Overview

overview

8

Static

static

1

URLScan

urlscan

1

https://protonvpn.co...

windows10-2004-x64

8

Analysis

  • max time kernel
    446s
  • max time network
    446s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/06/2024, 00:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://protonvpn.com/download
  • Sample240603-ac3plsca41
Score
8/10
adwarediscoveryevasionpersistencestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file
  • Modifies Installed Components in the registry 2 TTPs 7 IoCs
    persistence
  • Sets file execution options in registry 2 TTPs 2 IoCs
    persistence
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 64 IoCs
  • Registers COM server for autorun 1 TTPs 53 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Checks system information in the registry 2 TTPs 16 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 25 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 25 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 29 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://protonvpn.com/download
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3152
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ff8c04046f8,0x7ff8c0404708,0x7ff8c0404718
      2⤵
        PID:1020
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,4424476250640946724,8105179146208501534,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
        2⤵
          PID:4112
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,4424476250640946724,8105179146208501534,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2696
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,4424476250640946724,8105179146208501534,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
          2⤵
            PID:3672
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4424476250640946724,8105179146208501534,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
            2⤵
              PID:3732
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4424476250640946724,8105179146208501534,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
              2⤵
                PID:4160
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,4424476250640946724,8105179146208501534,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
                2⤵
                  PID:928
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,4424476250640946724,8105179146208501534,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1160
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2056,4424476250640946724,8105179146208501534,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5400 /prefetch:8
                  2⤵
                    PID:4592
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4424476250640946724,8105179146208501534,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
                    2⤵
                      PID:212
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2056,4424476250640946724,8105179146208501534,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5956 /prefetch:8
                      2⤵
                        PID:3640
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4424476250640946724,8105179146208501534,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
                        2⤵
                          PID:5276
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4424476250640946724,8105179146208501534,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
                          2⤵
                            PID:5284
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4424476250640946724,8105179146208501534,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
                            2⤵
                              PID:5464
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4424476250640946724,8105179146208501534,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
                              2⤵
                                PID:5472
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,4424476250640946724,8105179146208501534,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5808
                              • C:\Users\Admin\Downloads\ProtonVPN_v3.2.11.exe
                                "C:\Users\Admin\Downloads\ProtonVPN_v3.2.11.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:5916
                                • C:\Users\Admin\AppData\Local\Temp\is-SL4GL.tmp\ProtonVPN_v3.2.11.tmp
                                  "C:\Users\Admin\AppData\Local\Temp\is-SL4GL.tmp\ProtonVPN_v3.2.11.tmp" /SL5="$1201D0,78361131,1119744,C:\Users\Admin\Downloads\ProtonVPN_v3.2.11.exe"
                                  3⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Drops file in Program Files directory
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of FindShellTrayWindow
                                  PID:6016
                                  • C:\Users\Admin\AppData\Local\Temp\is-M1JK5.tmp\MicrosoftEdgeWebview2Setup.exe
                                    "C:\Users\Admin\AppData\Local\Temp\is-M1JK5.tmp\MicrosoftEdgeWebview2Setup.exe" /silent /install
                                    4⤵
                                    • Executes dropped EXE
                                    • Drops file in Program Files directory
                                    PID:1656
                                    • C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\MicrosoftEdgeUpdate.exe
                                      "C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
                                      5⤵
                                      • Sets file execution options in registry
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Checks system information in the registry
                                      • Drops file in Program Files directory
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:640
                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
                                        6⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Modifies registry class
                                        PID:5912
                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
                                        6⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Modifies registry class
                                        PID:6008
                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                          7⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Registers COM server for autorun
                                          • Modifies registry class
                                          PID:2848
                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                          7⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Registers COM server for autorun
                                          • Modifies registry class
                                          PID:4012
                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                          7⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Registers COM server for autorun
                                          • Modifies registry class
                                          PID:6072
                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NkRERjZGRDEtMERBOC00NEIxLUI2NTEtMUNBNjBDNUFDNkY4fSIgdXNlcmlkPSJ7QTc0RkM5RTUtQjQyMC00QzFBLUI1RDMtMUY4OEVCRkVFQkVCfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntFOTMwRkVDRC1FN0QxLTRCNDQtODc3My05REMxNzlENzM4OEZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RHhPYmpIR2ErblJhMmF0QzN3bytJRXBDNzgrWlllQVVia1hwREMyY2o3VT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE4Ny4zNyIgbmV4dHZlcnNpb249IjEuMy4xODcuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUwMzUzNDMyNzEiIGluc3RhbGxfdGltZV9tcz0iNjQwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
                                        6⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Checks system information in the registry
                                        PID:6128
                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{6DDF6FD1-0DA8-44B1-B651-1CA60C5AC6F8}" /silent
                                        6⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        PID:2924
                                  • C:\Program Files\Proton\VPN\v3.2.11\ProtonDrive.Downloader.exe
                                    "C:\Program Files\Proton\VPN\v3.2.11\ProtonDrive.Downloader.exe" "C:\Program Files\Proton\Drive"
                                    4⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Suspicious use of FindShellTrayWindow
                                    PID:512
                                    • C:\Users\Admin\AppData\Local\Temp\Proton%20Drive%20Setup%201.5.4.exe
                                      "C:\Users\Admin\AppData\Local\Temp\Proton%20Drive%20Setup%201.5.4.exe" /qn APPDIR="C:\Program Files\Proton\Drive"
                                      5⤵
                                      • Executes dropped EXE
                                      • Adds Run key to start application
                                      • Enumerates connected drives
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of FindShellTrayWindow
                                      PID:6020
                                      • C:\Windows\TEMP\{CDA63A03-FFB5-4470-8AAE-E2832B22C347}\.ba\wixprqba.exe
                                        "C:\Windows\TEMP\{CDA63A03-FFB5-4470-8AAE-E2832B22C347}\.ba\wixprqba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{BEB5FD84-1302-4F38-B0A2-5AE67F38814D} {9D58E7B5-0838-400D-B566-3B7EFBFF29D6}
                                        6⤵
                                        • Executes dropped EXE
                                        PID:5208
                                      • C:\Windows\TEMP\{CDA63A03-FFB5-4470-8AAE-E2832B22C347}\.ba\wixiuiba.exe
                                        "C:\Windows\TEMP\{CDA63A03-FFB5-4470-8AAE-E2832B22C347}\.ba\wixiuiba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{19BC255A-530F-4554-820A-120DE4AC0447} {9A79621E-7EE4-430B-BE93-15C4B97DDF95}
                                        6⤵
                                        • Executes dropped EXE
                                        PID:1396
                                      • C:\Users\Admin\AppData\Local\Programs\Proton\Drive\ProtonDrive.exe
                                        "C:\Users\Admin\AppData\Local\Programs\Proton\Drive\ProtonDrive.exe"
                                        6⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Registers COM server for autorun
                                        • Modifies registry class
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        PID:1916
                                  • C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe
                                    "C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe" /lang en-US
                                    4⤵
                                    • Executes dropped EXE
                                    PID:5712
                                    • C:\Program Files\Proton\VPN\v3.2.11\ProtonVPN.exe
                                      "v3.2.11\ProtonVPN.exe" /lang en-US
                                      5⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Adds Run key to start application
                                      • Checks whether UAC is enabled
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1500
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,4424476250640946724,8105179146208501534,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6156 /prefetch:2
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3744
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:4208
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:2852
                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                                  1⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Checks system information in the registry
                                  • Modifies data under HKEY_USERS
                                  PID:4224
                                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NkRERjZGRDEtMERBOC00NEIxLUI2NTEtMUNBNjBDNUFDNkY4fSIgdXNlcmlkPSJ7QTc0RkM5RTUtQjQyMC00QzFBLUI1RDMtMUY4OEVCRkVFQkVCfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QTMxMUFEMEMtMkJERi00MkVCLUI3MDktREM1MDJEMjQwMkM5fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0Q2anhQZVVtS2ZoOHl0eTZGMDdZeE0xZVpESC9UVjZGUVQyZmZEaVp5d3c9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjExMC4wLjU0ODEuMTA0IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyNSIgaW5zdGFsbGRhdGV0aW1lPSIxNzE1MTcxMjM1IiBvb2JlX2luc3RhbGxfdGltZT0iMTMzNTk2Njg5Mzk0MDY3OTEwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjExNDA2OCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTA0MDM0MzU5NCIvPjwvYXBwPjwvcmVxdWVzdD4
                                    2⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Checks system information in the registry
                                    PID:3228
                                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F3A9F35E-7D39-437D-9B51-05E6A4F07A7F}\MicrosoftEdge_X64_125.0.2535.79.exe
                                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F3A9F35E-7D39-437D-9B51-05E6A4F07A7F}\MicrosoftEdge_X64_125.0.2535.79.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                                    2⤵
                                    • Executes dropped EXE
                                    PID:3032
                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F3A9F35E-7D39-437D-9B51-05E6A4F07A7F}\EDGEMITMP_1A74B.tmp\setup.exe
                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F3A9F35E-7D39-437D-9B51-05E6A4F07A7F}\EDGEMITMP_1A74B.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F3A9F35E-7D39-437D-9B51-05E6A4F07A7F}\MicrosoftEdge_X64_125.0.2535.79.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                                      3⤵
                                      • Executes dropped EXE
                                      • Drops file in Program Files directory
                                      PID:3080
                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F3A9F35E-7D39-437D-9B51-05E6A4F07A7F}\EDGEMITMP_1A74B.tmp\setup.exe
                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F3A9F35E-7D39-437D-9B51-05E6A4F07A7F}\EDGEMITMP_1A74B.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.112 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F3A9F35E-7D39-437D-9B51-05E6A4F07A7F}\EDGEMITMP_1A74B.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.79 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff722034b18,0x7ff722034b24,0x7ff722034b30
                                        4⤵
                                        • Executes dropped EXE
                                        PID:5188
                                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NkRERjZGRDEtMERBOC00NEIxLUI2NTEtMUNBNjBDNUFDNkY4fSIgdXNlcmlkPSJ7QTc0RkM5RTUtQjQyMC00QzFBLUI1RDMtMUY4OEVCRkVFQkVCfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins4MTZDMzQ1NC1EMEI0LTRGMTktQTdEMS04NEY5MENEQTM5MTh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI1LjAuMjUzNS43OSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTA1MzAwNDMzOCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUwNTMwMDQzMzgiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NDU4OTAzMDQ1IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8wOGMzMGM2ZC02OWViLTQ5N2ItYWQ4Mi1mODQ3ODc5ZTQyNDA_UDE9MTcxNzk3Nzk4MCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1OaCUyZlRieEp6aDMlMmZTNU02UW9zUkZjdmxRRjlHdUMzeXRnZndkdTNNMlcycHhoYU81WTVkUU9vY2kzeXFOUDZWJTJiMmZCbTU5M3RYSEs5TVF6NUdaQnU1USUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE3MzcxNjAyNCIgdG90YWw9IjE3MzcxNjAyNCIgZG93bmxvYWRfdGltZV9tcz0iMzM4MDQiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NDU5MDU5Mzc0IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTQ3MzI3ODMwNCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTkxNjk1MDE2OCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9Ijg1OSIgZG93bmxvYWRfdGltZV9tcz0iNDA1NzUiIGRvd25sb2FkZWQ9IjE3MzcxNjAyNCIgdG90YWw9IjE3MzcxNjAyNCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iNDQzNTIiLz48L2FwcD48L3JlcXVlc3Q-
                                    2⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Checks system information in the registry
                                    PID:1484
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
                                  1⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2820
                                  • C:\Windows\system32\dashost.exe
                                    dashost.exe {d7388bef-2e8a-4ef7-911259ac588f49aa}
                                    2⤵
                                      PID:6000
                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"
                                    1⤵
                                    • Checks processor information in registry
                                    • Modifies Internet Explorer settings
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of SetWindowsHookEx
                                    PID:5256
                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
                                      2⤵
                                        PID:3380
                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3CF78BECA2305D35BC14319E28BCCDBF --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                          3⤵
                                            PID:1820
                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7F3AEDC95277188E794F286CF7C546D9 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7F3AEDC95277188E794F286CF7C546D9 --renderer-client-id=2 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job /prefetch:1
                                            3⤵
                                              PID:4584
                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=913DD99438E940517DA7F4CF94612386 --mojo-platform-channel-handle=2300 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                              3⤵
                                                PID:3628
                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2F93706206F0EF7B435FF7F60FEEA9D7 --mojo-platform-channel-handle=1968 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                3⤵
                                                  PID:1416
                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=67C45B22FA6EAA5E480F48F914436E94 --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                  3⤵
                                                    PID:5880
                                              • C:\Windows\System32\CompPkgSrv.exe
                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                1⤵
                                                  PID:5288
                                                • C:\Program Files\Proton\VPN\v3.2.11\ProtonVPNService.exe
                                                  "C:\Program Files\Proton\VPN\v3.2.11\ProtonVPNService.exe"
                                                  1⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:5104
                                                • C:\Windows\system32\msiexec.exe
                                                  C:\Windows\system32\msiexec.exe /V
                                                  1⤵
                                                  • Adds Run key to start application
                                                  • Enumerates connected drives
                                                  • Drops file in Windows directory
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:1212
                                                  • C:\Windows\System32\MsiExec.exe
                                                    C:\Windows\System32\MsiExec.exe -Embedding 917B3409BD86CA088AA2601732978A49 C
                                                    2⤵
                                                      PID:4484
                                                      • C:\Windows\system32\rundll32.exe
                                                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIBCDE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240762156 15 ProtonDrive.Installer.Extensions!ProtonDrive.Installer.Extensions.CustomActions.QueryUserProgramFilesFolder
                                                        3⤵
                                                        • Drops file in Windows directory
                                                        PID:644
                                                      • C:\Windows\system32\rundll32.exe
                                                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIBF30.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240762687 19 ProtonDrive.Installer.Extensions!ProtonDrive.Installer.Extensions.CustomActions.DoPerMachineUpgradeSupportActions
                                                        3⤵
                                                        • Drops file in Windows directory
                                                        PID:2520
                                                    • C:\Windows\System32\MsiExec.exe
                                                      C:\Windows\System32\MsiExec.exe -Embedding 1468E9440A900365A302776C70DF6361
                                                      2⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:6088
                                                      • C:\Windows\system32\rundll32.exe
                                                        rundll32.exe "C:\Windows\Installer\MSIFE2C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240778843 2 ProtonDrive.Installer.Extensions!ProtonDrive.Installer.Extensions.CustomActions.QueryUserProgramFilesFolder
                                                        3⤵
                                                        • Drops file in Windows directory
                                                        PID:5048
                                                      • C:\Windows\system32\rundll32.exe
                                                        rundll32.exe "C:\Windows\Installer\MSI31.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240779328 6 ProtonDrive.Installer.Extensions!ProtonDrive.Installer.Extensions.CustomActions.HideCancelButton
                                                        3⤵
                                                        • Drops file in Windows directory
                                                        PID:1656
                                                  • C:\Windows\System32\rundll32.exe
                                                    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                    1⤵
                                                      PID:4628
                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
                                                      1⤵
                                                      • Executes dropped EXE
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:4580
                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                                                      1⤵
                                                      • Executes dropped EXE
                                                      • Checks system information in the registry
                                                      • Modifies data under HKEY_USERS
                                                      PID:4988
                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F4A6D834-7414-4144-9CCE-7CFFDEE4663F}\BGAUpdate.exe
                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{F4A6D834-7414-4144-9CCE-7CFFDEE4663F}\BGAUpdate.exe" --edgeupdate-client --system-level
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • Adds Run key to start application
                                                        PID:4156
                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDMxNjUwMTUtOTg3My00Njg3LUIxMDItQkM2OTg4N0Q5Rjk3fSIgdXNlcmlkPSJ7QTc0RkM5RTUtQjQyMC00QzFBLUI1RDMtMUY4OEVCRkVFQkVCfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9InsxQkM4RjNGNC00QUMwLTRGMzktOTNBQi1BNkVGQTZBNEE5Mzh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RDZqeFBlVW1LZmg4eXR5NkYwN1l4TTFlWkRIL1RWNkZRVDJmZkRpWnl3dz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7MUZBQjhDRkUtOTg2MC00MTVDLUE2Q0EtQUE3RDEyMDIxOTQwfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMi4wLjAuMzQiIGxhbmc9IiIgYnJhbmQ9IkVVRkkiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4MDM3OTY5NTk3IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODAzODA1OTQ2MyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDIzODM4IiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4NDk3NTk5NjUwIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJkbyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvNWYxOTU2MTItMzg0YS00OGVhLTg0MDgtYjRlZGU5ZGM1NmJiP1AxPTE3MTc5NzgyNzgmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9RnpiODV5R1JnSmlEbzEzUEZkVTJmS1Ria2NJTGlVTzlWVFN3N2RScVVzdExJJTJiVDg2T25YZnlTcmlxNXlMQkNQSEFYZ2g5SmF5c21mcVZLdnhBUkVHUSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjAiIHRvdGFsPSIwIiBkb3dubG9hZF90aW1lX21zPSIxMiIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg0OTc2MDkzNjIiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzVmMTk1NjEyLTM4NGEtNDhlYS04NDA4LWI0ZWRlOWRjNTZiYj9QMT0xNzE3OTc4Mjc4JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PUZ6Yjg1eUdSZ0ppRG8xM1BGZFUyZktUYmtjSUxpVU85VlRTdzdkUnFVc3RMSSUyYlQ4Nk9uWGZ5U3JpcTV5TEJDUEhBWGdoOUpheXNtZnFWS3Z4QVJFR1ElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxODA0NDQ0OCIgdG90YWw9IjE4MDQ0NDQ4IiBkb3dubG9hZF90aW1lX21zPSI0MTM0MCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg0OTc2NjkzNzEiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4NTA0MDg5NDgxIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODUwNzk0OTQ3NyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjkzNSIgZG93bmxvYWRfdGltZV9tcz0iNDU4OTkiIGRvd25sb2FkZWQ9IjE4MDQ0NDQ4IiB0b3RhbD0iMTgwNDQ0NDgiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjM4MyIvPjwvYXBwPjwvcmVxdWVzdD4
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • Checks system information in the registry
                                                        PID:3184
                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                                                      1⤵
                                                      • Executes dropped EXE
                                                      • Checks system information in the registry
                                                      • Modifies data under HKEY_USERS
                                                      PID:3412
                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DDB72EA7-3030-4647-AF18-3BACEAA55914}\MicrosoftEdge_X64_125.0.2535.79.exe
                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DDB72EA7-3030-4647-AF18-3BACEAA55914}\MicrosoftEdge_X64_125.0.2535.79.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:4608
                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DDB72EA7-3030-4647-AF18-3BACEAA55914}\EDGEMITMP_6A4B3.tmp\setup.exe
                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DDB72EA7-3030-4647-AF18-3BACEAA55914}\EDGEMITMP_6A4B3.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DDB72EA7-3030-4647-AF18-3BACEAA55914}\MicrosoftEdge_X64_125.0.2535.79.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
                                                          3⤵
                                                          • Modifies Installed Components in the registry
                                                          • Executes dropped EXE
                                                          • Registers COM server for autorun
                                                          • Installs/modifies Browser Helper Object
                                                          • Drops file in Program Files directory
                                                          • Modifies Internet Explorer settings
                                                          • Modifies registry class
                                                          • System policy modification
                                                          PID:5664
                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DDB72EA7-3030-4647-AF18-3BACEAA55914}\EDGEMITMP_6A4B3.tmp\setup.exe
                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DDB72EA7-3030-4647-AF18-3BACEAA55914}\EDGEMITMP_6A4B3.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.112 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DDB72EA7-3030-4647-AF18-3BACEAA55914}\EDGEMITMP_6A4B3.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.79 --initial-client-data=0x11c,0x118,0x124,0x13c,0x120,0x7ff7dd5f4b18,0x7ff7dd5f4b24,0x7ff7dd5f4b30
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:5556
                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DDB72EA7-3030-4647-AF18-3BACEAA55914}\EDGEMITMP_6A4B3.tmp\setup.exe
                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DDB72EA7-3030-4647-AF18-3BACEAA55914}\EDGEMITMP_6A4B3.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
                                                            4⤵
                                                            • Executes dropped EXE
                                                            • Drops file in System32 directory
                                                            • Modifies data under HKEY_USERS
                                                            PID:1432
                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DDB72EA7-3030-4647-AF18-3BACEAA55914}\EDGEMITMP_6A4B3.tmp\setup.exe
                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DDB72EA7-3030-4647-AF18-3BACEAA55914}\EDGEMITMP_6A4B3.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.112 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DDB72EA7-3030-4647-AF18-3BACEAA55914}\EDGEMITMP_6A4B3.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.79 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff7dd5f4b18,0x7ff7dd5f4b24,0x7ff7dd5f4b30
                                                              5⤵
                                                              • Executes dropped EXE
                                                              PID:416
                                                    • C:\Windows\system32\LogonUI.exe
                                                      "LogonUI.exe" /flags:0x4 /state0:0xa38a4055 /state1:0x41c64e6d
                                                      1⤵
                                                      • Modifies data under HKEY_USERS
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:5400

                                                    Network

                                                          MITRE ATT&CK Enterprise v15

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          e59fd33.rbs
                                                          • Path C:\Config.Msi\e59fd33.rbs
                                                          • Size 12KB
                                                          • SHA256 a55e2b1db330c678d20415974bc3fdc6a4819f7ec0d0647c9bbfe32178347fc5
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          setup.exe
                                                          • Path C:\Program Files (x86)\Microsoft\EdgeCore\125.0.2535.79\Installer\setup.exe
                                                          • Size 6.9MB
                                                          • SHA256 19dc1f8c7901ec057bfaf763d8354a07880ce6fa3093185c64b95d082f8055af
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          BGAUpdate.exe
                                                          • Path C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{1FAB8CFE-9860-415C-A6CA-AA7D12021940}\2.0.0.34\BGAUpdate.exe
                                                          • Size 17.2MB
                                                          • SHA256 d3c12e642d4b032e2592c2ba6e0ed703a7e43fb424b7c3ab5b2e51b53d1d433b
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          SETUP.EX_
                                                          • Path C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DDB72EA7-3030-4647-AF18-3BACEAA55914}\EDGEMITMP_6A4B3.tmp\SETUP.EX_
                                                          • Size 2.8MB
                                                          • SHA256 597006630d186095a14e003334b1260b4de8a5931b68597e3916ae2129b24336
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          EdgeUpdate.dat
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\EdgeUpdate.dat
                                                          • Size 12KB
                                                          • SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          MicrosoftEdgeComRegisterShellARM64.exe
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\MicrosoftEdgeComRegisterShellARM64.exe
                                                          • Size 179KB
                                                          • SHA256 8a75eaf5677dc11b1c37fbf57ca354b0e3d25c8aa867269c2deb0e7fb7fa0693
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          MicrosoftEdgeUpdate.exe
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\MicrosoftEdgeUpdate.exe
                                                          • Size 201KB
                                                          • SHA256 41587c47ed8b365599332d5e321437a6dfca746edfc782a231f5d0d4174b5cb8
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          MicrosoftEdgeUpdateComRegisterShell64.exe
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                          • Size 212KB
                                                          • SHA256 1c2fd257dfc2c3967f7afc0ee726319cb6eaa0f1db86c34f97d703ce7bdcb5eb
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          MicrosoftEdgeUpdateCore.exe
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\MicrosoftEdgeUpdateCore.exe
                                                          • Size 257KB
                                                          • SHA256 39f7c35da1df0dca19b5bc426f0687ff0f8ae8de3ae997857a4672f1176de161
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          NOTICE.TXT
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\NOTICE.TXT
                                                          • Size 4KB
                                                          • SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          msedgeupdate.dll
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\msedgeupdate.dll
                                                          • Size 2.1MB
                                                          • SHA256 bd57792535d7f2c75136fe09241fce48b225b7d451b5e6241cd40e6374db388e
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          msedgeupdateres_af.dll
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\msedgeupdateres_af.dll
                                                          • Size 28KB
                                                          • SHA256 41d0565075327e4a0d1364eb556a238981659f063054404458c0b7b37ec64574
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          msedgeupdateres_am.dll
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\msedgeupdateres_am.dll
                                                          • Size 24KB
                                                          • SHA256 2fa5350047962335602e7a450d1e29951609487e997bf183ce0eb5d01b28f066
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          msedgeupdateres_ar.dll
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\msedgeupdateres_ar.dll
                                                          • Size 26KB
                                                          • SHA256 b4e66f907dde78b4d4f85c5c44656667b7b0fa0659eb56f7f96d974cb66d4dd0
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          msedgeupdateres_as.dll
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\msedgeupdateres_as.dll
                                                          • Size 28KB
                                                          • SHA256 68a495ee65652ebb55f856b7a82dde20fdda0b38880019170fa5cbafb336c123
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          msedgeupdateres_az.dll
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\msedgeupdateres_az.dll
                                                          • Size 29KB
                                                          • SHA256 3ccf9900953a871a129280260909acfc20aa23644181e354847fbe6b2e005110
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          msedgeupdateres_bg.dll
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\msedgeupdateres_bg.dll
                                                          • Size 29KB
                                                          • SHA256 6b380706e9273948be9995da09e3aebb71e7275ba6852086cf5bd1594c7d1232
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          msedgeupdateres_bn-IN.dll
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\msedgeupdateres_bn-IN.dll
                                                          • Size 29KB
                                                          • SHA256 19fecbe5aa1f007f5f4ed719ad474b3270603c1535f187067c30ceddd4444091
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          msedgeupdateres_bn.dll
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\msedgeupdateres_bn.dll
                                                          • Size 29KB
                                                          • SHA256 97e41d2acb8b638ac2a039da4f9750a0e9387ac10433cb68e0415c0093695ce0
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          msedgeupdateres_bs.dll
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\msedgeupdateres_bs.dll
                                                          • Size 28KB
                                                          • SHA256 4d2ad964da1441bb08800618db62f9e8117751a4a78bdfa3ae1c2dcf903d6d43
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          msedgeupdateres_ca-Es-VALENCIA.dll
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
                                                          • Size 29KB
                                                          • SHA256 e703d0fe2e49eef7b8a072830e76143281039527d9c2873c8162f18217b0ed5a
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          msedgeupdateres_ca.dll
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\msedgeupdateres_ca.dll
                                                          • Size 30KB
                                                          • SHA256 d75877f6cc1b4be175872e8d33778721e3e5acfe1a1154772a68c799f2e3ee1a
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          msedgeupdateres_cs.dll
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\msedgeupdateres_cs.dll
                                                          • Size 28KB
                                                          • SHA256 8a981d1abbd9c6454d2798c7df5708e4af44f54991ac06e988e4e66022c15489
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          msedgeupdateres_cy.dll
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\msedgeupdateres_cy.dll
                                                          • Size 28KB
                                                          • SHA256 a12771439505f2d419b246d6a974fe8937e0aa5d3b1f9863dbae9f4b7e6197c8
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          msedgeupdateres_da.dll
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\msedgeupdateres_da.dll
                                                          • Size 28KB
                                                          • SHA256 8123fc78e3217a67de7051574abc16d33043ac9a1d67fbe1220a51ef92c8d80e
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          msedgeupdateres_de.dll
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\msedgeupdateres_de.dll
                                                          • Size 30KB
                                                          • SHA256 444f87c7ab5a89e3d423b497abf05fe22ae4605569abd83f3925d3a50a74cd08
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          msedgeupdateres_el.dll
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\msedgeupdateres_el.dll
                                                          • Size 30KB
                                                          • SHA256 3723b0bb625284d49824ab7689721e180238e0c693fb41d9948920210fb171ce
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          msedgeupdateres_en-GB.dll
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\msedgeupdateres_en-GB.dll
                                                          • Size 27KB
                                                          • SHA256 18cc6c1c2cb593f1f0450745e5ad4d5d0be3b7d6d3f904b907ffb863391badba
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          msedgeupdateres_en.dll
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\msedgeupdateres_en.dll
                                                          • Size 27KB
                                                          • SHA256 fb69f9c72a5026b21ebe7717e58f7382ac8a960849c4676b5733948aedf186a0
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          msedgeupdateres_es-419.dll
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\msedgeupdateres_es-419.dll
                                                          • Size 29KB
                                                          • SHA256 0ae0b861bc4079593e4fe9a2721b187245a80afec33742f80fa7bab4c63928bc
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          msedgeupdateres_es.dll
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\msedgeupdateres_es.dll
                                                          • Size 28KB
                                                          • SHA256 f9ba82d35d780cf5b4819570e81933b06da524eacb5d0eebeef4276aafb9c96e
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          msedgeupdateres_et.dll
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\msedgeupdateres_et.dll
                                                          • Size 28KB
                                                          • SHA256 49424f739809b3d7fe874852420cd91752cfa605005bf6186c9f89b1b704f40e
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          msedgeupdateres_eu.dll
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\msedgeupdateres_eu.dll
                                                          • Size 28KB
                                                          • SHA256 0aaa5b02f2541fdbea4357155e3ff28c4d715994646364fb9cff591c27c8150a
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          msedgeupdateres_fa.dll
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\msedgeupdateres_fa.dll
                                                          • Size 27KB
                                                          • SHA256 77b558ba96080390a79ec321af1579b1d17b7179e8a893e10462c7b22c8e8a5e
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          msedgeupdateres_fi.dll
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\msedgeupdateres_fi.dll
                                                          • Size 28KB
                                                          • SHA256 a121a308be48878337fe8c68a45aa10ca898e39c2d195ef244bb657755327366
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          msedgeupdateres_fil.dll
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\msedgeupdateres_fil.dll
                                                          • Size 29KB
                                                          • SHA256 6b982a78ff95831477342ed6935dbd3abd1f730dd9bf364afc2556ce6a3afd50
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          msedgeupdateres_fr-CA.dll
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\msedgeupdateres_fr-CA.dll
                                                          • Size 30KB
                                                          • SHA256 6f6eef8c4afb0deee2497a55854f10407a69dd76e2211c83dc33546f6917a7ad
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          msedgeupdateres_fr.dll
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\msedgeupdateres_fr.dll
                                                          • Size 30KB
                                                          • SHA256 f3cfc3eecf03e256dd6df7d95fae127a4e2c86f3dce58545ae16c422fa8f562b
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          msedgeupdateres_ga.dll
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\msedgeupdateres_ga.dll
                                                          • Size 28KB
                                                          • SHA256 f595794586d38fd55bee18c9dbd21c87d33dfc0d03dfe87ade8b0bef5e97252e
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          msedgeupdateres_gd.dll
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\msedgeupdateres_gd.dll
                                                          • Size 30KB
                                                          • SHA256 248bb8fba661f7b7d4045331d1e4ad808ffe8f446f732c14d2f3a6857f0ebd4e
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          msedgeupdateres_gl.dll
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\msedgeupdateres_gl.dll
                                                          • Size 28KB
                                                          • SHA256 cb37f5288928cf0a89f7711366b70c943f7e6ade43e73b8bfee5e1660cc54032
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          msedgeupdateres_gu.dll
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\msedgeupdateres_gu.dll
                                                          • Size 29KB
                                                          • SHA256 faf2d0d88df753be0de3fa0218b78c3582947ead0be012c0af30f863cb3dda2d
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          msedgeupdateres_hi.dll
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\msedgeupdateres_hi.dll
                                                          • Size 28KB
                                                          • SHA256 4e2b724f581f3eeb2a3bb7c561d635741f515bc01be84c9d6ae245e5c7ddd37b
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          msedgeupdateres_hr.dll
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\msedgeupdateres_hr.dll
                                                          • Size 29KB
                                                          • SHA256 10e40940f8dc323c6e1fea3f625de0cf2efaceb266b64e81cfa66a2eb51d1f0d
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          msedgeupdateres_hu.dll
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\msedgeupdateres_hu.dll
                                                          • Size 29KB
                                                          • SHA256 7cf8997e700cbb81931bc9becf7d0887db7477d97c9f88718c0c2d7849310048
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          msedgeupdateres_id.dll
                                                          • Path C:\Program Files (x86)\Microsoft\Temp\EUF9F0.tmp\msedgeupdateres_id.dll
                                                          • Size 27KB
                                                          • SHA256 57b01bc5a7b4e8c656b08c89213278f81ce264cc399999e76733ddd90c580f26
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          settings.dat
                                                          • Path C:\Program Files\MsEdgeCrashpad\settings.dat
                                                          • Size 280B
                                                          • SHA256 632d1d841d8fd8a1f65f782438bf3ea9c44d426ba23e6103ca4ef67c40afb81a
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          settings.dat
                                                          • Path C:\Program Files\MsEdgeCrashpad\settings.dat
                                                          • Size 280B
                                                          • SHA256 81e20aff388d67fe444ec032aaaafef33fa9b7647cb874d32aa8acbb88930421
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          ProtonVPN.Launcher.exe
                                                          • Path C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe
                                                          • Size 11.7MB
                                                          • SHA256 ed3c8d4f6703e1138f22d4df73dfe50ec31474cf126ba9fbc590a37077ae99b6
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          ProtonVPNService.deps.json
                                                          • Path C:\Program Files\Proton\VPN\v3.2.11\ProtonVPNService.deps.json
                                                          • Size 172KB
                                                          • SHA256 212e78448f79af44d6b55a53f3a3e69d43ed20d8676e1b2ff1abc750b7e3c729
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          is-67UFG.tmp
                                                          • Path C:\Program Files\Proton\VPN\v3.2.11\is-67UFG.tmp
                                                          • Size 540B
                                                          • SHA256 1b8a0096c02b3f1ddf6756a3b112b4e5a3ff7698b8500eadd28298837387c60b
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          is-J90KD.tmp
                                                          • Path C:\Program Files\Proton\VPN\v3.2.11\is-J90KD.tmp
                                                          • Size 453B
                                                          • SHA256 a0eb69194b1819658ba615351a79859707d3a5cab440bdfc26e015a64ddc7b82
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          is-KR0R4.tmp
                                                          • Path C:\Program Files\Proton\VPN\v3.2.11\is-KR0R4.tmp
                                                          • Size 267B
                                                          • SHA256 3de6b890d0878014ac37f4807f8354d479c6e4ae6f96452564049379b57d0484
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          MicrosoftEdgeUpdate.log
                                                          • Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
                                                          • Size 107KB
                                                          • SHA256 1fe2f1eedd324105611346d6c9c4439c41e90b981ceef3391e16590fbf873c24
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          settings.dat
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                          • Size 152B
                                                          • SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          settings.dat
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                          • Size 152B
                                                          • SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          the-real-index
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                          • Size 456B
                                                          • SHA256 bef943bdc513acc5d131cdac737fa75025ef70c9a5756b3ab7cc35083822aaf9
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          Network Persistent State
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                          • Size 340B
                                                          • SHA256 88161588cde1a1aa6c056756db92ca81d08d75abbce9c29bc0d9037ed39acc2a
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          Preferences
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                          • Size 5KB
                                                          • SHA256 efd98205c2eea4a3cef42e70fa6b2758284fdae92010e6e60ed2eaefb8897c4c
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          Preferences
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                          • Size 6KB
                                                          • SHA256 00f096d023f9d129351d11207308d08d707f93c55ca4acf6413473c1f226725a
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          Preferences
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                          • Size 6KB
                                                          • SHA256 b063d9c2f5246a6731a27a59e8b9a395b41643dfffae3c1a56860bd85722d2ab
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          Preferences
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                          • Size 6KB
                                                          • SHA256 4f89369141c7738a8c1084202fc2d9a382efc630704c573d729b009e6cff16e4
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          CURRENT
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                          • Size 16B
                                                          • SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          Local State
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                          • Size 11KB
                                                          • SHA256 f1f9fbc1c285de9aebf021e0d1b5a86e79109d0d6d70aa6aa12d17e939e8bdce
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          Local State
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                          • Size 12KB
                                                          • SHA256 cca340869f4916a925ae853a543fbab3d63f6e5197a7c2d29e5594716a9806c3
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          Local State
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                          • Size 11KB
                                                          • SHA256 75fc3c321b8defb18960c0a2ce34230555c187d1bd5a838ecfd3b5558bc96f64
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          0c4wgtks.newcfg
                                                          • Path C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\0c4wgtks.newcfg
                                                          • Size 1KB
                                                          • SHA256 ed598b79200e9c090d2c23744c3073eeaafaeb8375a65304bd3b81fc41b78edd
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          2xibddts.newcfg
                                                          • Path C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\2xibddts.newcfg
                                                          • Size 1KB
                                                          • SHA256 fd36025a55e26feece8114f733e74ca469d5ae38762d05d5a2a22388692e500f
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          5afyly1s.newcfg
                                                          • Path C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\5afyly1s.newcfg
                                                          • Size 1KB
                                                          • SHA256 b9e304b05c9ed57f9427ced0fdbf16dda64aee87cbf104c8c66166f1e8bb6c06
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          b1ptjq03.newcfg
                                                          • Path C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\b1ptjq03.newcfg
                                                          • Size 1KB
                                                          • SHA256 9d8868773e63f54c16b05c47281d8bcfbbd9f2b8e71d9e9f926d28353f34af36
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          e4myntlu.newcfg
                                                          • Path C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\e4myntlu.newcfg
                                                          • Size 1KB
                                                          • SHA256 4e0e6f2e178a679fceca6299c0cfeb83391fc0dec3fd2c52b8d6551df12316bb
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          ii4ruz5e.newcfg
                                                          • Path C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\ii4ruz5e.newcfg
                                                          • Size 1KB
                                                          • SHA256 3e62127f9ee292f420fc846287d91b6f23fc589165cb87829f1f273c0e1b09b4
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          kdeqtmaa.newcfg
                                                          • Path C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\kdeqtmaa.newcfg
                                                          • Size 1KB
                                                          • SHA256 4e2754843c6267b012fa1d8cc38c2c5194172ea6e880f0f8f1e2a8fbd526b292
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          leww0xch.newcfg
                                                          • Path C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\leww0xch.newcfg
                                                          • Size 2KB
                                                          • SHA256 e37fae0a97c4c2c5a136d192fc8a3845ad1568c2ac05c39ed0bc4ca0e2257486
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          mffq2vsb.newcfg
                                                          • Path C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\mffq2vsb.newcfg
                                                          • Size 1KB
                                                          • SHA256 239d410238053c57e84476afe5194ea4551b937a5a3e0d6c7f65daa7c40089ee
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          onztgvcl.newcfg
                                                          • Path C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\onztgvcl.newcfg
                                                          • Size 1KB
                                                          • SHA256 225b712637f4fc2294ab247817eae2b2ff997e61ccb1515e0c9a8afd34d871c4
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          ph1m4jq5.newcfg
                                                          • Path C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\ph1m4jq5.newcfg
                                                          • Size 1KB
                                                          • SHA256 5ce903e58a452e705f0108783679523882799875b67c1b58d779c963c92a81b8
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          pme5y5ap.newcfg
                                                          • Path C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\pme5y5ap.newcfg
                                                          • Size 1KB
                                                          • SHA256 59ac703b6faf45e28ef6d665a8e6f1bb414cf53c52dedad047572a6d7e3f8d64
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          qsxgrmeh.newcfg
                                                          • Path C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\qsxgrmeh.newcfg
                                                          • Size 5KB
                                                          • SHA256 efdd9527d2ee217298e8f902f3b164c0f1b3c77c5e0b5d60e5253880abed007a
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          syfoonif.newcfg
                                                          • Path C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\syfoonif.newcfg
                                                          • Size 1KB
                                                          • SHA256 7ac4953d74d53c34c5802babf1dde2d425a7a45a4e5126b9ba4a6fc6c4f46130
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          user.config
                                                          • Path C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\user.config
                                                          • Size 1KB
                                                          • SHA256 0e0e8e0c97eeb3656379d2924b729ca29dc8c1790c9e8fc50f61d2ddb43f26f4
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          wiat0j21.newcfg
                                                          • Path C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\wiat0j21.newcfg
                                                          • Size 1KB
                                                          • SHA256 ce805995fb4efa40d8d0cba537dae3f8cbef9b76933dbacf155df19d9fee712b
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          xdvdmkgm.newcfg
                                                          • Path C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\xdvdmkgm.newcfg
                                                          • Size 1KB
                                                          • SHA256 c45f69e34ad0bcfb4e4db5674e8cd75195b11828373eb257b7a7028387df0681
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          yiyntdjf.newcfg
                                                          • Path C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\yiyntdjf.newcfg
                                                          • Size 1KB
                                                          • SHA256 012cb7b2b5ae6e59b2b08945a7cb3f1008f6435a9cc341347354f71e528600a7
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          ywx21lhq.newcfg
                                                          • Path C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\ywx21lhq.newcfg
                                                          • Size 1KB
                                                          • SHA256 b992734233be8d3c0ddc88c0d0b8f233eb419322ea9dc305b33f4a14439f0b3e
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          zc2xzc3u.newcfg
                                                          • Path C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\zc2xzc3u.newcfg
                                                          • Size 1KB
                                                          • SHA256 0563289f927756743267f676024869da32e3a9ca156ef6e0ad86d85012427ee5
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          Setup Log 2024-06-03 #001.txt
                                                          • Path C:\Users\Admin\AppData\Local\Temp\Setup Log 2024-06-03 #001.txt
                                                          • Size 226KB
                                                          • SHA256 cbeaad4903748bf6354d05fd651cd0a67040204ac8cd5fc0df55d4051e060ed6
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          MicrosoftEdgeWebview2Setup.exe
                                                          • Path C:\Users\Admin\AppData\Local\Temp\is-M1JK5.tmp\MicrosoftEdgeWebview2Setup.exe
                                                          • Size 1.5MB
                                                          • SHA256 34efce66f80ccdf56ec4697d323922ca751c783099b9e0d1a38eec054776182f
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          ProtonVPN.InstallActions.x86.dll
                                                          • Path C:\Users\Admin\AppData\Local\Temp\is-M1JK5.tmp\ProtonVPN.InstallActions.x86.dll
                                                          • Size 562KB
                                                          • SHA256 efff858e17d6a82ffd1b34445884208305e31c36c6a9cef509f67f0cc2d7e369
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          ProtonVPN_v3.2.11.tmp
                                                          • Path C:\Users\Admin\AppData\Local\Temp\is-SL4GL.tmp\ProtonVPN_v3.2.11.tmp
                                                          • Size 3.4MB
                                                          • SHA256 587896eddddc7554571fbfa9e430a99176b06f56fc74fb15d1054790f01a058d
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          MSI217.tmp
                                                          • Path C:\Windows\Installer\MSI217.tmp
                                                          • Size 394KB
                                                          • SHA256 50bbf22db97433456a4307211b99641740f20a6421bcee32216fa888feaa7b2c
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          MSIFE2C.tmp
                                                          • Path C:\Windows\Installer\MSIFE2C.tmp
                                                          • Size 328KB
                                                          • SHA256 0d8ca90a8191d243d517b411da2ee4223b21533a68ae0da2a44c7f9ed053b753
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          CustomAction.config
                                                          • Path C:\Windows\Installer\SFXCAB296D92AC64CCE0B1D40A2B2C2386F28\CustomAction.config
                                                          • Size 959B
                                                          • SHA256 7e1096d6f39ebe04d6e38bc714983af05ed92cc2bb4d3365ed4c85e733cb145c
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          ProtonDrive.Installer.Extensions.dll
                                                          • Path C:\Windows\Installer\SFXCAB296D92AC64CCE0B1D40A2B2C2386F28\ProtonDrive.Installer.Extensions.dll
                                                          • Size 7KB
                                                          • SHA256 e35b22864e8cd869261becd0c99fbcc4a94a9cc71f7ead6dfefeb952d6fae7ce
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          WixToolset.Dtf.WindowsInstaller.dll
                                                          • Path C:\Windows\Installer\SFXCAB296D92AC64CCE0B1D40A2B2C2386F28\WixToolset.Dtf.WindowsInstaller.dll
                                                          • Size 195KB
                                                          • SHA256 04ff498139c67cccb791ce0a6a2dc38792149fa94516736689bc224f026bde35
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          Proton Drive Setup 1.5.4 (8fffdc42).exe
                                                          • Path C:\Windows\Temp\{CDA63A03-FFB5-4470-8AAE-E2832B22C347}\.be\Proton Drive Setup 1.5.4 (8fffdc42).exe
                                                          • Size 1.3MB
                                                          • SHA256 07024c422d31d777cfd6d49a7084edbe77b37758e0caed30b0d9f838f29a04b9
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          memory/640-433-0x0000000072A30000-0x0000000072C4F000-memory.dmp
                                                          Download

                                                          memory/640-535-0x0000000000260000-0x0000000000295000-memory.dmp
                                                          Download

                                                          memory/640-383-0x0000000000260000-0x0000000000295000-memory.dmp
                                                          Download

                                                          memory/640-384-0x0000000072A30000-0x0000000072C4F000-memory.dmp
                                                          Download

                                                          memory/644-2219-0x000001B057920000-0x000001B057954000-memory.dmp
                                                          Download

                                                          memory/644-2221-0x000001B057790000-0x000001B057796000-memory.dmp
                                                          Download

                                                          memory/5916-166-0x0000000000400000-0x000000000051F000-memory.dmp
                                                          Download

                                                          memory/5916-198-0x0000000000400000-0x000000000051F000-memory.dmp
                                                          Download

                                                          memory/5916-1840-0x0000000000400000-0x000000000051F000-memory.dmp
                                                          Download

                                                          memory/6016-373-0x0000000000400000-0x0000000000767000-memory.dmp
                                                          Download

                                                          memory/6016-182-0x00000000023B0000-0x00000000024F0000-memory.dmp
                                                          Download

                                                          memory/6016-1771-0x0000000000400000-0x0000000000767000-memory.dmp
                                                          Download

                                                          memory/6016-199-0x0000000000400000-0x0000000000767000-memory.dmp
                                                          Download

                                                          memory/6016-1839-0x0000000000400000-0x0000000000767000-memory.dmp
                                                          Download