Overview

overview

10

Static

static

1

ProtonVPN_...64.exe

windows10-2004-x64

10

ProtonVPN_...64.exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/06/2026, 15:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ProtonVPN_v4.4.1_x64.exe
  • Size 121.0MB
  • Sample260623-tebtfses5s
  • SHA256 b0d9a4330712601fca4219508a12989fdb536779c93040832ff87559fccf4882
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryinstallerpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Reads ssh keys stored on the system 2 TTPs

    Tries to access SSH used by SSH programs.

    spywarestealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 28 IoCs
  • Executes dropped EXE 33 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 15 IoCs
  • Suspicious use of SendNotifyMessage 11 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3436
      • C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v4.4.1_x64.exe
        "C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v4.4.1_x64.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:6084
        • C:\Users\Admin\AppData\Local\Temp\is-PA9X0G8U6K.tmp\ProtonVPN_v4.4.1_x64.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-PA9X0G8U6K.tmp\ProtonVPN_v4.4.1_x64.tmp" /SL5="$502CC,125577697,1139200,C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v4.4.1_x64.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2956
          • C:\Users\Admin\AppData\Local\Temp\is-0WWYGH8QSG.tmp\VC_redist.x64.exe
            "C:\Users\Admin\AppData\Local\Temp\is-0WWYGH8QSG.tmp\VC_redist.x64.exe" /install /quiet /norestart
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1852
            • C:\Windows\Temp\{94B4018F-EA0E-4E01-B267-B0F72AD23CE1}\.cr\VC_redist.x64.exe
              "C:\Windows\Temp\{94B4018F-EA0E-4E01-B267-B0F72AD23CE1}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-0WWYGH8QSG.tmp\VC_redist.x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /install /quiet /norestart
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3604
              • C:\Windows\Temp\{441A811E-3EB8-4212-A7E6-5265D5D3F3BA}\.be\VC_redist.x64.exe
                "C:\Windows\Temp\{441A811E-3EB8-4212-A7E6-5265D5D3F3BA}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{8CC9D16F-621F-48B1-8DF9-4720899C7E37} {7B974662-5FD8-4166-B148-930040E4EC21} 3604
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4376
          • C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe
            "C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe" -MailInstalled -DriveInstalled -PassInstalled -Language en-US -CleanInstall
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4264
            • C:\Program Files\Proton\VPN\v4.4.1\ProtonVPN.Client.exe
              "v4.4.1\ProtonVPN.Client.exe" -MailInstalled -DriveInstalled -PassInstalled -Language en-US -CleanInstall
              5⤵
              • Adds Run key to start application
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies Control Panel
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:5860
      • C:\Program Files\Proton\VPN\v4.4.1\ProtonInstaller.exe
        C:\Program Files\Proton\VPN\v4.4.1\ProtonInstaller.exe /Mail /Drive /Pass /CreateDesktopShortcut
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2944
        • C:\Users\Admin\AppData\Local\Temp\Proton%20Drive%20Setup%203.0.1.exe
          "C:\Users\Admin\AppData\Local\Temp\Proton%20Drive%20Setup%203.0.1.exe" Source=vpn /quiet NoAppDataCleanup=1 NoAutoLaunch=1
          3⤵
          • Adds Run key to start application
          • Executes dropped EXE
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4636
          • C:\Windows\TEMP\{AD0A8A64-E3E2-4A99-B85C-7F476FC8E2BE}\.ba\wixprqba.exe
            "C:\Windows\TEMP\{AD0A8A64-E3E2-4A99-B85C-7F476FC8E2BE}\.ba\wixprqba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{ED9D4434-45B3-41A3-B968-C98C823F8D5D} {74B76325-36C1-4525-92BD-DA763C7139E5}
            4⤵
            • Executes dropped EXE
            PID:1516
          • C:\Windows\TEMP\{AD0A8A64-E3E2-4A99-B85C-7F476FC8E2BE}\.ba\wixiuiba.exe
            "C:\Windows\TEMP\{AD0A8A64-E3E2-4A99-B85C-7F476FC8E2BE}\.ba\wixiuiba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{B3BB9B33-1CE2-4075-886C-538DBC87132D} {5C0F9C82-7638-4146-BDB7-4C76E8FA9B5B}
            4⤵
            • Executes dropped EXE
            PID:4644
        • C:\Users\Admin\AppData\Local\Temp\ProtonPass_Setup_1.37.0.exe
          "C:\Users\Admin\AppData\Local\Temp\ProtonPass_Setup_1.37.0.exe" --source=vpn --silent=1 --auto-launch=0
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3104
          • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
            "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install . --source=vpn --silent=1 --auto-launch=0
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4860
            • C:\Users\Admin\AppData\Local\ProtonPass\app-1.37.0\Squirrel.exe
              "C:\Users\Admin\AppData\Local\ProtonPass\app-1.37.0\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
              5⤵
              • Executes dropped EXE
              PID:2472
            • C:\Users\Admin\AppData\Local\ProtonPass\app-1.37.0\ProtonPass.exe
              "C:\Users\Admin\AppData\Local\ProtonPass\app-1.37.0\ProtonPass.exe" --squirrel-install 1.37.0 --source="vpn" --desktop-shortcut=1
              5⤵
              • Executes dropped EXE
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:4484
              • C:\Users\Admin\AppData\Local\ProtonPass\Update.exe
                C:\Users\Admin\AppData\Local\ProtonPass\Update.exe --createShortcut=ProtonPass.exe --shortcut-locations=Desktop,StartMenu
                6⤵
                • Executes dropped EXE
                PID:1724
              • C:\Users\Admin\AppData\Local\ProtonPass\app-1.37.0\ProtonPass.exe
                "C:\Users\Admin\AppData\Local\ProtonPass\app-1.37.0\ProtonPass.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Proton Pass" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1808,i,2949801208447155668,1564465139173685348,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1804 /prefetch:2
                6⤵
                • Executes dropped EXE
                PID:4156
              • C:\Users\Admin\AppData\Local\ProtonPass\app-1.37.0\ProtonPass.exe
                "C:\Users\Admin\AppData\Local\ProtonPass\app-1.37.0\ProtonPass.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Proton Pass" --field-trial-handle=1808,i,2949801208447155668,1564465139173685348,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2016 /prefetch:11
                6⤵
                • Executes dropped EXE
                PID:2108
              • C:\Users\Admin\AppData\Local\ProtonPass\app-1.37.0\ProtonPass.exe
                "C:\Users\Admin\AppData\Local\ProtonPass\app-1.37.0\ProtonPass.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Proton Pass" --app-user-model-id=com.squirrel.ProtonPass.ProtonPass --app-path="C:\Users\Admin\AppData\Local\ProtonPass\app-1.37.0\resources\app.asar" --enable-sandbox --disable-blink-features=Auxclick --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1808,i,2949801208447155668,1564465139173685348,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2704 /prefetch:1
                6⤵
                • Executes dropped EXE
                PID:5524
        • C:\Users\Admin\AppData\Local\Temp\ProtonMail-desktop.exe
          "C:\Users\Admin\AppData\Local\Temp\ProtonMail-desktop.exe" --source=vpn --silent=1 --auto-launch=0
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3652
          • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
            "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install . --source=vpn --silent=1 --auto-launch=0
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3528
            • C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Squirrel.exe
              "C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
              5⤵
              • Executes dropped EXE
              PID:2904
            • C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe
              "C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe" --squirrel-install 1.13.3 --source="vpn" --desktop-shortcut=1
              5⤵
              • Executes dropped EXE
              • Checks processor information in registry
              • Suspicious use of WriteProcessMemory
              PID:4944
              • C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe
                "C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Proton Mail" /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Proton Mail\Crashpad" --url=https://mail-api.proton.me/core/v4/reports/sentry/api/54/minidump/?sentry_key=8c45c7615ac54aed9a6747430e0a5d8e "--annotation=_productName=Proton Mail" --annotation=_version=1.13.3 --annotation=plat=Win64 --annotation=prod=Electron "--annotation=sentry___initialScope={\"release\":\"[email protected]+packaged\",\"environment\":\"proton.me\"}" --annotation=ver=40.10.1 --initial-client-data=0x49c,0x4a8,0x4ac,0x4a4,0x4b0,0x7ff7450d5a0c,0x7ff7450d5a18,0x7ff7450d5a28
                6⤵
                • Executes dropped EXE
                PID:5380
              • C:\Users\Admin\AppData\Local\proton_mail\Update.exe
                C:\Users\Admin\AppData\Local\proton_mail\Update.exe "--createShortcut=Proton Mail.exe" --shortcut-locations=Desktop,StartMenu
                6⤵
                • Executes dropped EXE
                PID:5576
              • C:\Windows\System32\reg.exe
                C:\Windows\System32\reg.exe import C:\Users\Admin\AppData\Local\Temp\protonmail-mailto-register.reg
                6⤵
                • Modifies registry class
                PID:2560
              • C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe
                "C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Proton Mail" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=2096,i,8580368939024580714,18105034018412912898,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2128 /prefetch:11
                6⤵
                • Executes dropped EXE
                PID:1764
              • C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe
                "C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Proton Mail" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2096,i,8580368939024580714,18105034018412912898,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2092 /prefetch:2
                6⤵
                • Executes dropped EXE
                PID:4052
    • C:\Program Files\Proton\VPN\v4.4.1\ProtonVPNService.exe
      "C:\Program Files\Proton\VPN\v4.4.1\ProtonVPNService.exe"
      1⤵
      • Executes dropped EXE
      PID:3680
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:2952
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5096
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:3880
      • C:\Program Files\Proton\VPN\v4.4.1\ProtonVPNService.exe
        "C:\Program Files\Proton\VPN\v4.4.1\ProtonVPNService.exe"
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2460
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Adds Run key to start application
        • Enumerates connected drives
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3524
        • C:\Windows\System32\MsiExec.exe
          C:\Windows\System32\MsiExec.exe -Embedding DEAB4903F7DCEAEA1218B8AB51B13828
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4936
          • C:\Windows\system32\rundll32.exe
            rundll32.exe "C:\Windows\Installer\MSI6E1D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240807515 2 ProtonDrive.Installer.Extensions!ProtonDrive.Installer.Extensions.CustomActions.QueryUserProgramFilesFolder
            3⤵
            • Drops file in Windows directory
            PID:2648
          • C:\Windows\system32\rundll32.exe
            rundll32.exe "C:\Windows\Installer\MSI6F37.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240807750 6 ProtonDrive.Installer.Extensions!ProtonDrive.Installer.Extensions.CustomActions.HideCancelButton
            3⤵
            • Drops file in Windows directory
            PID:2520
          • C:\Windows\system32\rundll32.exe
            rundll32.exe "C:\Windows\Installer\MSI6FD4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240807921 11 ProtonDrive.Installer.Extensions!ProtonDrive.Installer.Extensions.CustomActions.DoPerMachineUpgradeSupportActions
            3⤵
            • Drops file in Windows directory
            PID:2352
      • C:\Users\Admin\AppData\Local\Package Cache\{2ED7693C-1538-4C96-8078-397F800EA406}\Proton Drive Setup 3.0.1 (2967a9cd) (x64).exe
        "C:\Users\Admin\AppData\Local\Package Cache\{2ED7693C-1538-4C96-8078-397F800EA406}\Proton Drive Setup 3.0.1 (2967a9cd) (x64).exe" /burn.runonce
        1⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2532
        • C:\Users\Admin\AppData\Local\Package Cache\{2ED7693C-1538-4C96-8078-397F800EA406}\Proton Drive Setup 3.0.1 (2967a9cd) (x64).exe
          "C:\Users\Admin\AppData\Local\Package Cache\{2ED7693C-1538-4C96-8078-397F800EA406}\Proton Drive Setup 3.0.1 (2967a9cd) (x64).exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Proton_Drive_20260623165949.log" /quiet Source=vpn NoAppDataCleanup=1 NoAutoLaunch=1 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Proton_Drive_20260623165949.log" /quiet Source=vpn NoAppDataCleanup=1 NoAutoLaunch=1
          2⤵
          • Adds Run key to start application
          • Executes dropped EXE
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:6104
          • C:\Windows\TEMP\{1A8A97C4-1F83-47ED-A204-A54F4C235EFB}\.ba\wixprqba.exe
            "C:\Windows\TEMP\{1A8A97C4-1F83-47ED-A204-A54F4C235EFB}\.ba\wixprqba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{50D29157-1EBC-4653-BDF3-3B78B87A2B02} {B1C94106-AF28-4E03-9B6F-BDC136E5AA2A}
            3⤵
            • Executes dropped EXE
            PID:5508
          • C:\Windows\TEMP\{1A8A97C4-1F83-47ED-A204-A54F4C235EFB}\.ba\wixiuiba.exe
            "C:\Windows\TEMP\{1A8A97C4-1F83-47ED-A204-A54F4C235EFB}\.ba\wixiuiba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{2D452A74-17F1-41E4-A6B2-FA32E8E4C76B} {36C05820-3536-4281-A2E2-20F3D0C2F796}
            3⤵
            • Executes dropped EXE
            PID:3776
      • C:\Users\Admin\AppData\Local\Programs\Proton\Drive\ProtonDrive.exe
        "C:\Users\Admin\AppData\Local\Programs\Proton\Drive\ProtonDrive.exe" -quiet
        1⤵
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:476

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Event Triggered Execution

            1
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Event Triggered Execution

            1
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Defense Evasion

            Modify Registry

            1
            T1112

            Credential Access

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Peripheral Device Discovery

            2
            T1120

            Query Registry

            4
            T1012

            System Information Discovery

            4
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e5a6844.rbs
            • Path C:\Config.Msi\e5a6844.rbs
            • Size 21KB
            • SHA256 8e5995ae8ddcaf3e613cf5ba6e698792e53cbd89134a1a43c65c8768b57a8b91
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ProtonVPN.Launcher.exe
            • Path C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe
            • Size 17.9MB
            • SHA256 fca85ac5052e62f7aab2b7c199e13df2f2330483134c5926c99f61c9af7586d6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CoreMessagingXP.dll
            • Path C:\Program Files\Proton\VPN\v4.4.1\CoreMessagingXP.dll
            • Size 1018KB
            • SHA256 2b1d604460a7d44b5e555e9e3068785b96287b034cb120ecc3290fb70260c762
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Internal.FrameworkUdk.dll
            • Path C:\Program Files\Proton\VPN\v4.4.1\Microsoft.Internal.FrameworkUdk.dll
            • Size 905KB
            • SHA256 51dc87180623b78bcd4933bfbc40ea7bd42efc25a3e5c2b34a47c850a7d0a805
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.UI.Windowing.Core.dll
            • Path C:\Program Files\Proton\VPN\v4.4.1\Microsoft.UI.Windowing.Core.dll
            • Size 530KB
            • SHA256 ca0015abf1533f2f3357c8a6480a6ceb2adda66810f0d5d257da33ef13e3315c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.UI.Xaml.dll
            • Path C:\Program Files\Proton\VPN\v4.4.1\Microsoft.UI.Xaml.dll
            • Size 14.3MB
            • SHA256 f4084263744c5dd5c37cc7dbd1f6a26ad7acf989e306184359b4377f3435319b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.WinUI.dll
            • Path C:\Program Files\Proton\VPN\v4.4.1\Microsoft.WinUI.dll
            • Size 7.0MB
            • SHA256 b745cc38595f48f6b33c02eefc5d5df15a7759ea9e918ce1c18ddf3eb050ce38
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.WindowsAppRuntime.dll
            • Path C:\Program Files\Proton\VPN\v4.4.1\Microsoft.WindowsAppRuntime.dll
            • Size 2.2MB
            • SHA256 8d593c4374b193b18ba37b8be8cce093ae4f247423c127ee9c09a63ded3dbb64
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ProtonInstaller.exe
            • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonInstaller.exe
            • Size 6.0MB
            • SHA256 73b8708d5035cfde020747e7e62e34ad6e2b187415fa5e33a951affaf7a624c9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ProtonVPN.Client.deps.json
            • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonVPN.Client.deps.json
            • Size 559KB
            • SHA256 bf0d1e1f2095051668d878f21b2aff740703d068674d126ab35428b8ae4e89ad
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ProtonVPN.Client.dll
            • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonVPN.Client.dll
            • Size 3.0MB
            • SHA256 f4fc38ed924833fdd5e00aa6b9fc47165130a1a8f0ca72eb3d2a0247fb39ba06
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ProtonVPN.Client.exe
            • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonVPN.Client.exe
            • Size 589KB
            • SHA256 dd49422f35b76ebcd4d9a60a300b0eb4e427185bfd9fe3ad45320d8a97595742
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ProtonVPN.Common.Core.dll
            • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonVPN.Common.Core.dll
            • Size 66KB
            • SHA256 94143bfae0c009201778ac6164c11089a0f575d6c71e01ba37b34a5839f3d840
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ProtonVPNService.deps.json
            • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonVPNService.deps.json
            • Size 375KB
            • SHA256 3d786b7dcd1ae5099d245f9fa009194cc19432838d63db44f4fb30dbc593ba0f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ProtonVPNService.exe
            • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonVPNService.exe
            • Size 466KB
            • SHA256 29cd1f1c9b0f368739f6f7840f641480abeaa3f492a9325edb712dcdfb2016f0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ProtonVPNService.runtimeconfig.json
            • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonVPNService.runtimeconfig.json
            • Size 629B
            • SHA256 becb5e7dbe360a21ec893d5fbed565339094204adeb595a83cb2541e0fc99cb9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Sentry.dll
            • Path C:\Program Files\Proton\VPN\v4.4.1\Sentry.dll
            • Size 786KB
            • SHA256 983e82ccedac76fe39677bef1e93436bf6a696c39b83ec7591f4d472ecf6ccd0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Collections.Concurrent.dll
            • Path C:\Program Files\Proton\VPN\v4.4.1\System.Collections.Concurrent.dll
            • Size 269KB
            • SHA256 0b1545071db0e5e918035aa7103bf8864d504099c6083bed5db94f8657711d74
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Collections.dll
            • Path C:\Program Files\Proton\VPN\v4.4.1\System.Collections.dll
            • Size 253KB
            • SHA256 a3d31fea1ae85efdbf8cc510e3dada8d6144cf05cdf5c47f70bb4a36054c74ac
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Linq.dll
            • Path C:\Program Files\Proton\VPN\v4.4.1\System.Linq.dll
            • Size 529KB
            • SHA256 081b23576a9cdb180622191707b9f2dfcbbd0a2b3744d2633979ded32ba1f617
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Memory.dll
            • Path C:\Program Files\Proton\VPN\v4.4.1\System.Memory.dll
            • Size 153KB
            • SHA256 0550392de886d48bdc5fff6fef9590dd4954c926f765df17037670754d300fe2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.ObjectModel.dll
            • Path C:\Program Files\Proton\VPN\v4.4.1\System.ObjectModel.dll
            • Size 77KB
            • SHA256 62e0cd6e1585a1f5cd153e2832a03b6dafac0e0ab3331048e7f7bd3dd692f9c4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Private.CoreLib.dll
            • Path C:\Program Files\Proton\VPN\v4.4.1\System.Private.CoreLib.dll
            • Size 12.6MB
            • SHA256 29777d3e311415ec7d2f4233e8f44f180b47f1a1c260870714ac95936e52a004
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Runtime.CompilerServices.Unsafe.dll
            • Path C:\Program Files\Proton\VPN\v4.4.1\System.Runtime.CompilerServices.Unsafe.dll
            • Size 14KB
            • SHA256 13978df865f57310a6fd2a68b6b7c8c3add3e7d222335f191998429c65ebd7c7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Runtime.InteropServices.dll
            • Path C:\Program Files\Proton\VPN\v4.4.1\System.Runtime.InteropServices.dll
            • Size 93KB
            • SHA256 02f9e9969b29a027ac5fb9f24c681170413231fa8a84da2658120ca11e91b6dc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Runtime.dll
            • Path C:\Program Files\Proton\VPN\v4.4.1\System.Runtime.dll
            • Size 42KB
            • SHA256 126facb35c9ba044401173748825e1c4c1197aea7b68e443e2fe8b82fc6f0f5f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Threading.dll
            • Path C:\Program Files\Proton\VPN\v4.4.1\System.Threading.dll
            • Size 81KB
            • SHA256 b734d6a999a1d275ed30bf66e7532175aaae5ad40ffc9bd30ebab458de878b9a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WinRT.Runtime.dll
            • Path C:\Program Files\Proton\VPN\v4.4.1\WinRT.Runtime.dll
            • Size 516KB
            • SHA256 bcf3a14e8712a90837fc5c0d8c8a24696af2bd7f74e9767597ec81ededfb23db
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            clrjit.dll
            • Path C:\Program Files\Proton\VPN\v4.4.1\clrjit.dll
            • Size 1.7MB
            • SHA256 bd5936786cedc4119fa0508e41f5104ed351deae5c04c59e612f9c3a7b9aa65b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            coreclr.dll
            • Path C:\Program Files\Proton\VPN\v4.4.1\coreclr.dll
            • Size 4.8MB
            • SHA256 b600c8fdfe3210c55113dc9dc2a6f9e5630cb0b14f4efd8cc56e9d38df075e54
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hostfxr.dll
            • Path C:\Program Files\Proton\VPN\v4.4.1\hostfxr.dll
            • Size 357KB
            • SHA256 0a495d3a7befebf627a973760439da0f7f1f1667b99832f083664fac7641d2dc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hostpolicy.dll
            • Path C:\Program Files\Proton\VPN\v4.4.1\hostpolicy.dll
            • Size 397KB
            • SHA256 aec1393a96946d92ff061ce31a455559b773122218cd62af1df9a8328d60f70b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            is-53SKRKI5G8.tmp
            • Path C:\Program Files\Proton\VPN\v4.4.1\is-53SKRKI5G8.tmp
            • Size 245KB
            • SHA256 9f90955a42a154f2efcd564723e9c3be8d68e41185bfa01476d0adac30a40c7e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            me.proton.pass.nm.json
            • Path C:\Users\Admin\AppData\Local\NativeMessagingHosts\me.proton.pass.nm.json
            • Size 452B
            • SHA256 c4838afdc102bf222d9f416693f4eff6c6d19235e01fb1f25c770e1d0c192e93
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            squirrel.exe
            • Path C:\Users\Admin\AppData\Local\ProtonPass\app-1.37.0\squirrel.exe
            • Size 1.9MB
            • SHA256 fcb35e678a3e16729c6bc22573697c2e4a5be316c58eeb6f61b05d2e40981578
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            RELEASES
            • Path C:\Users\Admin\AppData\Local\ProtonPass\packages\RELEASES
            • Size 82B
            • SHA256 a7c4bb65d12b812bc628bf92d9c3f91f3a6331cf69bd2e436bd5658488af666d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            GlobalSettings.json
            • Path C:\Users\Admin\AppData\Local\Proton\Proton VPN\Storage\GlobalSettings.json
            • Size 16KB
            • SHA256 6b2af7d5a984acbacc8ec6168badfddd60f7b6a7a851ca4eefef3c8fc5911959
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ProtonVPN.InstallActions.x86.dll
            • Path C:\Users\Admin\AppData\Local\Temp\is-0WWYGH8QSG.tmp\ProtonVPN.InstallActions.x86.dll
            • Size 460KB
            • SHA256 87e106374a5612c02486e19ecca2ae67b482c72f2dac67855040d7cce994b220
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VC_redist.x64.exe
            • Path C:\Users\Admin\AppData\Local\Temp\is-0WWYGH8QSG.tmp\VC_redist.x64.exe
            • Size 17.7MB
            • SHA256 8995548dfffcde7c49987029c764355612ba6850ee09a7b6f0fddc85bdc5c280
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ProtonVPN_v4.4.1_x64.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\is-PA9X0G8U6K.tmp\ProtonVPN_v4.4.1_x64.tmp
            • Size 3.8MB
            • SHA256 94fa0009490e7e57a6bea8bb4d59eed1293e14f1040640af78d059366e7b53f3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            squirrel.exe
            • Path C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\squirrel.exe
            • Size 2.1MB
            • SHA256 578779193ceb774e78b5ff53d41a6b6a247f91b5873dc7424bdc81e85a8059aa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            RELEASES
            • Path C:\Users\Admin\AppData\Local\proton_mail\packages\RELEASES
            • Size 83B
            • SHA256 5566f03dd2d927e62d548f06149886d22144e04fcb01baab8595fc7016f3470e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Proton Drive.lnk
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Proton\Proton Drive.lnk
            • Size 1KB
            • SHA256 9063da50d848f990fe75e57eb050846a01dbdd68afe47d30644fc92838e98a4b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Proton Drive.lnk~RFe5a7c75.TMP
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Proton\Proton Drive.lnk~RFe5a7c75.TMP
            • Size 1KB
            • SHA256 d49a4fad740b33baf32cd92682b9155d6aa55873f185923a512f4412d0db1a5f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            index
            • Path C:\Users\Admin\AppData\Roaming\Proton Mail\Code Cache\wasm\index
            • Size 24B
            • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
            • MD5 SHA1 SHA512
            Submit Download

            Network Persistent State
            • Path C:\Users\Admin\AppData\Roaming\Proton Mail\Partitions\update\Network\Network Persistent State
            • Size 59B
            • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Network Persistent State
            • Path C:\Users\Admin\AppData\Roaming\Proton Mail\Partitions\update\Network\Network Persistent State
            • Size 111B
            • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            config.json
            • Path C:\Users\Admin\AppData\Roaming\Proton Mail\config.json
            • Size 216B
            • SHA256 e0d000358241777277ff4c733123cc08c5ccd3a482a63a8faf0f5044a609936c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            config.json
            • Path C:\Users\Admin\AppData\Roaming\Proton Mail\config.json
            • Size 395B
            • SHA256 285d7cf5f01706f2b4ba652e5a161722e866f4ef1b7f961b6f99967b016b608e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            config.json.tmp-22304407645023db
            • Path C:\Users\Admin\AppData\Roaming\Proton Mail\config.json.tmp-22304407645023db
            • Size 456B
            • SHA256 4b56ef4511103190e9066cc3185836d0f1529bf4c0dc25ff0d8946e4521a16a2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            main.log
            • Path C:\Users\Admin\AppData\Roaming\Proton Mail\logs\main.log
            • Size 2KB
            • SHA256 ced663a8951062f8fb7655bb47601b9664e99eb0a5a9ae049d38da685724c503
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            main.log
            • Path C:\Users\Admin\AppData\Roaming\Proton Mail\logs\main.log
            • Size 4KB
            • SHA256 a87f732bb75b9f025be4b145ea5641977dca8ac2fcc88736a1245d171ddde500
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CURRENT
            • Path C:\Users\Admin\AppData\Roaming\Proton Pass\Partitions\app\Session Storage\CURRENT
            • Size 16B
            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
            • MD5 SHA1 SHA512
            Submit Download

            MANIFEST-000001
            • Path C:\Users\Admin\AppData\Roaming\Proton Pass\Partitions\app\Session Storage\MANIFEST-000001
            • Size 41B
            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
            • MD5 SHA1 SHA512
            Submit Download

            config.json
            • Path C:\Users\Admin\AppData\Roaming\Proton Pass\config.json
            • Size 72B
            • SHA256 cc5529eefacf9ce27a0de14289a835010b99dd48d69036133a5c0114456cdcb2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            config.json
            • Path C:\Users\Admin\AppData\Roaming\Proton Pass\config.json
            • Size 131B
            • SHA256 6bc370eea9c8d01eb5a077682391c8dc97f736c4725c99501ac4551871bd1a99
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            config.json.tmp-22304204752f2ea8
            • Path C:\Users\Admin\AppData\Roaming\Proton Pass\config.json.tmp-22304204752f2ea8
            • Size 70B
            • SHA256 33fd41a041f3e00849e7e5c37948d9820cb5474dd1cef6ac99ad8ac74d3a7244
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Proton Drive.lnk
            • Path C:\Users\Admin\Desktop\Proton Drive.lnk
            • Size 1KB
            • SHA256 9fef7c81d9b99cd2604a35d19750b7708104d24259ca99420f2b38e62a8cf5cd
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Proton Drive.lnk~RFe5a7d6f.TMP
            • Path C:\Users\Admin\Desktop\Proton Drive.lnk~RFe5a7d6f.TMP
            • Size 1KB
            • SHA256 aafa4bfb17e3b8847f920d7a92d2b4359a049b6cd44083aec495993bc60b7b7a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            MSI6FD4.tmp
            • Path C:\Windows\Installer\MSI6FD4.tmp
            • Size 322KB
            • SHA256 b08b9280b7aace450f3b1282b4d7c04ad563a9c13489c464c679cef63ec81625
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSI7110.tmp
            • Path C:\Windows\Installer\MSI7110.tmp
            • Size 390KB
            • SHA256 7aacd4c18710e9bc4ff2034895a0a0c8f80f21809fb177d520e93f7688216e6d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CustomAction.config
            • Path C:\Windows\Installer\SFXCAEE3F6850D94A7B9A23C62E13D4361FC4\CustomAction.config
            • Size 959B
            • SHA256 7e1096d6f39ebe04d6e38bc714983af05ed92cc2bb4d3365ed4c85e733cb145c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ProtonDrive.Installer.Extensions.dll
            • Path C:\Windows\Installer\SFXCAEE3F6850D94A7B9A23C62E13D4361FC4\ProtonDrive.Installer.Extensions.dll
            • Size 7KB
            • SHA256 eef665fd2089e35e60f35a296547f0cea44600590f946bab0b6168e56acc78a7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WixToolset.Dtf.WindowsInstaller.dll
            • Path C:\Windows\Installer\SFXCAEE3F6850D94A7B9A23C62E13D4361FC4\WixToolset.Dtf.WindowsInstaller.dll
            • Size 193KB
            • SHA256 a614884ea627da1925131ebf41e8ae202caeac0fe543b86384f5eb2bfaf1aa75
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            logo.png
            • Path C:\Windows\Temp\{441A811E-3EB8-4212-A7E6-5265D5D3F3BA}\.ba\logo.png
            • Size 1KB
            • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            wixstdba.dll
            • Path C:\Windows\Temp\{441A811E-3EB8-4212-A7E6-5265D5D3F3BA}\.ba\wixstdba.dll
            • Size 215KB
            • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VC_redist.x64.exe
            • Path C:\Windows\Temp\{94B4018F-EA0E-4E01-B267-B0F72AD23CE1}\.cr\VC_redist.x64.exe
            • Size 615KB
            • SHA256 806e6252db45be78bfc064eb9a774dd1320d8f9aa70dd746996a1d9ddf9b8fd4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/1724-3027-0x0000000002EA0000-0x0000000002EC0000-memory.dmp
            Download

            memory/2472-2807-0x0000000000780000-0x0000000000976000-memory.dmp
            Download

            memory/2648-2576-0x000001F756F60000-0x000001F756F94000-memory.dmp
            Download

            memory/2648-2578-0x000001F73EE20000-0x000001F73EE26000-memory.dmp
            Download

            memory/2904-3155-0x0000000000F90000-0x00000000011AE000-memory.dmp
            Download

            memory/2956-2471-0x0000000000AE0000-0x0000000000EC1000-memory.dmp
            Download

            memory/2956-24-0x0000000004050000-0x0000000004190000-memory.dmp
            Download

            memory/2956-2458-0x0000000000AE0000-0x0000000000EC1000-memory.dmp
            Download

            memory/2956-6-0x0000000002BA0000-0x0000000002BA1000-memory.dmp
            Download

            memory/2956-12-0x0000000004050000-0x0000000004190000-memory.dmp
            Download

            memory/2956-2456-0x0000000000AE0000-0x0000000000EC1000-memory.dmp
            Download

            memory/2956-21-0x0000000002BA0000-0x0000000002BA1000-memory.dmp
            Download

            memory/2956-20-0x0000000000AE0000-0x0000000000EC1000-memory.dmp
            Download

            memory/2956-23-0x0000000000AE0000-0x0000000000EC1000-memory.dmp
            Download

            memory/2956-1145-0x0000000004050000-0x0000000004190000-memory.dmp
            Download

            memory/2956-1144-0x0000000000AE0000-0x0000000000EC1000-memory.dmp
            Download

            memory/3528-3061-0x0000000000F10000-0x00000000010E8000-memory.dmp
            Download

            memory/4484-3044-0x0000021EA9870000-0x0000021EA99BF000-memory.dmp
            Download

            memory/4860-2707-0x00000000003A0000-0x0000000000578000-memory.dmp
            Download

            memory/4944-3607-0x00000229929E0000-0x0000022992B2F000-memory.dmp
            Download

            memory/5524-3040-0x00007FF868070000-0x00007FF868071000-memory.dmp
            Download

            memory/5524-3037-0x00007FF868B10000-0x00007FF868B11000-memory.dmp
            Download

            memory/6084-2472-0x0000000000860000-0x0000000000985000-memory.dmp
            Download

            memory/6084-1-0x0000000000860000-0x0000000000985000-memory.dmp
            Download

            memory/6084-19-0x0000000000860000-0x0000000000985000-memory.dmp
            Download