Overview

overview

10

Static

static

1

ProtonVPN_...64.exe

windows10-2004-x64

10

ProtonVPN_...64.exe

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    151s
  • max time network
    120s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/07/2026, 03:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ProtonVPN_v4.4.1_x64.exe
  • Size 121.0MB
  • Sample260709-ea2fzsds2x
  • SHA256 b0d9a4330712601fca4219508a12989fdb536779c93040832ff87559fccf4882
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoveryinstallerpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 51 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 23 IoCs
  • Executes dropped EXE 14 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 10 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v4.4.1_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v4.4.1_x64.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4452
    • C:\Users\Admin\AppData\Local\Temp\is-78GL8ZW3AX.tmp\ProtonVPN_v4.4.1_x64.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-78GL8ZW3AX.tmp\ProtonVPN_v4.4.1_x64.tmp" /SL5="$B0252,125577697,1139200,C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v4.4.1_x64.exe"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4076
      • C:\Users\Admin\AppData\Local\Temp\is-1YOD9A537D.tmp\VC_redist.x64.exe
        "C:\Users\Admin\AppData\Local\Temp\is-1YOD9A537D.tmp\VC_redist.x64.exe" /install /quiet /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3088
        • C:\Windows\Temp\{3E00407D-CA48-405D-B489-9E58C57DB7FE}\.cr\VC_redist.x64.exe
          "C:\Windows\Temp\{3E00407D-CA48-405D-B489-9E58C57DB7FE}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-1YOD9A537D.tmp\VC_redist.x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /install /quiet /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4424
          • C:\Windows\Temp\{064B4CA1-9094-4DC3-A3BE-987A4235C575}\.be\VC_redist.x64.exe
            "C:\Windows\Temp\{064B4CA1-9094-4DC3-A3BE-987A4235C575}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{A437D88B-97A3-4E51-8F6C-ED3292EA40E3} {CBEBFF5D-A5B7-41C0-B323-6ADD609E6821} 4424
            5⤵
            • Adds Run key to start application
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            PID:3400
      • C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe
        "C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe" -Language en-US -CleanInstall
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4808
        • C:\Program Files\Proton\VPN\v4.4.1\ProtonVPN.Client.exe
          "v4.4.1\ProtonVPN.Client.exe" -Language en-US -CleanInstall
          4⤵
          • Adds Run key to start application
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies Control Panel
          • Modifies registry class
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:5624
  • C:\Program Files\Proton\VPN\v4.4.1\ProtonVPNService.exe
    "C:\Program Files\Proton\VPN\v4.4.1\ProtonVPNService.exe"
    1⤵
    • Executes dropped EXE
    PID:5136
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:1904
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
      PID:2880
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:5992
    • C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2452
      • C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe
        "C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260709044636.log" /install
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2516
        • C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe
          "C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260709044636.log" /install
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:852
          • C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe
            "C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{1198D299-FCDB-465F-A10F-8598B829E0AA} {46AF9BCE-62A2-4718-8E31-F9CA3B888CCA} 852
            4⤵
            • Adds Run key to start application
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:3164
            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00} -burn.filehandle.self=1008 -burn.embedded BurnPipe.{2B516D9E-8078-409B-89DF-E1FE81713C15} {DE72AD96-60CE-401D-A48D-2FDD7B78300B} 3164
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2756
              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=576 -burn.filehandle.self=596 -uninstall -quiet -burn.related.upgrade -burn.ancestors={91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00} -burn.filehandle.self=1008 -burn.embedded BurnPipe.{2B516D9E-8078-409B-89DF-E1FE81713C15} {DE72AD96-60CE-401D-A48D-2FDD7B78300B} 3164
                6⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3764
                • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{FCF16366-9638-4A4A-AED9-18FDD98E61FD} {27F8F93A-E617-4143-8D0C-195572C7F682} 3764
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:3048
    • C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe
      "C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4004
      • C:\Program Files\Proton\VPN\v4.4.1\ProtonVPN.Client.exe
        "v4.4.1\ProtonVPN.Client.exe"
        2⤵
        • Executes dropped EXE
        PID:2112
    • C:\Program Files\Proton\VPN\v4.4.1\ProtonVPNService.exe
      "C:\Program Files\Proton\VPN\v4.4.1\ProtonVPNService.exe"
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      PID:5356

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e5a5ea1.rbs
          • Path C:\Config.Msi\e5a5ea1.rbs
          • Size 19KB
          • SHA256 9084ab92af0159779a15e16231b01750aa39e558cf40716eeaaf20cc398cf6e6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5a5ead.rbs
          • Path C:\Config.Msi\e5a5ead.rbs
          • Size 19KB
          • SHA256 4f10ea82d18f3583701dbb06fde5335c1e6e92e3b95e51db564b9e89c1d738e5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5a5eb4.rbs
          • Path C:\Config.Msi\e5a5eb4.rbs
          • Size 21KB
          • SHA256 dcd6eba8af171e183ae16edfe1b912a24eef6d95e872bd5bdd50b7e2fffcbf93
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5a5ec3.rbs
          • Path C:\Config.Msi\e5a5ec3.rbs
          • Size 21KB
          • SHA256 55fce6eef063d39af19b0b3a47e693c1bb6ad68d17108c7de67069efb99f8a45
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ProtonVPN.Launcher.exe
          • Path C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe
          • Size 17.9MB
          • SHA256 fca85ac5052e62f7aab2b7c199e13df2f2330483134c5926c99f61c9af7586d6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.WinUI.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\Microsoft.WinUI.dll
          • Size 7.0MB
          • SHA256 b745cc38595f48f6b33c02eefc5d5df15a7759ea9e918ce1c18ddf3eb050ce38
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.WindowsAppRuntime.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\Microsoft.WindowsAppRuntime.dll
          • Size 2.2MB
          • SHA256 8d593c4374b193b18ba37b8be8cce093ae4f247423c127ee9c09a63ded3dbb64
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ProtonVPN.Client.deps.json
          • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonVPN.Client.deps.json
          • Size 559KB
          • SHA256 bf0d1e1f2095051668d878f21b2aff740703d068674d126ab35428b8ae4e89ad
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ProtonVPN.Client.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonVPN.Client.dll
          • Size 3.0MB
          • SHA256 f4fc38ed924833fdd5e00aa6b9fc47165130a1a8f0ca72eb3d2a0247fb39ba06
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ProtonVPN.Client.exe
          • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonVPN.Client.exe
          • Size 589KB
          • SHA256 dd49422f35b76ebcd4d9a60a300b0eb4e427185bfd9fe3ad45320d8a97595742
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ProtonVPN.Common.Core.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonVPN.Common.Core.dll
          • Size 66KB
          • SHA256 94143bfae0c009201778ac6164c11089a0f575d6c71e01ba37b34a5839f3d840
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ProtonVPNService.deps.json
          • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonVPNService.deps.json
          • Size 375KB
          • SHA256 3d786b7dcd1ae5099d245f9fa009194cc19432838d63db44f4fb30dbc593ba0f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ProtonVPNService.exe
          • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonVPNService.exe
          • Size 466KB
          • SHA256 29cd1f1c9b0f368739f6f7840f641480abeaa3f492a9325edb712dcdfb2016f0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ProtonVPNService.runtimeconfig.json
          • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonVPNService.runtimeconfig.json
          • Size 629B
          • SHA256 becb5e7dbe360a21ec893d5fbed565339094204adeb595a83cb2541e0fc99cb9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Sentry.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\Sentry.dll
          • Size 786KB
          • SHA256 983e82ccedac76fe39677bef1e93436bf6a696c39b83ec7591f4d472ecf6ccd0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Collections.Concurrent.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\System.Collections.Concurrent.dll
          • Size 269KB
          • SHA256 0b1545071db0e5e918035aa7103bf8864d504099c6083bed5db94f8657711d74
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Collections.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\System.Collections.dll
          • Size 253KB
          • SHA256 a3d31fea1ae85efdbf8cc510e3dada8d6144cf05cdf5c47f70bb4a36054c74ac
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Linq.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\System.Linq.dll
          • Size 529KB
          • SHA256 081b23576a9cdb180622191707b9f2dfcbbd0a2b3744d2633979ded32ba1f617
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Memory.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\System.Memory.dll
          • Size 153KB
          • SHA256 0550392de886d48bdc5fff6fef9590dd4954c926f765df17037670754d300fe2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Private.CoreLib.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\System.Private.CoreLib.dll
          • Size 12.6MB
          • SHA256 29777d3e311415ec7d2f4233e8f44f180b47f1a1c260870714ac95936e52a004
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Runtime.InteropServices.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\System.Runtime.InteropServices.dll
          • Size 93KB
          • SHA256 02f9e9969b29a027ac5fb9f24c681170413231fa8a84da2658120ca11e91b6dc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Runtime.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\System.Runtime.dll
          • Size 42KB
          • SHA256 126facb35c9ba044401173748825e1c4c1197aea7b68e443e2fe8b82fc6f0f5f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Threading.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\System.Threading.dll
          • Size 81KB
          • SHA256 b734d6a999a1d275ed30bf66e7532175aaae5ad40ffc9bd30ebab458de878b9a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WinRT.Runtime.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\WinRT.Runtime.dll
          • Size 516KB
          • SHA256 bcf3a14e8712a90837fc5c0d8c8a24696af2bd7f74e9767597ec81ededfb23db
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          clrjit.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\clrjit.dll
          • Size 1.7MB
          • SHA256 bd5936786cedc4119fa0508e41f5104ed351deae5c04c59e612f9c3a7b9aa65b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          coreclr.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\coreclr.dll
          • Size 4.8MB
          • SHA256 b600c8fdfe3210c55113dc9dc2a6f9e5630cb0b14f4efd8cc56e9d38df075e54
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          hostfxr.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\hostfxr.dll
          • Size 357KB
          • SHA256 0a495d3a7befebf627a973760439da0f7f1f1667b99832f083664fac7641d2dc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          hostpolicy.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\hostpolicy.dll
          • Size 397KB
          • SHA256 aec1393a96946d92ff061ce31a455559b773122218cd62af1df9a8328d60f70b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          is-IDSB9K9W8U.tmp
          • Path C:\Program Files\Proton\VPN\v4.4.1\is-IDSB9K9W8U.tmp
          • Size 245KB
          • SHA256 9f90955a42a154f2efcd564723e9c3be8d68e41185bfa01476d0adac30a40c7e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          state.rsm
          • Path C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\state.rsm
          • Size 980B
          • SHA256 a0e5c011958924a6a19f75e933190c685cc2f767688bfe18914ab944e390628d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dd_vcredist_amd64_20260709044636_000_vcRuntimeMinimum_x64.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260709044636_000_vcRuntimeMinimum_x64.log
          • Size 2KB
          • SHA256 9ad6d9321a7b62e63f0af673e2d0e398029eec5b19895f506279872ca5c9fa1c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dd_vcredist_amd64_20260709044636_001_vcRuntimeAdditional_x64.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260709044636_001_vcRuntimeAdditional_x64.log
          • Size 3KB
          • SHA256 2101ca2ce328ccf2ab250d12668218778a0c224f0f10a2dc2bdaeeafa8f44889
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ProtonVPN.InstallActions.x86.dll
          • Path C:\Users\Admin\AppData\Local\Temp\is-1YOD9A537D.tmp\ProtonVPN.InstallActions.x86.dll
          • Size 460KB
          • SHA256 87e106374a5612c02486e19ecca2ae67b482c72f2dac67855040d7cce994b220
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VC_redist.x64.exe
          • Path C:\Users\Admin\AppData\Local\Temp\is-1YOD9A537D.tmp\VC_redist.x64.exe
          • Size 17.7MB
          • SHA256 8995548dfffcde7c49987029c764355612ba6850ee09a7b6f0fddc85bdc5c280
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ProtonVPN_v4.4.1_x64.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\is-78GL8ZW3AX.tmp\ProtonVPN_v4.4.1_x64.tmp
          • Size 3.8MB
          • SHA256 94fa0009490e7e57a6bea8bb4d59eed1293e14f1040640af78d059366e7b53f3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          logo.png
          • Path C:\Windows\Temp\{064B4CA1-9094-4DC3-A3BE-987A4235C575}\.ba\logo.png
          • Size 1KB
          • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{064B4CA1-9094-4DC3-A3BE-987A4235C575}\.ba\wixstdba.dll
          • Size 215KB
          • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cab2C04DDC374BD96EB5C8EB8208F2C7C92
          • Path C:\Windows\Temp\{064B4CA1-9094-4DC3-A3BE-987A4235C575}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
          • Size 5.4MB
          • SHA256 62a859b0db8bca416c7b6ad2ad5d2c84a4890a39e5d45cbec75f90a2fd328749
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cab5046A8AB272BF37297BB7928664C9503
          • Path C:\Windows\Temp\{064B4CA1-9094-4DC3-A3BE-987A4235C575}\cab5046A8AB272BF37297BB7928664C9503
          • Size 967KB
          • SHA256 c346d91193246b18301cce532f2ae784fb377cb068d77bd22edec238e5746aa7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeAdditional_x64
          • Path C:\Windows\Temp\{064B4CA1-9094-4DC3-A3BE-987A4235C575}\vcRuntimeAdditional_x64
          • Size 208KB
          • SHA256 275d770dc4332bf6f3eae9ebc544ed07e3b169de791ba3d20ad50f04d9d222df
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeMinimum_x64
          • Path C:\Windows\Temp\{064B4CA1-9094-4DC3-A3BE-987A4235C575}\vcRuntimeMinimum_x64
          • Size 208KB
          • SHA256 57d65221ca418dabfcc6320215b2c05eec907690aa4f93384f2007eb9e1394b0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VC_redist.x64.exe
          • Path C:\Windows\Temp\{3E00407D-CA48-405D-B489-9E58C57DB7FE}\.cr\VC_redist.x64.exe
          • Size 615KB
          • SHA256 806e6252db45be78bfc064eb9a774dd1320d8f9aa70dd746996a1d9ddf9b8fd4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{8CD5DDC8-46F3-4F51-9F3A-31BAF1EE2506}\.ba\wixstdba.dll
          • Size 191KB
          • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/2756-2617-0x0000000000610000-0x0000000000687000-memory.dmp
          Download

          memory/3048-2614-0x0000000000610000-0x0000000000687000-memory.dmp
          Download

          memory/3764-2616-0x0000000000610000-0x0000000000687000-memory.dmp
          Download

          memory/4076-22-0x0000000003C80000-0x0000000003DC0000-memory.dmp
          Download

          memory/4076-12-0x0000000003C80000-0x0000000003DC0000-memory.dmp
          Download

          memory/4076-6-0x0000000000D70000-0x0000000000D71000-memory.dmp
          Download

          memory/4076-20-0x00000000004E0000-0x00000000008C1000-memory.dmp
          Download

          memory/4076-21-0x0000000000D70000-0x0000000000D71000-memory.dmp
          Download

          memory/4076-2632-0x00000000004E0000-0x00000000008C1000-memory.dmp
          Download

          memory/4076-2456-0x00000000004E0000-0x00000000008C1000-memory.dmp
          Download

          memory/4076-1145-0x00000000004E0000-0x00000000008C1000-memory.dmp
          Download

          memory/4076-694-0x0000000003C80000-0x0000000003DC0000-memory.dmp
          Download

          memory/4076-106-0x00000000004E0000-0x00000000008C1000-memory.dmp
          Download

          memory/4452-2633-0x0000000000F60000-0x0000000001085000-memory.dmp
          Download

          memory/4452-19-0x0000000000F60000-0x0000000001085000-memory.dmp
          Download

          memory/4452-0-0x0000000000F60000-0x0000000001085000-memory.dmp
          Download