AA0-A06C-7BD24B088624}\B088624\ProtonVPN_win_v2.4.3.msi
Filesize20.2MB
MD5718551cb789dc50d7f2c6317d709d122
SHA18c26f156c33b246b68c80467bb74cac9712dd6cf
SHA25602ee18cc11bcf4d37ce52d80b509566bb29e2b2b78260bde37ba6987e72aa1d3
SHA51276217a323782b02f4385bf068970f84978095a4cdd9716b22dd0574ba3e2618a5262a4df0670d4813369047176f77d21e124a663cd7fbee2695e0bf6742b00e8
-
Filesize
215KB
MD57117e33f9b1dc041b477060f8f8c3a0c
SHA197fbcb6676bfb43d36701805c86eac3567f61bca
SHA256a350f06808b517dd2b7f363dca6119c072d08d1677e379ce48267bc7d95f1517
SHA51231f484d210e575dc8f522d1b3c16d2a77601be172287d8f7ff009a5700820e028c9c1366d543872edaec002a7e2e5fe5880ad303cde8d28a60fe0359db4307fe
-
C:\Users\Admin\AppData\Local\Temp\{87BDF456-9882-44E6-8FFC-F73B83E42EAD}\3E42EAD\ProtonVPNTap_1.1.4.msi
Filesize2.5MB
MD58ab9d61eb819c285ab08e347c26b9d58
SHA1a1cb0e6ed4017cef37dcfbc1cc71e356f5fd2f29
SHA25610128139c58042889684c254b1e35087d31fa46eddf86997c7ca0efe5b97e04a
SHA51294d0c2dddcac0042e8b2ae1ac6ee296a8e2f3ef0a36cd69e5e37a4aec15b4161e5eb6f0674667e25904660828b2cc47054fb0cfc445c37dd08ecc006166143e1
-
C:\Users\Admin\AppData\Local\Temp\{B1EBF050-CC3E-45B0-9DE5-339C6241F3DA}\241F3DA\ProtonVPNTun_0.13.1.msi
Filesize2.3MB
MD524b7a945bbb1693e2498759a8a4b246d
SHA19de1ea92af8e62c8ddb41e4d062c85e2945b5e5c
SHA25643625b2eb327f4aa0fa3a5c8f39358c0fc410ff505334b53ad6f42917d16ab3c
SHA5125b08b63ba46c2bc5337af4c8f6ed847636ebe074d59c476b7c83ca8a3569fd4cfb6e0a4386714f5032d0e346234c65abe6e7897329071af42a17c31ddbd1f02a
-
Filesize
7KB
MD5739b5009fbbf4101f3a2caadcb06ee88
SHA171a35d1b1de4beb544c6f15acb2d49976f2b07f5
SHA256f0e80af20d1635e2a5aaf51c0894844a90ea4d8be7420e20360cb5e1849e6c03
SHA5120acf97f5d229c7d5dd518154484aa7a320875ffc16b1529a51c400a249e107cf406561208e653e517c3c73fd8dc50726026af95d5c7fde141bcca7fa8063a4ea
-
Filesize
19KB
MD564423201fa94a71110f3835b40b2e3b0
SHA1783d7c1cbb549c0517020f85307a8408782c95ff
SHA256d2748c7aa414bbba5738f6a7cd003e086ecbd515fbfd52dc2baa68d870cfc9d3
SHA5129d3328bc1e3414bb162f6bd905c0a195f2d0130fd037f84e6e0894ea548b8cab3b204aa83b876cd3df50fac7b52cebc7c95f967f8fb54c30a7ca90c5b57c22c3
-
Filesize
47KB
MD52a15171185d6981175a8e0be7e256420
SHA137d39aa4a47941757aa20e95a7eb4446a2cd3649
SHA2566aef37ca89e2f0f74cc5acf988c910a6e22d56850b0ff8aefd442562ff770b24
SHA51237c73de8081eb0f56d6d58c569de44d5bc978553e72968de593e9ea3292b0805b46169c52f062b138da56d8d72f0bef011a1c82d628266847d7696a165f4f72b
-
Filesize
717KB
MD5c58bd81d42172a400ae138342da3e526
SHA115812f329f28d0c7f0a18bae6f93302b950267d9
SHA25657e11062cc1a2b08277f463bf1f6e352cfd0e74675c695c52a0cdc3c0b61abb8
SHA512c00ed1e41f5b104be4d34a1c81c36e3058fd4b20055cbe5dcd208645dd9b5413e6ff583fe4c2ccf0f8011e590d2ebdb51fb79cf1e0f7e8fac83e8065cecd4cff
-
Filesize
418KB
MD532fc66b494dc28ade41ccc2d21e6f973
SHA1545a5699b249ef6eda4e9d034c9e1a1f510f4f63
SHA256a453a304482050a10c288c6158cef38bfe2039aa4d0ecebfad77637468548e5c
SHA512879037cc6da964032c3220a0bc5513314849f4a5d671ffdce63a419583cc657496546240147f52e23dfb22b4715ff63a6f0f7f2b140373ed75afad5dace8fff1
-
Filesize
419KB
MD59a0696ba635299fef01371289ad6a4aa
SHA16b865faecc47c6f48b10672295011679f4bf80e5
SHA256a3566ead9e9b4e69d047d9047d4cc3284cda6dab9d05c7928aafb2b8dfc0526c
SHA51207d1503e5ba8c094fc78534e96db680699ab0c891edc5ca188e0d06bca4912a7388a02175fa7cc3adb0e1619703d4dc8590ef4990bfeb11f5e07b99ef671dedb
-
Filesize
294KB
MD55f6aa4c4ca0a4da6ff7c3a1c88066f1c
SHA19d527b0de0a8032ae1b987fa445c8b279cb12d25
SHA2566dc28873da754babbad5898ef88e1f7786bdec2afd91384e2cf225daebab65b6
SHA5124180d46eba452e6c7e2776cdadb43603a31fdf58c42d47b5b2a3ee83e9cf0f5bd8c1c67a503e52a3bde9ddec941972c0e816be8190dd90c3abcd1328b79776f2
-
Filesize
305KB
MD5fb6c354fee1f04a3ea0ea3d5371da341
SHA1fd3fd10b399fb2fc98a588f99ed243bf3b2b667f
SHA25673e632fdb7cd7cfaf5bd6e388f891b573700c5ba93e7813ac70c959267779ee2
SHA5129a50f2922da654642470edbe2229e0ac1d5bc47d1e31a2b473c49ba6a03ca6e7464a121ebf3ea07419eaef0e245b9c927e85835c442c411c2304e097c36a7722
-
Filesize
1.5MB
MD52fbe10e4233824fbea08ddf085d7df96
SHA117068c55b3c15e1213436ba232bbd79d90985b31
SHA2565b01d964ced28c1ff850b4de05a71f386addd815a30c4a9ee210ef90619df58e
SHA5124c4d256d67b6aadea45b1677ab2f0b66bef385fa09127c4681389bdde214b35351b38121d651bf47734147afd4af063e2eb2e6ebf15436ad42f1533c42278fa4
-
Filesize
1.5MB
MD52fbe10e4233824fbea08ddf085d7df96
SHA117068c55b3c15e1213436ba232bbd79d90985b31
SHA2565b01d964ced28c1ff850b4de05a71f386addd815a30c4a9ee210ef90619df58e
SHA5124c4d256d67b6aadea45b1677ab2f0b66bef385fa09127c4681389bdde214b35351b38121d651bf47734147afd4af063e2eb2e6ebf15436ad42f1533c42278fa4
-
Filesize
2.1MB
MD50bec55833f356f89b8d9d63727ddc43e
SHA18dcfd2b8292ab7a585a8a4e40d61b81c96b63f5c
SHA256b360afadecb2334ba103d515c506e792cb9aeea5925a6cf85dbfd786a225ffc3
SHA5126592f21800f91474d2ade6102a0d0d36097e5552278e5aa390e52dccc838b323f9a4b89b6c879c56621d0de84a9ef054f695a6fdc267c9142a3d234bf3a2460c
-
Filesize
554KB
MD53b171ce087bb799aafcbbd93bab27f71
SHA17bd69efbc7797bdff5510830ca2cc817c8b86d08
SHA256bb9a3c8972d89ad03c1dee3e91f03a13aca8d370185ac521b8c48040cc285ef4
SHA5127700d86f6f2c6798bed1be6cd651805376d545f48f0a89c08f7032066431cb4df980688a360c44275b8d7f8010769dc236fbdaa0184125d016acdf158989ee38
-
Filesize
945KB
MD5a6f0a2eac5b934fac5d1d9e445d277df
SHA1219870701fc2014f5a00b29116570b69f4f8045f
SHA256f31f648f39602e725161eafe87d3bb41355d835740e7e2c972bef8ec29122cab
SHA512b380977f18fcb677622707362c3309d37ecd7a4fd90e269157f7aa958aabcb5164318b0b455e2f7f5b5a4451aa71ae9bb0a6a07da1d79a75b7f9ab02a47b1c63
-
Filesize
215KB
MD57117e33f9b1dc041b477060f8f8c3a0c
SHA197fbcb6676bfb43d36701805c86eac3567f61bca
SHA256a350f06808b517dd2b7f363dca6119c072d08d1677e379ce48267bc7d95f1517
SHA51231f484d210e575dc8f522d1b3c16d2a77601be172287d8f7ff009a5700820e028c9c1366d543872edaec002a7e2e5fe5880ad303cde8d28a60fe0359db4307fe
-
Filesize
215KB
MD57117e33f9b1dc041b477060f8f8c3a0c
SHA197fbcb6676bfb43d36701805c86eac3567f61bca
SHA256a350f06808b517dd2b7f363dca6119c072d08d1677e379ce48267bc7d95f1517
SHA51231f484d210e575dc8f522d1b3c16d2a77601be172287d8f7ff009a5700820e028c9c1366d543872edaec002a7e2e5fe5880ad303cde8d28a60fe0359db4307fe